@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/agent_board_fleet_machine_hijack.test.sql

@@ -0,0 +1,190 @@
+-- #141 register_fleet_machine fleet-ownership hijack.
+--
+-- machine_fingerprint is globally unique, so a fingerprint conflict can target ANY owner's
+-- machine. The fix gates the `on conflict do update` with `where owner_agent_id = <resolved
+-- actor>` and raises 42501 when the conflicting row belongs to a different owner. These
+-- assertions pin: (a) a cross-owner re-register RAISES and leaves the victim row untouched,
+-- (b) a same-owner re-register still updates descriptive fields, and (c) a same-owner
+-- re-register does NOT resurrect a deliberately revoked machine.
+--
+-- Tests run as session_user=postgres => _is_service_role() is true => _resolved_actor_agent_id
+-- returns the supplied p_owner_agent_id verbatim, so owner A and owner B are addressed
+-- directly. (The authenticated-actor path -- p_owner must match current_agent_id() -- is
+-- already covered by agent_board_fleet_policy.test.sql's impersonation block.)
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(14);
+
+select has_function(
+  'agent_board', 'register_fleet_machine',
+  array['uuid', 'uuid', 'text', 'text', 'text', 'jsonb'],
+  'register_fleet_machine exists'
+);
+
+create temp table _hijack_fx (
+  owner_a uuid,
+  owner_b uuid,
+  domain_a uuid,
+  domain_b uuid,
+  machine uuid
+) on commit drop;
+
+grant all on table _hijack_fx to authenticated, service_role;
+
+do $$
+declare
+  v_owner_a uuid := gen_random_uuid();
+  v_owner_b uuid := gen_random_uuid();
+  v_domain_a uuid;
+  v_domain_b uuid;
+  v_machine uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_owner_a, 'agent', 'fleet-hijack-owner-a', 'Fleet Hijack Owner A'),
+    (v_owner_b, 'agent', 'fleet-hijack-owner-b', 'Fleet Hijack Owner B');
+
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values
+    ('fleet-hijack-domain-a', 'Hijack Domain A', 'tailnet', v_owner_a, 'active', now()),
+    ('fleet-hijack-domain-b', 'Hijack Domain B', 'external', v_owner_b, 'active', now());
+
+  select id into v_domain_a from agent_board.fleet_trust_domains where slug = 'fleet-hijack-domain-a';
+  select id into v_domain_b from agent_board.fleet_trust_domains where slug = 'fleet-hijack-domain-b';
+
+  -- Owner A registers the machine that owner B will try to steal.
+  select machine_id
+    into v_machine
+    from agent_board.register_fleet_machine(
+      v_owner_a, v_domain_a, 'owner-a-claw', 'sha256:fleet-hijack-fixture', 'portal', '{"redacted":true}'::jsonb
+    );
+
+  insert into _hijack_fx(owner_a, owner_b, domain_a, domain_b, machine)
+  values (v_owner_a, v_owner_b, v_domain_a, v_domain_b, v_machine);
+end
+$$;
+
+-- (1) Cross-owner re-register of an existing fingerprint RAISES 42501.
+-- Mutation pin: neutering the `where owner_agent_id = v_actor_agent_id` gate on the
+-- do-update (e.g. `where true`) lets the cross-owner update proceed and this THROWS_OK
+-- flips to `not ok` (the call lives instead of raising).
+select throws_ok(
+  $$ select * from agent_board.register_fleet_machine(
+       (select owner_b from _hijack_fx),
+       (select domain_b from _hijack_fx),
+       'owner-b-steal',
+       'sha256:fleet-hijack-fixture',
+       'portal',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  '42501',
+  NULL,
+  'cross-owner re-register of an existing fingerprint raises 42501'
+);
+
+-- (2)(3) The victim row is untouched by the failed hijack: owner and lifecycle unchanged.
+-- Mutation pin: additionally restoring `owner_agent_id = excluded.owner_agent_id` to the
+-- do-update (the original stealing upsert) flips assertion (2) -- the owner becomes owner_b.
