@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/agent_board_fedsession_provider_absence_gate.test.sql

@@ -0,0 +1,170 @@
+-- Consiliency/message-board#193 pgTAP: enroll_federated_human must reject an
+-- ABSENT (issuer, audience) BEFORE it provisions or locks the human owner.
+--
+-- WHY THE GATE IS WHERE IT IS. PostgreSQL cannot row-lock a row that does not
+-- exist, so with the provider absent there was nothing for the board/provider
+-- ordering to attach to: the function skipped it, locked auth.users, and delegated
+-- -- and the delegate's fresh READ COMMITTED snapshot could then see a provider
+-- committed in the gap and auto-join its default board while this transaction held
+-- the owner. Owner -> board, inverted against fleet onboarding.
+--
+-- WHAT THIS FILE CAN AND CANNOT PROVE. A single pgTAP transaction cannot exhibit
+-- the interleaving; the load-bearing proof is
+-- tests/isolation/specs/fedsession_provider_absent_owner_lock.spec, where a guard
+-- session holds the owner row and the pre-fix function BLOCKS while the fixed one
+-- raises without waiting. What is pinned HERE is (a) that the rejection comes from
+-- the pre-lock gate and not from the delegate's identical-verdict step (4) -- which
+-- is why the two messages differ -- (b) that it is positionally ahead of the owner
+-- provisioning in the shipped definition, and (c) that the deeper provider gates and
+-- the auto-join allow path are unchanged.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(8);
+
+-- G-1: the ABSENT-provider rejection, identified by the pre-lock gate's own message.
+-- The delegate raises the same 42501 with a DIFFERENT message, so an errcode-only
+-- assertion here would pass with the gate removed.
+select throws_ok(
+  $$ select agent_board.enroll_federated_human(
+       'https://lo193-absent.test', 'message-board', 'lo193-orphan',
+       jsonb_build_object('sub','lo193-orphan'), null) $$,
+  '42501',
+  'issuer/audience not in the identity-provider allowlist (rejected before any owner or board lock)',
+  'G-1: an absent (issuer,audience) is rejected by the PRE-LOCK gate');
+
+-- G-2: and it is positionally ahead of owner provisioning in the shipped body.
+--
+-- WHAT THIS ASSERTION HAD TO SURVIVE, because each version read as evidence while
+-- being defeatable. The marker is located on a body with comments and dollar-quoted
+-- blocks stripped and single-quoted literals KEPT (the raise message is a literal,
+-- so stripping literals would remove the very thing being located), and it is
+-- anchored to the RAISE SHAPE rather than to the bare message:
+--   * bare message on raw text  -> a one-line comment quoting the message passes it
+--     with the gate moved below _ensure_agent_auth_user;
+--   * bare message on the stripped body -> `raise debug 'ordering note: %', '<msg>'`
+--     or `declare v_note text := '<msg>'` passes it the same way. Both verified.
+--   * raise-exception-shaped on the stripped body -> all four masks fail, including
+--     a composite that also makes the provider freeze null-tolerant and goes 8/8
+--     GREEN against every other assertion here with the owner provisioned before the
+--     verdict.
+-- RESIDUAL, stated rather than implied: this narrows the vector, it does not close
+-- the shape. A dead-code `raise exception '<msg>'` earlier in the body still passes.
+-- What that residual cannot reach is the LOCK order: a gate moved below the
+-- auth.users FOR UPDATE is caught by
+-- tests/isolation/specs/fedsession_provider_absent_owner_lock.spec (the call goes
+-- `<waiting ...>` instead of raising), verified by mutation. A gate moved below
+-- _ensure_agent_auth_user but ABOVE that lock is caught by NEITHER the spec nor the
+-- pre-remedy G-2 -- which is precisely the hole this anchoring closes.
