@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/agent_board_fleet_machine_reclaim.test.sql

@@ -0,0 +1,509 @@
+-- #146 operator squatting-reclaim — reassign a squatted machine + revoke squatter access.
+--
+-- reclaim_fleet_machine (service_role only) is the arbitration escape hatch for a machine whose
+-- globally-unique fingerprint was pre-registered by a SQUATTER (someone other than the rightful
+-- owner), which #141 otherwise locks permanently. It (1) reassigns owner_agent_id to the
+-- arbitrated new owner, (2) revokes every ACTIVE fleet_machine_agents binding on THIS machine so
+-- the squatter loses access (machine-scoped, NOT a global revoke_fleet_subject('agent')), (3)
+-- leaves the machine active for the new owner (stamps reactivated_at), and (4, #150 panel MUST-FIX)
+-- optionally MOVES the machine into a trust domain owned by the new owner to close the squatter's
+-- trust-domain kill switch.
+--
+-- These assertions pin:
+--   * reclaim reassigns owner_agent_id (state) — PIN: skip the owner reassign ⇒ (3) fails and the
+--     squatter's ownership-based access (10) stays true.
+--   * reclaim revokes the squatter's binding (state) — PIN: skip the binding revoke ⇒ (4)/(5) fail
+--     and the worker's binding-based access (12) stays true.
+--   * MACHINE-SCOPING of the binding revoke — a worker bound on a DIFFERENT machine SURVIVES (8) —
+--     PIN: drop the `machine_id = p_machine_id` predicate ⇒ (8) fails.
+--   * ACCESS BRACKET (rule #2/#3): each "loses access" probe is bracketed by a BEFORE=true probe
+--     under the same authenticated principal, proving current_agent_id() resolves — so AFTER=false
+--     is a genuine revocation, not a null-actor artifact. Owner probe (A) isolates the ownership
+--     lever (owns m1, no binding); worker probe (W) isolates the binding lever (bound, owns nothing).
+--   * the new owner CAN claim the reclaimed machine, and fresh bindings work post-reclaim.
+--   * a squatted-THEN-revoked machine comes back active for the new owner (v_fleet_machine_status).
+--   * KILL SWITCH (#150 MUST-FIX): with p_new_trust_domain_id the machine MOVES (19) into the new
+--     owner's domain, and the squatter revoking the OLD domain can no longer deny it (20) — PIN:
+--     skip the domain move ⇒ (19) and (20) fail. Domain validation: a domain not owned by the new
+--     owner is rejected (24) — PIN: skip the validation ⇒ (24) fails.
+--   * reclaim is operator-only: an authenticated caller (the victim) is refused 42501 (21) — PIN:
+--     remove the _is_service_role() body guard ⇒ (21) fails (body guard isolated from the ACL by a
+--     temp grant to authenticated).
+--   * reclaim validates the new owner and the provenance agent exist (22, 23).
+--   * CLASS (rule #1 / EC-4): register_fleet_machine + reclaim_fleet_machine are the ONLY writers of
+--     fleet_machines.owner_agent_id (25) — catalog-derived, so a future owner-writer names itself.
+--
+-- Tests run as session_user=postgres ⇒ _is_service_role() is true; probes and the authz assertion
+-- flip to role=authenticated (jwt claims) to exercise the principal / body guard.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(29);
+
+-- (1) Shape.