+select is(
+  (select owner_agent_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  (select owner_a from _hijack_fx),
+  'failed hijack leaves owner_agent_id unchanged (still owner A)'
+);
+select is(
+  (select lifecycle_state from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  'active',
+  'failed hijack leaves lifecycle_state unchanged (still active)'
+);
+
+-- (4)(5) No cross-owner WRITE at all: the descriptive fields the attacker supplied
+-- (label, trust domain) are also untouched. My do-update writes machine_label and
+-- trust_domain_id unconditionally once the owner-gate opens, so neutering that gate
+-- (mutation 1) flips these directly -- pinning the no-cross-owner-write property, not
+-- just the raise.
+select is(
+  (select machine_label from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  'owner-a-claw',
+  'failed hijack leaves machine_label unchanged (attacker label not written)'
+);
+select is(
+  (select trust_domain_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  (select domain_a from _hijack_fx),
+  'failed hijack leaves trust_domain_id unchanged (attacker domain not written)'
+);
+
+-- (6) Same-owner re-register still succeeds and updates descriptive fields.
+select lives_ok(
+  $$ create temp table _hijack_rereg as
+       select * from agent_board.register_fleet_machine(
+         (select owner_a from _hijack_fx),
+         (select domain_a from _hijack_fx),
+         'owner-a-claw-renamed',
+         'sha256:fleet-hijack-fixture',
+         'portal',
+         '{"redacted":true}'::jsonb
+       ) $$,
+  'same-owner re-register succeeds'
+);
+
+-- (7)(8)(9) It is the SAME row, the label updated, and the owner is still owner A.
+select is(
+  (select machine_id from _hijack_rereg),
+  (select machine from _hijack_fx),
+  'same-owner re-register updates the existing row (machine_id unchanged)'
+);
+select is(
+  (select machine_label from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  'owner-a-claw-renamed',
+  'same-owner re-register updates the machine label'
+);
+select is(
+  (select owner_agent_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  (select owner_a from _hijack_fx),
+  'same-owner re-register keeps owner_agent_id = owner A'
+);
+
+-- (10) Owner A revokes their own machine.
+select lives_ok(
+  $$ select * from agent_board.revoke_fleet_subject(
+       'machine',
+       (select machine from _hijack_fx),
+       (select owner_a from _hijack_fx),
+       'test revocation',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  'owner A revokes their machine'
+);
+
+-- (11) A same-owner re-register of the now-revoked machine still succeeds ...
+select lives_ok(
+  $$ select * from agent_board.register_fleet_machine(
+       (select owner_a from _hijack_fx),
+       (select domain_a from _hijack_fx),
+       'owner-a-claw-reregistered',
+       'sha256:fleet-hijack-fixture',
+       'portal',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  'same-owner re-register of a revoked machine succeeds'
+);
+
+-- (13)(14) ... but does NOT resurrect it: lifecycle_state and revoked_at are preserved.
+-- Mutation pin: restoring `lifecycle_state = 'active', revoked_at = null` to the do-update
+-- (the original un-revoke) flips both assertions.
+select is(
+  (select lifecycle_state from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  'revoked',
+  're-register does not resurrect a revoked machine (lifecycle_state stays revoked)'
+);
+select ok(
+  (select revoked_at is not null from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  're-register does not clear revoked_at of a revoked machine'
+);
+
+select * from finish();
+
+rollback;

package/tests/agent_board_fleet_machine_reactivation.test.sql

@@ -0,0 +1,426 @@
+-- #146 operator machine reactivation — supersede-based un-revoke.
+--
+-- reactivate_fleet_machine (service_role only) stamps fleet_machines.reactivated_at and
+-- clears revoked_at/lifecycle so machine-revocation READERS ignore machine events
+-- at-or-before that supersession point. The readers are: evaluate_fleet_sender_policy and
+-- the v_fleet_machine_status read model. revoke_fleet_subject (the WRITER) advances the
+-- event's effective_at to now() on re-revocation so the append-only ledger stays
+-- authoritative (a re-revocation after reactivation supersedes reactivated_at).
+--
+-- These assertions pin:
+--   * revoke → policy denies; reactivate → the SAME sender passes (authority restored).