+select is(
+  (select case
+            when p_gate = 0 then 'gate-missing'
+            when p_ensure = 0 or p_lock is null then 'owner-provisioning-not-found'
+            when p_gate < p_ensure and p_gate < p_lock then 'gate-before-owner'
+            else 'gate-after-owner'
+          end
+     from (
+       select coalesce(strpos(d, substring(d from
+                $g$raise\s+exception\s+'issuer/audience not in the identity-provider allowlist \(rejected before any owner or board lock\)'$g$)), 0) as p_gate,
+              strpos(d, '_ensure_agent_auth_user') as p_ensure,
+              strpos(d, substring(d from 'from\s+auth\.users[^;]{0,250}?for\s+update')) as p_lock
+         from (select regexp_replace(p.prosrc,
+                       $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
+                       '\2', 'g') as d
+                 from pg_proc p
+                 join pg_namespace n on n.oid = p.pronamespace
+                where n.nspname = 'agent_board'
+                  and p.proname = 'enroll_federated_human') s
+     ) t),
+  'gate-before-owner',
+  'G-2: the absence gate precedes both _ensure_agent_auth_user and the auth.users lock');
+
+-- Fixtures for the allow side and for the deeper gates the new one must not shadow.
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+values ('193a0000-0000-0000-0000-000000000001', 'agent', 'agent',
+        'lo193-owner', 'LO193 Owner', 'active');
+
+select count(*) from agent_board.create_board(
+  '193a0000-0000-0000-0000-000000000001', 'lo193-board', 'LO193 Board',
+  'Consiliency/message-board#193 provider-absence gate', jsonb_build_object(), 'private');
+
+insert into agent_board.identity_providers(
+  issuer, audience, supported, policy_approved,
+  allowed_scopes, allowed_board_scopes, allowed_agent_kinds, default_board_id)
+values
+  ('https://lo193-autojoin.test', 'message-board', true, true,
+   ARRAY[]::text[], ARRAY[]::text[], ARRAY['agent','human'],
+   (select id from agent_board.boards where slug = 'lo193-board')),
+  ('https://lo193-noboard.test', 'message-board', true, true,
+   ARRAY[]::text[], ARRAY[]::text[], ARRAY['agent','human'], null),
+  ('https://lo193-unapproved.test', 'message-board', true, false,
+   ARRAY[]::text[], ARRAY[]::text[], ARRAY['agent','human'], null);
+
+-- G-3/G-4: provider PRESENT with a designated default board -- enrollment succeeds
+-- and the auto-join still lands. The gate narrowed the absent case only.
+select lives_ok(
+  $$ select agent_board.enroll_federated_human(
+       'https://lo193-autojoin.test', 'message-board', 'lo193-joiner',
+       jsonb_build_object('sub','lo193-joiner'), 'LO193 Joiner') $$,
+  'G-3: an allowlisted provider with a default board still enrolls');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships m
+     join agent_board.agents a on a.id = m.agent_id
+    where m.board_id = (select id from agent_board.boards where slug = 'lo193-board')
+      and a.metadata #>> ARRAY['federation','subject'] = 'lo193-joiner'
+      and m.membership_state = 'joined'),
+  1, 'G-4: the fedsession auto-join still lands a joined membership');
+
+-- G-5: provider PRESENT with a NULL default board -- enrolls, no auto-join. This is
+-- the neighbouring absence 20260901000140 already handled (NULL designation), kept
+-- distinct from the provider-absent case this migration closes.
+select lives_ok(
+  $$ select agent_board.enroll_federated_human(
+       'https://lo193-noboard.test', 'message-board', 'lo193-plain',
+       jsonb_build_object('sub','lo193-plain'), 'LO193 Plain') $$,
+  'G-5: an allowlisted provider with no default board still enrolls');
+
+-- G-6: the deeper provider gates are NOT shadowed -- an allowlisted but
+-- unapproved provider still fails inside the delegate, with the delegate's own
+-- message. Asserted positively so "42501 came from somewhere" is never enough.
+select throws_ok(
+  $$ select agent_board.enroll_federated_human(
+       'https://lo193-unapproved.test', 'message-board', 'lo193-unapproved',
+       jsonb_build_object('sub','lo193-unapproved'), null) $$,
+  '42501', 'identity provider is not policy-approved',
+  'G-6: a present-but-unapproved provider is still rejected by the delegate');
+
+-- G-7: the pre-lock gate is the ONLY new rejection -- a present provider never
+-- reaches it. (Mutating the gate to fire unconditionally fails G-3/G-5/G-7.)
+select is(
+  (select count(*)::int
+     from agent_board.agents a
+    where a.kind = 'human'
+      and a.metadata #>> ARRAY['federation','subject'] in ('lo193-joiner', 'lo193-plain')),
+  2, 'G-7: both allowlisted enrollments provisioned their human agents');
+
+
+-- G-8: the CLASS of routes that reject an absent provider, enumerated from the
+-- catalog rather than described in prose. All four reject with 42501; none
+-- serializes the absence, and that is the recorded decision (#195) -- the
+-- serialization alternative was built, measured and reverted because no shipped
+-- caller can distinguish 42501 from a retryable code. A new route joining this
+-- class fails here and names itself.