+select has_function(
+  'agent_board', 'reclaim_fleet_machine',
+  array['uuid', 'uuid', 'uuid', 'text', 'uuid'],
+  'reclaim_fleet_machine exists'
+);
+
+create temp table _reclaim_fx (
+  operator uuid,       -- arbitration actor (p_reclaimed_by); no auth mapping needed
+  squatter uuid,       -- pre-registers the fingerprints; owner of m1..m5 and of the OLD domain
+  worker uuid,         -- squatter's sub-agent, BOUND to m1 (access purely via binding)
+  worker2 uuid,        -- bound on m2; used to pin machine-scoping (its binding must survive)
+  new_owner uuid,      -- arbitrated rightful owner; owns the NEW domain
+  victim uuid,         -- rightful human/agent locked out; used for the authz probe
+  m1 uuid, m2 uuid, m3 uuid, m4 uuid, m5 uuid, m6 uuid, m7 uuid,
+  fp1 text, fp5 text, fp6 text, fp7 text,
+  dom_old uuid,        -- squatter-owned domain (the kill switch)
+  dom_new uuid,        -- new-owner-owned domain (kill switch closed by moving into it)
+  squatter_user uuid,
+  worker_user uuid,
+  new_owner_user uuid,
+  victim_user uuid
+) on commit drop;
+
+grant all on table _reclaim_fx to authenticated, service_role;
+
+create temp table _reclaim_probe (label text, allowed boolean) on commit drop;
+grant all on table _reclaim_probe to authenticated, service_role;
+
+do $$
+declare
+  v_operator uuid := gen_random_uuid();
+  v_squatter uuid := gen_random_uuid();
+  v_worker uuid := gen_random_uuid();
+  v_worker2 uuid := gen_random_uuid();
+  v_new_owner uuid := gen_random_uuid();
+  v_victim uuid := gen_random_uuid();
+  v_dom_old uuid;
+  v_dom_new uuid;
+  v_m1 uuid; v_m2 uuid; v_m3 uuid; v_m4 uuid; v_m5 uuid; v_m6 uuid; v_m7 uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_operator, 'agent', 'reclaim-operator', 'Reclaim Operator'),
+    (v_squatter, 'agent', 'reclaim-squatter', 'Reclaim Squatter'),
+    (v_worker, 'agent', 'reclaim-worker', 'Reclaim Worker'),
+    (v_worker2, 'agent', 'reclaim-worker2', 'Reclaim Worker 2'),
+    (v_new_owner, 'agent', 'reclaim-new-owner', 'Reclaim New Owner'),
+    (v_victim, 'agent', 'reclaim-victim', 'Reclaim Victim');
+
+  -- The squatter owns the OLD domain and registers the fingerprints under it. The new owner owns a
+  -- separate NEW domain that the machine can be moved into to close the kill switch.
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values
+    ('reclaim-domain-old', 'Reclaim Domain Old', 'tailnet', v_squatter, 'active', now()),
+    ('reclaim-domain-new', 'Reclaim Domain New', 'tailnet', v_new_owner, 'active', now());
+  select id into v_dom_old from agent_board.fleet_trust_domains where slug = 'reclaim-domain-old';
+  select id into v_dom_new from agent_board.fleet_trust_domains where slug = 'reclaim-domain-new';
+
+  select machine_id into v_m1 from agent_board.register_fleet_machine(v_squatter, v_dom_old, 'reclaim-m1', 'sha256:reclaim-m1', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m2 from agent_board.register_fleet_machine(v_squatter, v_dom_old, 'reclaim-m2', 'sha256:reclaim-m2', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m3 from agent_board.register_fleet_machine(v_squatter, v_dom_old, 'reclaim-m3', 'sha256:reclaim-m3', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m4 from agent_board.register_fleet_machine(v_squatter, v_dom_old, 'reclaim-m4', 'sha256:reclaim-m4', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m5 from agent_board.register_fleet_machine(v_squatter, v_dom_old, 'reclaim-m5', 'sha256:reclaim-m5', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m6 from agent_board.register_fleet_machine(v_squatter, v_dom_old, 'reclaim-m6', 'sha256:reclaim-m6', 'portal', '{"redacted":true}'::jsonb);
+  select machine_id into v_m7 from agent_board.register_fleet_machine(v_squatter, v_dom_old, 'reclaim-m7', 'sha256:reclaim-m7', 'portal', '{"redacted":true}'::jsonb);
+
+  -- Worker bound to m1 (access purely via binding); worker2 bound to a DIFFERENT machine m2 (its
+  -- binding must SURVIVE an m1 reclaim — pins the machine_id scoping). The squatter's own access to
+  -- m1 is purely via ownership — this separates the ownership and binding revocation levers. The new
+  -- owner is bound to m7 (an unusual but valid case: the rightful owner was a worker on the squatted
+  -- machine) — reclaiming m7 to the new owner must NOT revoke the new owner's own binding.
+  insert into agent_board.fleet_machine_agents(machine_id, agent_id, agent_role)
+  values
+    (v_m1, v_worker, 'phase_worker'),
+    (v_m2, v_worker2, 'phase_worker'),
+    (v_m7, v_new_owner, 'phase_worker');
+
+  insert into _reclaim_fx(operator, squatter, worker, worker2, new_owner, victim, m1, m2, m3, m4, m5, m6, m7, fp1, fp5, fp6, fp7, dom_old, dom_new)
+  values (v_operator, v_squatter, v_worker, v_worker2, v_new_owner, v_victim, v_m1, v_m2, v_m3, v_m4, v_m5, v_m6, v_m7,
+          'sha256:reclaim-m1', 'sha256:reclaim-m5', 'sha256:reclaim-m6', 'sha256:reclaim-m7', v_dom_old, v_dom_new);
+end
+$$;
+
+-- Map the squatter, worker, new owner and victim agents to auth users so the authenticated
+-- probes/authz call resolve a principal via current_agent_id() → auth.uid().