+--   * a re-revocation via the REAL writer denies again AND advances the ledger's effective_at
+--     past reactivated_at (supersession is prior-only; ledger stays authoritative — #146 panel
+--     MUST-FIX 1). Because now() is transaction-frozen in pgTAP, the re-revoke fixture ages
+--     the original revocation (event -2h) and the reactivation (marker -1h) so the real
+--     writer's now() re-revocation lands strictly after the supersession point.
+--   * reactivation supersedes ONLY the machine subject: a revoked trust_domain or a revoked
+--     sender agent stays denied after machine reactivation.
+--   * reactivation is operator-only: an authenticated caller (even the owner) is refused.
+--   * reactivating a non-revoked machine raises (nothing to reactivate).
+--   * v_fleet_machine_status.machine_revoked honors reactivated_at (#146 panel MUST-FIX 2).
+--   * rule #1 CLASS: every catalog-enumerated machine-subject revocation reader honors
+--     reactivated_at (a new non-conforming reader names itself); the WRITER exemption is
+--     asserted positively (it bumps effective_at=now()).
+--
+-- Tests run as session_user=postgres ⇒ _is_service_role() is true; the authz assertion flips
+-- to role=authenticated (jwt claims) to exercise the body guard.
+--
+-- Mutation pins (rule #2):
+--   * drop the machine-clause reactivated_at guard in the policy → (8) fails.
+--   * revert revoke_fleet_subject's UPDATE branch (remove `effective_at = now()`) → (12) fails
+--     (the aged event stays before reactivated_at → ledger not advanced).
+--   * remove the policy's lifecycle_state='revoked' guard → (11) STILL passes (the advanced
+--     event clause catches the re-revocation): 2-of-2 depth.
+--   * remove reactivate's _is_service_role() body guard → (17) fails.
+--   * add the reactivated_at guard to the trust_domain clause → (14) fails; to the agent
+--     clause → (16) fails.
+--   * revert v_fleet_machine_status.machine_revoked to bare event-existence → (19) fails.
+--   * add any machine-subject reader that omits reactivated_at → (21) fails and names it.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(22);
+
+-- (1)(2) Shape.
+select has_function(
+  'agent_board', 'reactivate_fleet_machine',
+  array['uuid', 'uuid', 'text'],
+  'reactivate_fleet_machine exists'
+);
+select has_column(
+  'agent_board', 'fleet_machines', 'reactivated_at',
+  'fleet_machines.reactivated_at supersession marker exists'
+);
+
+create temp table _react_fx (
+  recipient uuid,
+  owner uuid,          -- machine owner (registers machines); also the trust-domain owner
+  a1 uuid, a2 uuid, a3 uuid, a4 uuid, a5 uuid, a6 uuid,   -- sender agents
+  m1 uuid, m2 uuid, m3 uuid, m4 uuid, m5 uuid, m6 uuid,   -- machines
+  domain_main uuid,
+  domain_revoked uuid,
+  owner_user_id uuid
+) on commit drop;
+
+grant all on table _react_fx to authenticated, service_role;
+
+do $$
+declare
+  v_recipient uuid := gen_random_uuid();
+  v_owner uuid := gen_random_uuid();
+  v_a1 uuid := gen_random_uuid();
+  v_a2 uuid := gen_random_uuid();
+  v_a3 uuid := gen_random_uuid();
+  v_a4 uuid := gen_random_uuid();
+  v_a5 uuid := gen_random_uuid();
+  v_a6 uuid := gen_random_uuid();
+  v_domain_main uuid;
+  v_domain_revoked uuid;
+  v_m1 uuid; v_m2 uuid; v_m3 uuid; v_m4 uuid; v_m5 uuid; v_m6 uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_recipient, 'agent', 'react-recipient', 'React Recipient'),
+    (v_owner, 'agent', 'react-owner', 'React Owner'),
+    (v_a1, 'agent', 'react-sender-1', 'React Sender 1'),
+    (v_a2, 'agent', 'react-sender-2', 'React Sender 2'),
+    (v_a3, 'agent', 'react-sender-3', 'React Sender 3'),
+    (v_a4, 'agent', 'react-sender-4', 'React Sender 4'),
+    (v_a5, 'agent', 'react-sender-5', 'React Sender 5'),
+    (v_a6, 'agent', 'react-sender-6', 'React Sender 6');
+
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values
+    ('react-domain-main', 'React Domain Main', 'tailnet', v_owner, 'active', now()),