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prokind = 'f'
+      and regexp_replace(p.prosrc,
+            $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
+            '\2', 'g') ~ 'not in the identity-provider allowlist'),
+  '_enroll_federated_human_after_revocation_gate, _enroll_federated_identity_once, '
+  || 'enroll_federated_human, enroll_federated_identity',
+  'G-8: exactly four routes reject an absent identity provider');
+
+select * from finish();
+rollback;

package/tests/agent_board_fleet_domain_reclaim.test.sql

@@ -0,0 +1,419 @@
+-- #153 whole-domain squatting arbitration — reassign a squatted fleet_trust_domain's owner.
+--
+-- reclaim_fleet_trust_domain (service_role only) is the operator arbitration path for a WHOLE
+-- domain squatted by someone other than its rightful owner — the residual #150's machine-level
+-- reclaim could not cover. It reassigns fleet_trust_domains.owner_agent_id to the arbitrated new
+-- owner under a row lock; the reassignment is atomic at the domain row and post-commit every authz
+-- site (revoke_fleet_subject('trust_domain'), register_fleet_machine, set_fleet_receive_policy) reads
+-- the new owner. SERIALIZATION CAVEAT (#159): only revoke_fleet_subject('trust_domain') is locked
+-- against an in-flight reclaim here; register_fleet_machine / set_fleet_receive_policy are NOT yet
+-- serialized (tracked in #159). It writes NO fleet_revocation_events row (a trust_domain ledger row
+-- over-denies the whole domain incl. the new owner — #150 divergence rationale), and APPENDS the
+-- audit to metadata.reclaim_history.
+--
+-- These assertions pin:
+--   * reclaim reassigns owner_agent_id (state + returned prior owner) — PIN: skip the reassign ⇒
+--     (3)/(10)/(12)/(13) fail (owner stays squatter, authority does not move).
+--   * NO trust_domain revocation event is written by reclaim (7) — PIN: add a revoke-event write ⇒
+--     a row appears ⇒ (7) fails. Pins the over-deny divergence rationale.
+--   * NON-GOAL scope: a machine in the reclaimed domain KEEPS owner=squatter (8) — PIN: also
+--     reassign machine owners ⇒ (8) fails. Documents domain-vs-machine separation.
+--   * AUTHORITY BRACKET (rule #2/#3): each authority probe is bracketed by a BEFORE probe under the
+--     same authenticated principal proving current_agent_id() resolves — so an AFTER flip is a
+--     genuine authority change, not a null-actor artifact. register_fleet_machine into the domain is
+--     the reversible authority lever: squatter CAN before / CANNOT after; new owner CANNOT before /
+--     CAN after (9-12). The kill switch itself: squatter's revoke('trust_domain') is REFUSED after
+--     reclaim (13) — PIN: skip reassign ⇒ squatter still owns ⇒ not refused ⇒ (13) fails.
+--   * reclaim is operator-only: an authenticated caller (the victim) is refused 42501 (14) — PIN:
+--     remove the _is_service_role() body guard ⇒ (14) fails (body guard isolated from the ACL by a
+--     temp grant to authenticated).
+--   * reclaim validates the new owner + provenance agent exist and the domain exists (15,16,17).
+--   * REVOKED-DOMAIN RESIDUAL (documented, positive pin): reclaim of a domain the squatter already
+--     revoked SUCCEEDS + transfers owner (18,19) but the domain STAYS revoked (20) — no domain
+--     un-revoke path today. Pins the boundary positively (rule #1) rather than leaving a silent gap.
+--   * AUDIT APPEND (rule #2): a second reclaim APPENDS to reclaim_history (21) — PIN: overwrite ⇒
+--     length stays 1 ⇒ (21) fails.
+--   * CLASS (rule #1 / EC-4): reclaim_fleet_trust_domain is the ONLY function-writer of
+--     fleet_trust_domains.owner_agent_id (22) — catalog-derived, so a future owner-writer names
+--     itself. (No RPC INSERTs a domain; domains are seeded by direct table INSERT, which is not a
+--     function and cannot match.)