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_squatter_user uuid;
+  v_worker_user uuid;
+  v_new_owner_user uuid;
+  v_victim_user uuid;
+begin
+  v_squatter_user := public.ensure_github_user('reclaim-squatter-' || v_sfx, 'reclaim-squatter-' || v_sfx || '@example.test', 'reclaim-squatter-' || v_sfx, 'Reclaim Squatter ' || v_sfx);
+  v_worker_user := public.ensure_github_user('reclaim-worker-' || v_sfx, 'reclaim-worker-' || v_sfx || '@example.test', 'reclaim-worker-' || v_sfx, 'Reclaim Worker ' || v_sfx);
+  v_new_owner_user := public.ensure_github_user('reclaim-newowner-' || v_sfx, 'reclaim-newowner-' || v_sfx || '@example.test', 'reclaim-newowner-' || v_sfx, 'Reclaim New Owner ' || v_sfx);
+  v_victim_user := public.ensure_github_user('reclaim-victim-' || v_sfx, 'reclaim-victim-' || v_sfx || '@example.test', 'reclaim-victim-' || v_sfx, 'Reclaim Victim ' || v_sfx);
+
+  update agent_board.agents set auth_user_id = v_squatter_user where id = (select squatter from _reclaim_fx);
+  update agent_board.agents set auth_user_id = v_worker_user where id = (select worker from _reclaim_fx);
+  update agent_board.agents set auth_user_id = v_new_owner_user where id = (select new_owner from _reclaim_fx);
+  update agent_board.agents set auth_user_id = v_victim_user where id = (select victim from _reclaim_fx);
+
+  update _reclaim_fx set squatter_user = v_squatter_user, worker_user = v_worker_user,
+                         new_owner_user = v_new_owner_user, victim_user = v_victim_user;
+end
+$$;
+
+------------------------------------------------------------------------------------------
+-- BEFORE probes (rule #2/#3 bracket): under each authenticated principal, capture that they CAN
+-- claim m1 today. A true here proves the principal resolves — so AFTER=false below is real.
+------------------------------------------------------------------------------------------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _reclaim_fx), true);
+do $$ begin
+  insert into _reclaim_probe values ('squatter_before', agent_board._can_claim_resource('machine', (select fp1 from _reclaim_fx)));
+end $$;
+select set_config('request.jwt.claim.sub', (select worker_user::text from _reclaim_fx), true);
+do $$ begin
+  insert into _reclaim_probe values ('worker_before', agent_board._can_claim_resource('machine', (select fp1 from _reclaim_fx)));
+end $$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+------------------------------------------------------------------------------------------
+-- CORE: operator reclaims m1 from the squatter to the new owner (no domain move — the m1 case
+-- exercises the ownership/binding levers).
+------------------------------------------------------------------------------------------
+-- (2) Reclaim succeeds (allow-side lives_ok + separate state reads, #113).
+select lives_ok(
+  $$ create temp table _reclaim_m1 as
+       select * from agent_board.reclaim_fleet_machine(
+         (select m1 from _reclaim_fx), (select new_owner from _reclaim_fx),
+         (select operator from _reclaim_fx), 'operator arbitrated: fingerprint belongs to new owner') $$,
+  'core: service_role reclaim of m1 succeeds'
+);
+
+-- (3) Owner is reassigned. MUTATION PIN: skipping the owner reassignment leaves owner=squatter.
+select is(
+  (select owner_agent_id from agent_board.fleet_machines where id = (select m1 from _reclaim_fx)),
+  (select new_owner from _reclaim_fx),
+  'core: reclaim reassigns owner_agent_id to the new owner'
+);
+
+-- (4) The squatter's (worker's) binding on m1 is revoked. MUTATION PIN: skipping the binding revoke
+-- leaves it 'active'.
+select is(
+  (select lifecycle_state from agent_board.fleet_machine_agents
+     where machine_id = (select m1 from _reclaim_fx) and agent_id = (select worker from _reclaim_fx)),
+  'revoked',
+  'core: reclaim revokes the squatter''s binding on the machine'
+);
+
+-- (5) The returned revoked-binding count reflects the one active binding removed.
+select is((select revoked_binding_count from _reclaim_m1), 1,
+  'core: reclaim reports revoked_binding_count = 1');
+
+-- (6) Audit APPENDED to metadata.reclaim_history: last record has operator + prior owner (#150
+-- SHOULD-FIX: append, not overwrite).