+    ('react-domain-revoked', 'React Domain Revoked', 'tailnet', v_owner, 'active', now());
+
+  select id into v_domain_main from agent_board.fleet_trust_domains where slug = 'react-domain-main';
+  select id into v_domain_revoked from agent_board.fleet_trust_domains where slug = 'react-domain-revoked';
+
+  select machine_id into v_m1 from agent_board.register_fleet_machine(v_owner, v_domain_main, 'react-m1', 'sha256:react-m1', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m2 from agent_board.register_fleet_machine(v_owner, v_domain_revoked, 'react-m2', 'sha256:react-m2', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m3 from agent_board.register_fleet_machine(v_owner, v_domain_main, 'react-m3', 'sha256:react-m3', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m4 from agent_board.register_fleet_machine(v_owner, v_domain_main, 'react-m4', 'sha256:react-m4', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m5 from agent_board.register_fleet_machine(v_owner, v_domain_main, 'react-m5', 'sha256:react-m5', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m6 from agent_board.register_fleet_machine(v_owner, v_domain_main, 'react-m6', 'sha256:react-m6', 'portal', '{"redacted":true}'::jsonb);
+
+  insert into agent_board.fleet_machine_agents(machine_id, agent_id, agent_role)
+  values
+    (v_m1, v_a1, 'phase_worker'),
+    (v_m2, v_a2, 'phase_worker'),
+    (v_m3, v_a3, 'phase_worker'),
+    (v_m4, v_a4, 'phase_worker'),
+    (v_m5, v_a5, 'phase_worker'),
+    (v_m6, v_a6, 'phase_worker');
+
+  -- Allow-by-default receive policy for the recipient: a non-revoked bound machine passes,
+  -- so the ONLY lever these assertions exercise is the machine-revocation state.
+  perform agent_board.set_fleet_receive_policy(v_recipient, 'react allow-by-default', 'allow', false, null, null, '{"senderPolicy":"open"}'::jsonb);
+
+  insert into _react_fx(recipient, owner, a1, a2, a3, a4, a5, a6, m1, m2, m3, m4, m5, m6, domain_main, domain_revoked)
+  values (v_recipient, v_owner, v_a1, v_a2, v_a3, v_a4, v_a5, v_a6, v_m1, v_m2, v_m3, v_m4, v_m5, v_m6, v_domain_main, v_domain_revoked);
+end
+$$;
+
+------------------------------------------------------------------------------------------
+-- CORE (m1): revoke → deny; reactivate → the SAME sender passes.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.revoke_fleet_subject('machine', (select m1 from _react_fx), (select owner from _react_fx), 'core revoke', '{"redacted":true}'::jsonb);
+end
+$$;
+
+-- (3) Revoked machine is denied.
+select is(
+  (select denial_class from agent_board.evaluate_fleet_sender_policy(
+    (select a1 from _react_fx), (select recipient from _react_fx), (select m1 from _react_fx), null, 'send_direct_message', null, false)),
+  'machine_revoked',
+  'core: revoked machine is denied before reactivation'
+);
+
+-- (4) Operator reactivation succeeds (allow-side lives_ok + separate state reads, #113).
+select lives_ok(
+  $$ create temp table _react_m1 as
+       select * from agent_board.reactivate_fleet_machine(
+         (select m1 from _react_fx), (select owner from _react_fx), 'operator brings m1 back') $$,
+  'core: service_role reactivation of m1 succeeds'
+);
+
+-- (5)(6)(7) Row is reconciled: reactivated_at stamped, lifecycle active, revoked_at cleared.
+select ok(
+  (select reactivated_at is not null from agent_board.fleet_machines where id = (select m1 from _react_fx)),
+  'core: reactivation stamps reactivated_at'
+);
+select is(
+  (select lifecycle_state from agent_board.fleet_machines where id = (select m1 from _react_fx)),
+  'active',
+  'core: reactivation sets lifecycle_state=active'
+);
+select ok(
+  (select revoked_at is null from agent_board.fleet_machines where id = (select m1 from _react_fx)),
+  'core: reactivation clears revoked_at'
+);
+
+-- (8) The SAME sender now passes. MUTATION PIN: dropping the reactivated_at guard on the
+-- machine clause makes the prior machine event match again → this flips to `not ok`.