+--
+-- Tests run as session_user=postgres ⇒ _is_service_role() is true; probes and the authz assertion
+-- flip to role=authenticated (jwt claims) to exercise the principal / body guard.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(22);
+
+-- (1) Shape.
+select has_function(
+  'agent_board', 'reclaim_fleet_trust_domain',
+  array['uuid', 'uuid', 'uuid', 'text'],
+  'reclaim_fleet_trust_domain exists'
+);
+
+create temp table _dr_fx (
+  operator uuid,      -- arbitration actor (p_reclaimed_by); no auth mapping needed
+  squatter uuid,      -- squats the domains; owner of dom_core/dom_revoked/dom_authz
+  new_owner uuid,     -- arbitrated rightful owner
+  victim uuid,        -- used for the operator-only authz probe
+  dom_core uuid,      -- main reclaim + authority + kill-switch
+  dom_revoked uuid,   -- revoked by the squatter BEFORE reclaim (residual pin)
+  dom_authz uuid,     -- operator-only probe target
+  m_core uuid,        -- a machine in dom_core (non-goal: stays owned by squatter)
+  squatter_user uuid,
+  new_owner_user uuid,
+  victim_user uuid
+) on commit drop;
+grant all on table _dr_fx to authenticated, service_role;
+
+create temp table _dr_probe (label text, allowed boolean) on commit drop;
+grant all on table _dr_probe to authenticated, service_role;
+
+do $$
+declare
+  v_operator uuid := gen_random_uuid();
+  v_squatter uuid := gen_random_uuid();
+  v_new_owner uuid := gen_random_uuid();
+  v_victim uuid := gen_random_uuid();
+  v_dom_core uuid;
+  v_dom_revoked uuid;
+  v_dom_authz uuid;
+  v_m_core uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_operator, 'agent', 'dr-operator', 'DR Operator'),
+    (v_squatter, 'agent', 'dr-squatter', 'DR Squatter'),
+    (v_new_owner, 'agent', 'dr-new-owner', 'DR New Owner'),
+    (v_victim, 'agent', 'dr-victim', 'DR Victim');
+
+  -- All three domains are squatted (owned by the squatter). dom_core + dom_authz active; dom_revoked
+  -- active now (revoked below via the squatter's own kill switch to exercise the residual).
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values
+    ('dr-domain-core', 'DR Domain Core', 'tailnet', v_squatter, 'active', now()),
+    ('dr-domain-revoked', 'DR Domain Revoked', 'tailnet', v_squatter, 'active', now()),
+    ('dr-domain-authz', 'DR Domain Authz', 'tailnet', v_squatter, 'active', now());
+  select id into v_dom_core from agent_board.fleet_trust_domains where slug = 'dr-domain-core';
+  select id into v_dom_revoked from agent_board.fleet_trust_domains where slug = 'dr-domain-revoked';
+  select id into v_dom_authz from agent_board.fleet_trust_domains where slug = 'dr-domain-authz';
+
+  -- A machine the squatter owns inside dom_core (non-goal: domain reclaim must NOT reassign it).
+  select machine_id into v_m_core from agent_board.register_fleet_machine(
+    v_squatter, v_dom_core, 'dr-m-core', 'sha256:dr-m-core', 'portal', '{"redacted":true}'::jsonb);
+
+  insert into _dr_fx(operator, squatter, new_owner, victim, dom_core, dom_revoked, dom_authz, m_core)
+  values (v_operator, v_squatter, v_new_owner, v_victim, v_dom_core, v_dom_revoked, v_dom_authz, v_m_core);
+end
+$$;
+
+-- Map the squatter, new owner and victim agents to auth users so the authenticated probes/authz
+-- call resolve a principal via current_agent_id() → auth.uid().