+select ok(
+  (select (metadata -> 'reclaim_history' -> -1 ->> 'reclaimed_by') = (select operator::text from _reclaim_fx)
+      and (metadata -> 'reclaim_history' -> -1 ->> 'prior_owner') = (select squatter::text from _reclaim_fx)
+     from agent_board.fleet_machines where id = (select m1 from _reclaim_fx)),
+  'core: reclaim audit (reclaimed_by + prior owner) appended to metadata.reclaim_history'
+);
+
+-- (7) The machine is left active for the new owner, with the supersession marker stamped.
+select ok(
+  (select lifecycle_state = 'active' and revoked_at is null and reactivated_at is not null
+     from agent_board.fleet_machines where id = (select m1 from _reclaim_fx)),
+  'core: reclaim leaves the machine active and stamps reactivated_at'
+);
+
+-- (8) MACHINE-SCOPING: worker2's binding on the OTHER machine m2 SURVIVES the m1 reclaim.
+-- MUTATION PIN: dropping the `machine_id = p_machine_id` predicate revokes worker2 too → this flips.
+select is(
+  (select lifecycle_state from agent_board.fleet_machine_agents
+     where machine_id = (select m2 from _reclaim_fx) and agent_id = (select worker2 from _reclaim_fx)),
+  'active',
+  'scoping: a binding on a different machine survives the reclaim'
+);
+
+------------------------------------------------------------------------------------------
+-- AFTER probes: claim authority on m1 post-reclaim.
+------------------------------------------------------------------------------------------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _reclaim_fx), true);
+do $$ begin
+  insert into _reclaim_probe values ('squatter_after', agent_board._can_claim_resource('machine', (select fp1 from _reclaim_fx)));
+end $$;
+select set_config('request.jwt.claim.sub', (select worker_user::text from _reclaim_fx), true);
+do $$ begin
+  insert into _reclaim_probe values ('worker_after', agent_board._can_claim_resource('machine', (select fp1 from _reclaim_fx)));
+end $$;
+select set_config('request.jwt.claim.sub', (select new_owner_user::text from _reclaim_fx), true);
+do $$ begin
+  insert into _reclaim_probe values ('new_owner_after', agent_board._can_claim_resource('machine', (select fp1 from _reclaim_fx)));
+end $$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- (9)(10) Owner lever: could claim before (bracket) → cannot after (PIN skip owner reassign).
+select is((select allowed from _reclaim_probe where label = 'squatter_before'), true,
+  'bracket: the squatter (owner) could claim m1 before reclaim');
+select is((select allowed from _reclaim_probe where label = 'squatter_after'), false,
+  'squatter: loses ownership-based claim authority after reclaim');
+-- (11)(12) Binding lever: could claim before (bracket) → cannot after (PIN skip binding revoke).
+select is((select allowed from _reclaim_probe where label = 'worker_before'), true,
+  'bracket: the squatter''s worker could claim m1 before reclaim (via binding)');
+select is((select allowed from _reclaim_probe where label = 'worker_after'), false,
+  'worker: loses binding-based claim authority after reclaim');
+-- (13) The new owner CAN claim the reclaimed machine.
+select is((select allowed from _reclaim_probe where label = 'new_owner_after'), true,
+  'new owner: gains claim authority over the reclaimed machine');
+
+------------------------------------------------------------------------------------------
+-- FRESH BINDING: the new owner can bind agents on the reclaimed machine.
+------------------------------------------------------------------------------------------
+-- (14)
+select lives_ok(
+  $$ insert into agent_board.fleet_machine_agents(machine_id, agent_id, agent_role)
+       values ((select m1 from _reclaim_fx), (select new_owner from _reclaim_fx), 'phase_worker') $$,
+  'fresh binding: a new binding for the new owner on the reclaimed machine succeeds'
+);
+-- (15)
+select is(
+  (select lifecycle_state from agent_board.fleet_machine_agents
+     where machine_id = (select m1 from _reclaim_fx) and agent_id = (select new_owner from _reclaim_fx)),
+  'active',
+  'fresh binding: the new owner''s binding is active'
+);
+
+------------------------------------------------------------------------------------------
+-- REVOKED-THEN-RECLAIM (m4): a squatted machine that was revoked comes back active for the new
+-- owner; v_fleet_machine_status agrees.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.revoke_fleet_subject('machine', (select m4 from _reclaim_fx), (select squatter from _reclaim_fx), 'squatter revoke before reclaim', '{"redacted":true}'::jsonb);
+end
+$$;
+-- (16)
+select lives_ok(
+  $$ select * from agent_board.reclaim_fleet_machine(
+       (select m4 from _reclaim_fx), (select new_owner from _reclaim_fx),
+       (select operator from _reclaim_fx), 'reclaim a revoked-then-squatted machine') $$,
+  'revoked-reclaim: reclaiming a revoked machine succeeds'
+);
+-- (17)
+select is(
+  (select machine_revoked from agent_board.v_fleet_machine_status where machine_id = (select m4 from _reclaim_fx)),
+  false,
+  'revoked-reclaim: v_fleet_machine_status reports machine_revoked=false after reclaim'
+);
+
+------------------------------------------------------------------------------------------
+-- KILL SWITCH (#150 MUST-FIX, m5): reclaim WITH p_new_trust_domain_id moves the machine into the
+-- new owner's domain; the squatter revoking the OLD domain can no longer deny it.