+select is(
+  (select allowed from agent_board.evaluate_fleet_sender_policy(
+    (select a1 from _react_fx), (select recipient from _react_fx), (select m1 from _react_fx), null, 'send_direct_message', null, false)),
+  true,
+  'core: reactivation restores sender authority (same sender now passes)'
+);
+
+------------------------------------------------------------------------------------------
+-- LEDGER AUTHORITY (m6): a re-revocation via the REAL writer denies again AND advances the
+-- append-only ledger past reactivated_at (#146 panel MUST-FIX 1). now() is transaction-frozen,
+-- so the fixture ages the original revocation and the reactivation to create a real gap.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.revoke_fleet_subject('machine', (select m6 from _react_fx), (select owner from _react_fx), 'm6 initial revoke', '{"redacted":true}'::jsonb);
+  perform * from agent_board.reactivate_fleet_machine((select m6 from _react_fx), (select owner from _react_fx), 'm6 reactivate');
+  -- Simulate elapsed time (frozen now()): original revocation 2h ago, reactivation 1h ago.
+  -- Only fleet_machines.reactivated_at (a mutable marker) and the existing ledger row's
+  -- timestamp are aged; the RE-REVOCATION below uses the real writer, unmodified.
+  update agent_board.fleet_revocation_events
+     set effective_at = now() - interval '2 hours'
+   where subject_kind = 'machine' and subject_id = (select m6 from _react_fx);
+  update agent_board.fleet_machines
+     set reactivated_at = now() - interval '1 hour'
+   where id = (select m6 from _react_fx);
+end
+$$;
+
+-- (9) After the aged reactivation, the aged prior revocation is superseded → sender passes.
+select is(
+  (select allowed from agent_board.evaluate_fleet_sender_policy(
+    (select a6 from _react_fx), (select recipient from _react_fx), (select m6 from _react_fx), null, 'send_direct_message', null, false)),
+  true,
+  'ledger: reactivation holds over a real gap (aged prior revocation is superseded)'
+);
+
+-- (10) Re-revoke via the REAL writer.
+select lives_ok(
+  $$ select * from agent_board.revoke_fleet_subject('machine', (select m6 from _react_fx), (select owner from _react_fx), 'm6 re-revoke', '{"redacted":true}'::jsonb) $$,
+  'ledger: re-revoking a reactivated machine via the real writer succeeds'
+);
+
+-- (11) Denied again. MUTATION PIN: with the writer fix the ledger event now post-dates
+-- reactivated_at, so this denial survives removing the policy's lifecycle_state guard
+-- (the event clause catches it — 2-of-2 depth).
+select is(
+  (select denial_class from agent_board.evaluate_fleet_sender_policy(
+    (select a6 from _react_fx), (select recipient from _react_fx), (select m6 from _react_fx), null, 'send_direct_message', null, false)),
+  'machine_revoked',
+  'ledger: reactivated-then-revoked machine is denied again'
+);
+
+-- (12) MUST-FIX 1 PIN: the real writer advanced the append-only ledger past the supersession
+-- point. Reverting revoke_fleet_subject's UPDATE branch (no `effective_at = now()`) leaves the
+-- event at -2h < reactivated_at (-1h) → this flips to `not ok`.
+select ok(
+  (
+    (select effective_at from agent_board.fleet_revocation_events
+      where subject_kind = 'machine' and subject_id = (select m6 from _react_fx))
+    > (select reactivated_at from agent_board.fleet_machines where id = (select m6 from _react_fx))
+  ),
+  'ledger: re-revocation advances the append-only event effective_at past reactivated_at (ledger stays authoritative)'
+);
+
+------------------------------------------------------------------------------------------
+-- DOMAIN (m2): reactivating the machine does NOT un-revoke its trust domain.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.revoke_fleet_subject('machine', (select m2 from _react_fx), (select owner from _react_fx), 'domain-case machine revoke', '{"redacted":true}'::jsonb);
+  perform agent_board.revoke_fleet_subject('trust_domain', (select domain_revoked from _react_fx), (select owner from _react_fx), 'domain revoke', '{"redacted":true}'::jsonb);
+end
+$$;
+
+-- (13) Reactivate the machine only.