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_squatter_user uuid;
+  v_new_owner_user uuid;
+  v_victim_user uuid;
+begin
+  v_squatter_user := public.ensure_github_user('dr-squatter-' || v_sfx, 'dr-squatter-' || v_sfx || '@example.test', 'dr-squatter-' || v_sfx, 'DR Squatter ' || v_sfx);
+  v_new_owner_user := public.ensure_github_user('dr-newowner-' || v_sfx, 'dr-newowner-' || v_sfx || '@example.test', 'dr-newowner-' || v_sfx, 'DR New Owner ' || v_sfx);
+  v_victim_user := public.ensure_github_user('dr-victim-' || v_sfx, 'dr-victim-' || v_sfx || '@example.test', 'dr-victim-' || v_sfx, 'DR Victim ' || v_sfx);
+
+  update agent_board.agents set auth_user_id = v_squatter_user where id = (select squatter from _dr_fx);
+  update agent_board.agents set auth_user_id = v_new_owner_user where id = (select new_owner from _dr_fx);
+  update agent_board.agents set auth_user_id = v_victim_user where id = (select victim from _dr_fx);
+
+  update _dr_fx set squatter_user = v_squatter_user, new_owner_user = v_new_owner_user, victim_user = v_victim_user;
+end
+$$;
+
+------------------------------------------------------------------------------------------
+-- BEFORE authority probes (rule #2/#3 bracket): register_fleet_machine into dom_core is the
+-- reversible authority lever (requires ftd.owner_agent_id = actor). The squatter (owner) CAN; the
+-- new owner CANNOT — proving both principals resolve, so the AFTER flips below are genuine.
+------------------------------------------------------------------------------------------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select squatter from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-sqbefore', 'sha256:dr-m-sqbefore', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('squatter_before', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('squatter_before', false);
+  end;
+end $$;
+select set_config('request.jwt.claim.sub', (select new_owner_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select new_owner from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-nobefore', 'sha256:dr-m-nobefore', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('new_owner_before', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('new_owner_before', false);
+  end;
+end $$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+------------------------------------------------------------------------------------------
+-- CORE: operator reclaims dom_core from the squatter to the new owner.
+------------------------------------------------------------------------------------------
+-- (2) Reclaim succeeds (allow-side lives_ok + separate state reads, #113).
+select lives_ok(
+  $$ create temp table _dr_core as
+       select * from agent_board.reclaim_fleet_trust_domain(
+         (select dom_core from _dr_fx), (select new_owner from _dr_fx),
+         (select operator from _dr_fx), 'operator arbitrated: domain belongs to new owner') $$,
+  'core: service_role reclaim of dom_core succeeds'
+);
+
+-- (3) Owner is reassigned. MUTATION PIN: skipping the owner reassignment leaves owner=squatter.
+select is(
+  (select owner_agent_id from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  (select new_owner from _dr_fx),
+  'core: reclaim reassigns owner_agent_id to the new owner'
+);
+
+-- (4) The returned prior owner is the squatter.
+select is(
+  (select prior_owner_agent_id from _dr_core),
+  (select squatter from _dr_fx),
+  'core: reclaim returns the prior owner (the squatter)'
+);
+
+-- (5) Audit APPENDED to metadata.reclaim_history: last record has operator + prior owner.
+select ok(
+  (select (metadata -> 'reclaim_history' -> -1 ->> 'reclaimed_by') = (select operator::text from _dr_fx)
+      and (metadata -> 'reclaim_history' -> -1 ->> 'prior_owner') = (select squatter::text from _dr_fx)
+     from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  'core: reclaim audit (reclaimed_by + prior owner) appended to metadata.reclaim_history'
+);
+
+-- (6) The audit records the prior lifecycle (active here) — makes the revoked residual visible.
+select is(
+  (select metadata -> 'reclaim_history' -> -1 ->> 'prior_lifecycle_state'
+     from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  'active',
+  'core: reclaim audit records prior_lifecycle_state'
+);
+
+-- (7) NO trust_domain revocation event is written by reclaim (over-deny divergence rationale).
+-- MUTATION PIN: adding a fleet_revocation_events write to reclaim makes a row appear → this flips.
+select is(
+  (select count(*)::integer from agent_board.fleet_revocation_events
+     where subject_kind = 'trust_domain' and subject_id = (select dom_core from _dr_fx)),
+  0,
+  'core: reclaim writes NO trust_domain revocation event (no over-deny)'
+);
+
+-- (8) NON-GOAL: a machine in dom_core KEEPS owner=squatter (domain reclaim ≠ machine reclaim).
+-- MUTATION PIN: also reassigning machine owners in reclaim flips this to new_owner.
+select is(
+  (select owner_agent_id from agent_board.fleet_machines where id = (select m_core from _dr_fx)),
+  (select squatter from _dr_fx),
+  'non-goal: a machine in the reclaimed domain keeps owner=squatter'
+);
+
+------------------------------------------------------------------------------------------
+-- AFTER authority probes: register authority on dom_core post-reclaim, then the kill switch.