+select lives_ok(
+  $$ select * from agent_board.reactivate_fleet_machine((select m2 from _react_fx), (select owner from _react_fx), 'reactivate m2 in revoked domain') $$,
+  'domain: reactivating m2 (whose domain is revoked) succeeds'
+);
+
+-- (14) Still denied: the trust_domain clause is unchanged by machine reactivation.
+-- MUTATION PIN: adding the reactivated_at guard to the trust_domain clause flips this.
+select is(
+  (select denial_class from agent_board.evaluate_fleet_sender_policy(
+    (select a2 from _react_fx), (select recipient from _react_fx), (select m2 from _react_fx), null, 'send_direct_message', null, false)),
+  'machine_revoked',
+  'domain: machine reactivation does NOT un-revoke a revoked trust domain'
+);
+
+------------------------------------------------------------------------------------------
+-- AGENT (m3): reactivating the machine does NOT un-revoke the sender agent.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.revoke_fleet_subject('machine', (select m3 from _react_fx), (select owner from _react_fx), 'agent-case machine revoke', '{"redacted":true}'::jsonb);
+  perform agent_board.revoke_fleet_subject('agent', (select a3 from _react_fx), (select a3 from _react_fx), 'agent revoke', '{"redacted":true}'::jsonb);
+end
+$$;
+
+-- (15) Reactivate the machine only.
+select lives_ok(
+  $$ select * from agent_board.reactivate_fleet_machine((select m3 from _react_fx), (select owner from _react_fx), 'reactivate m3 with revoked agent') $$,
+  'agent: reactivating m3 (whose sender agent is revoked) succeeds'
+);
+
+-- (16) Still denied: the agent clause is unchanged by machine reactivation.
+-- MUTATION PIN: adding the reactivated_at guard to the agent clause flips this.
+select is(
+  (select denial_class from agent_board.evaluate_fleet_sender_policy(
+    (select a3 from _react_fx), (select recipient from _react_fx), (select m3 from _react_fx), null, 'send_direct_message', null, false)),
+  'machine_revoked',
+  'agent: machine reactivation does NOT un-revoke a revoked sender agent'
+);
+
+------------------------------------------------------------------------------------------
+-- AUTHZ (m4): operator-only. An authenticated caller — even the machine owner — is refused.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.revoke_fleet_subject('machine', (select m4 from _react_fx), (select owner from _react_fx), 'authz-case revoke', '{"redacted":true}'::jsonb);
+end
+$$;
+
+-- Map the owner agent to an auth user so the authenticated path resolves a principal.
+do $$
+declare
+  v_user_id uuid;
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+begin
+  v_user_id := public.ensure_github_user(
+    'react-owner-' || v_suffix,
+    'react-owner-' || v_suffix || '@example.test',
+    'react-owner-' || v_suffix,
+    'React Owner ' || v_suffix
+  );
+  update agent_board.agents set auth_user_id = v_user_id where id = (select owner from _react_fx);
+  update _react_fx set owner_user_id = v_user_id;
+end
+$$;
+
+create temp table _react_authz (denied boolean) on commit drop;
+grant all on table _react_authz to authenticated, service_role;
+
+-- Isolate the BODY guard from the grant: temporarily grant EXECUTE to authenticated so a
+-- call reaching the function body is refused by _is_service_role(), not the ACL. (Rolled
+-- back with the test transaction.) This pins the "callable by authenticated" mutation to the
+-- guard itself, independent of the service_role-only grant restated in the migration.
+grant execute on function agent_board.reactivate_fleet_machine(uuid, uuid, text) to authenticated;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select owner_user_id::text from _react_fx), true);
+
+do $$
+begin
+  begin
+    perform * from agent_board.reactivate_fleet_machine(
+      (select m4 from _react_fx), (select owner from _react_fx), 'authenticated owner attempt');
+    insert into _react_authz values (false);   -- reached completion → NOT denied
+  exception
+    when sqlstate '42501' then insert into _react_authz values (true);
+  end;
+end
+$$;
+
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+revoke execute on function agent_board.reactivate_fleet_machine(uuid, uuid, text) from authenticated;
+
+-- (17) MUTATION PIN: removing the _is_service_role() body guard lets the authenticated call
+-- complete → denied=false → this flips to `not ok`.
+select ok(
+  (select denied from _react_authz),
+  'authz: authenticated caller (even the owner) cannot reactivate (42501)'
+);
+
+------------------------------------------------------------------------------------------
+-- NON-REVOKED (m5): reactivating a machine that is not revoked raises (nothing to do).
+------------------------------------------------------------------------------------------
+-- (18)
+select throws_ok(
+  $$ select * from agent_board.reactivate_fleet_machine((select m5 from _react_fx), (select owner from _react_fx), 'reactivate a live machine') $$,
+  '22023',
+  NULL,
+  'non-revoked: reactivating a machine that is not revoked raises'
+);
+
+------------------------------------------------------------------------------------------
+-- READ MODEL (MUST-FIX 2): v_fleet_machine_status.machine_revoked honors reactivated_at.
+------------------------------------------------------------------------------------------
+-- (19) MUTATION PIN: reverting machine_revoked to bare event-existence flips this — m1 was
+-- reactivated, so its lingering (superseded) event must NOT read as revoked.
+select is(
+  (select machine_revoked from agent_board.v_fleet_machine_status where machine_id = (select m1 from _react_fx)),
+  false,
+  'view: a reactivated machine reports machine_revoked=false (agrees with the policy)'
+);
+
+-- (20) Sanity: a genuinely revoked-and-not-reactivated machine still reads revoked.
+select is(
+  (select machine_revoked from agent_board.v_fleet_machine_status where machine_id = (select m4 from _react_fx)),
+  true,
+  'view: a revoked (never reactivated) machine still reports machine_revoked=true'
+);
+
+------------------------------------------------------------------------------------------
+-- CLASS (rule #1): catalog-derived — every machine-subject revocation READER honors
+-- reactivated_at; the WRITER exemption is asserted positively.
+------------------------------------------------------------------------------------------
+-- (21) Enumerate readers (functions + views) whose definition tests a machine-subject
+-- revocation event (`fre.subject_kind = 'machine'`) but does NOT reference reactivated_at.
+-- Expected: none. A new non-conforming reader appears here BY NAME (rule #1: offenders name
+-- themselves). Aggregates are excluded (pg_get_functiondef errors on them; prokind='f').
+select is(
+  (
+    select string_agg(offender, ', ' order by offender)
+      from (
+        select p.proname as offender
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+         where n.nspname = 'agent_board'
+           and p.prokind = 'f'
+           and pg_get_functiondef(p.oid) ~ 'fre\.subject_kind = ''machine'''
+           and pg_get_functiondef(p.oid) not ilike '%reactivated_at%'
+        union all
+        select c.relname
+          from pg_class c
+          join pg_namespace n on n.oid = c.relnamespace
+         where n.nspname = 'agent_board'
+           and c.relkind = 'v'
+           and pg_get_viewdef(c.oid) ~ 'fre\.subject_kind = ''machine'''
+           and pg_get_viewdef(c.oid) not ilike '%reactivated_at%'
+      ) offenders
+  ),
+  null,
+  'class: every machine-subject revocation reader honors reactivated_at (offenders name themselves)'
+);
+
+-- (22) Positive exemption (rule #1): revoke_fleet_subject is the machine-revocation WRITER,
+-- not a state reader — its exemption claim is that it advances the ledger's effective_at.
+select ok(
+  (
+    select pg_get_functiondef(p.oid) ~ 'effective_at = now\(\)'
+      from pg_proc p
+      join pg_namespace n on n.oid = p.pronamespace
+     where n.nspname = 'agent_board'
+       and p.prokind = 'f'
+       and p.proname = 'revoke_fleet_subject'
+  ),
+  'class exemption: revoke_fleet_subject (the writer) advances effective_at=now() on re-revocation'
+);
+
+select * from finish();
+
+rollback;