+------------------------------------------------------------------------------------------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select squatter from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-sqafter', 'sha256:dr-m-sqafter', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('squatter_after', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('squatter_after', false);
+  end;
+end $$;
+select set_config('request.jwt.claim.sub', (select new_owner_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select new_owner from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-noafter', 'sha256:dr-m-noafter', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('new_owner_after', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('new_owner_after', false);
+  end;
+end $$;
+-- Kill switch: the squatter (no longer owner) tries revoke_fleet_subject('trust_domain', dom_core).
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.revoke_fleet_subject('trust_domain', (select dom_core from _dr_fx),
+      (select squatter from _dr_fx), 'squatter tries the kill switch after losing the domain',
+      '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('squatter_killswitch_denied', false);   -- reached completion → NOT denied
+  exception when sqlstate '42501' then insert into _dr_probe values ('squatter_killswitch_denied', true);
+  end;
+end $$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- (9)(10) Authority lever (register): squatter COULD before (bracket) → CANNOT after (PIN skip reassign).
+select is((select allowed from _dr_probe where label = 'squatter_before'), true,
+  'bracket: the squatter (owner) could register into dom_core before reclaim');
+select is((select allowed from _dr_probe where label = 'squatter_after'), false,
+  'squatter: loses domain authority (cannot register into dom_core) after reclaim');
+-- (11)(12) New owner: CANNOT before (bracket) → CAN after (PIN skip reassign).
+select is((select allowed from _dr_probe where label = 'new_owner_before'), false,
+  'bracket: the new owner could NOT register into dom_core before reclaim');
+select is((select allowed from _dr_probe where label = 'new_owner_after'), true,
+  'new owner: gains domain authority (can register into dom_core) after reclaim');
+-- (13) KILL SWITCH removed: the squatter's revoke('trust_domain') is refused after reclaim.
+-- MUTATION PIN: skipping the owner reassign leaves the squatter owning dom_core → revoke is NOT
+-- refused → denied=false → this flips.
+select is((select allowed from _dr_probe where label = 'squatter_killswitch_denied'), true,
+  'kill-switch: the squatter''s revoke(trust_domain) is refused (42501) after reclaim');
+
+------------------------------------------------------------------------------------------
+-- AUTHZ (dom_authz): operator-only. An authenticated caller (the victim) is refused. The BODY guard
+-- is isolated from the service_role-only grant by a temp grant to authenticated.
+------------------------------------------------------------------------------------------
+create temp table _dr_authz (denied boolean) on commit drop;
+grant all on table _dr_authz to authenticated, service_role;
+
+grant execute on function agent_board.reclaim_fleet_trust_domain(uuid, uuid, uuid, text) to authenticated;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select victim_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform * from agent_board.reclaim_fleet_trust_domain(
+      (select dom_authz from _dr_fx), (select victim from _dr_fx),
+      (select victim from _dr_fx), 'victim self-reclaim attempt');
+    insert into _dr_authz values (false);   -- reached completion → NOT denied
+  exception when sqlstate '42501' then insert into _dr_authz values (true);
+  end;
+end
+$$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+revoke execute on function agent_board.reclaim_fleet_trust_domain(uuid, uuid, uuid, text) from authenticated;
+
+-- (14) MUTATION PIN: removing the _is_service_role() body guard lets the authenticated call
+-- complete → denied=false → this flips.
+select ok(
+  (select denied from _dr_authz),
+  'authz: authenticated caller (the victim) cannot reclaim (42501) — operator-only'
+);
+
+------------------------------------------------------------------------------------------
+-- VALIDATION.
+------------------------------------------------------------------------------------------
+-- (15) unknown new owner
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_trust_domain(%L::uuid, %L::uuid, %L::uuid, 'unknown new owner') $$,
+    (select dom_authz from _dr_fx), gen_random_uuid(), (select operator from _dr_fx)),
+  '22023', NULL, 'validate: reclaim to an unknown new owner raises'
+);
+-- (16) unknown provenance
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_trust_domain(%L::uuid, %L::uuid, %L::uuid, 'unknown provenance') $$,
+    (select dom_authz from _dr_fx), (select new_owner from _dr_fx), gen_random_uuid()),
+  '22023', NULL, 'validate: reclaim with an unknown reclaimed_by agent raises'
+);
+-- (17) unknown domain
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_trust_domain(%L::uuid, %L::uuid, %L::uuid, 'unknown domain') $$,
+    gen_random_uuid(), (select new_owner from _dr_fx), (select operator from _dr_fx)),
+  '22023', NULL, 'validate: reclaim of a non-existent domain raises'
+);
+
+------------------------------------------------------------------------------------------
+-- REVOKED-DOMAIN RESIDUAL (documented, positive pin): the squatter revokes dom_revoked first; the
+-- operator then reclaims it. Ownership transfers, but the domain STAYS revoked (no un-revoke path).
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.revoke_fleet_subject('trust_domain', (select dom_revoked from _dr_fx),
+    (select squatter from _dr_fx), 'squatter revoke before arbitration', '{"redacted":true}'::jsonb);
+end
+$$;
+-- (18)
+select lives_ok(
+  $$ select * from agent_board.reclaim_fleet_trust_domain(
+       (select dom_revoked from _dr_fx), (select new_owner from _dr_fx),
+       (select operator from _dr_fx), 'reclaim a revoked-then-squatted domain') $$,
+  'revoked-residual: reclaiming a revoked domain succeeds'
+);
+-- (19)
+select is(
+  (select owner_agent_id from agent_board.fleet_trust_domains where id = (select dom_revoked from _dr_fx)),
+  (select new_owner from _dr_fx),
+  'revoked-residual: reclaim of a revoked domain still transfers ownership'
+);
+-- (20) BOUNDARY AS BEHAVIOR: the owner-transfer SUCCEEDED (owner=new_owner) AND the domain is STILL
+-- revoked — one compound assertion so the intentional residual is pinned as behavior, not inferred
+-- across two checks. PIN (mutation H): making reclaim revive the domain (lifecycle='active' on the
+-- revoked branch) flips this; skipping the reassign (owner stays squatter) also flips it.
+select ok(
+  (select owner_agent_id = (select new_owner from _dr_fx) and lifecycle_state = 'revoked'
+     from agent_board.fleet_trust_domains where id = (select dom_revoked from _dr_fx)),
+  'revoked-residual: after a successful owner-transfer the pre-revoked domain STAYS revoked (intentional boundary)'
+);
+
+------------------------------------------------------------------------------------------
+-- AUDIT APPEND (rule #2): a SECOND reclaim of dom_core APPENDS to reclaim_history.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform * from agent_board.reclaim_fleet_trust_domain(
+    (select dom_core from _dr_fx), (select victim from _dr_fx),
+    (select operator from _dr_fx), 'second arbitration on the same domain');
+end
+$$;
+-- (21) MUTATION PIN: reverting the audit to overwrite (single-element array / flat keys) leaves
+-- reclaim_history at length 1 → this flips.
+select is(
+  (select jsonb_array_length(metadata -> 'reclaim_history') from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  2,
+  'audit: a repeated reclaim appends to reclaim_history (prior record preserved)'
+);
+
+------------------------------------------------------------------------------------------
+-- CLASS (rule #1 / EC-4): catalog-derived — reclaim_fleet_trust_domain is the ONLY writer of
+-- fleet_trust_domains.owner_agent_id. A future owner-writer appears here BY NAME. WRITER = a
+-- function whose definition INSERTs owner_agent_id into fleet_trust_domains or UPDATEs
+-- fleet_trust_domains assigning owner_agent_id. Reads (WHERE owner_agent_id = ...) and the lifecycle
+-- -only revoke UPDATE (no owner_agent_id =) do not match. Aggregates excluded (prokind='f').
+------------------------------------------------------------------------------------------
+-- (22)
+select is(
+  (
+    select string_agg(proname, ', ' order by proname)
+      from (
+        select p.proname
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+         where n.nspname = 'agent_board'
+           and p.prokind = 'f'
+           and (
+             pg_get_functiondef(p.oid) ~ 'insert into agent_board\.fleet_trust_domains\s*\([^)]*owner_agent_id'
+             or pg_get_functiondef(p.oid) ~ 'update agent_board\.fleet_trust_domains[^;]*owner_agent_id\s*='
+           )
+      ) writers
+  ),
+  'reclaim_fleet_trust_domain',
+  'class: reclaim_fleet_trust_domain is the only writer of fleet_trust_domains.owner_agent_id (a new writer names itself)'
+);
+
+select * from finish();
+
+rollback;