+------------------------------------------------------------------------------------------
+-- (18) Reclaim m5 moving it into the new owner's domain.
+select lives_ok(
+  $$ select * from agent_board.reclaim_fleet_machine(
+       (select m5 from _reclaim_fx), (select new_owner from _reclaim_fx),
+       (select operator from _reclaim_fx), 'reclaim + move into new owner domain',
+       (select dom_new from _reclaim_fx)) $$,
+  'kill-switch: reclaim with a destination domain succeeds'
+);
+-- (19) The machine now sits in the new owner's domain. MUTATION PIN: skipping the domain move
+-- leaves it in the squatter''s old domain → this flips.
+select is(
+  (select trust_domain_id from agent_board.fleet_machines where id = (select m5 from _reclaim_fx)),
+  (select dom_new from _reclaim_fx),
+  'kill-switch: reclaim moves the machine into the destination trust domain'
+);
+
+-- The squatter (still owner of the OLD domain) revokes it via the authenticated domain-owner path.
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _reclaim_fx), true);
+do $$ begin
+  perform agent_board.revoke_fleet_subject('trust_domain', (select dom_old from _reclaim_fx), (select squatter from _reclaim_fx), 'squatter tries to kill the reclaimed machine', '{"redacted":true}'::jsonb);
+end $$;
+-- New owner probes claim authority on the moved machine (still in the live NEW domain).
+select set_config('request.jwt.claim.sub', (select new_owner_user::text from _reclaim_fx), true);
+do $$ begin
+  insert into _reclaim_probe values ('killswitch_new_owner', agent_board._can_claim_resource('machine', (select fp5 from _reclaim_fx)));
+end $$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- (20) The squatter's OLD-domain revocation cannot reach the moved machine. MUTATION PIN: skipping
+-- the domain move leaves m5 in the old domain → the revocation denies → this flips to false.
+select is((select allowed from _reclaim_probe where label = 'killswitch_new_owner'), true,
+  'kill-switch: the squatter revoking the old domain cannot deny the moved machine');
+
+------------------------------------------------------------------------------------------
+-- AUTHZ (m2): operator-only. An authenticated caller (the victim) is refused. The BODY guard is
+-- isolated from the service_role-only grant by a temp grant to authenticated.
+------------------------------------------------------------------------------------------
+create temp table _reclaim_authz (denied boolean) on commit drop;
+grant all on table _reclaim_authz to authenticated, service_role;
+
+grant execute on function agent_board.reclaim_fleet_machine(uuid, uuid, uuid, text, uuid) to authenticated;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select victim_user::text from _reclaim_fx), true);
+do $$
+begin
+  begin
+    perform * from agent_board.reclaim_fleet_machine(
+      (select m2 from _reclaim_fx), (select victim from _reclaim_fx),
+      (select victim from _reclaim_fx), 'victim self-reclaim attempt');
+    insert into _reclaim_authz values (false);   -- reached completion → NOT denied
+  exception
+    when sqlstate '42501' then insert into _reclaim_authz values (true);
+  end;
+end
+$$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+revoke execute on function agent_board.reclaim_fleet_machine(uuid, uuid, uuid, text, uuid) from authenticated;
+
+-- (21) MUTATION PIN: removing the _is_service_role() body guard lets the authenticated call
+-- complete → denied=false → this flips.
+select ok(
+  (select denied from _reclaim_authz),
+  'authz: authenticated caller (the victim) cannot reclaim (42501) — operator-only'
+);
+
+------------------------------------------------------------------------------------------
+-- VALIDATION.
+------------------------------------------------------------------------------------------
+-- (22) unknown new owner
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_machine(%L::uuid, %L::uuid, %L::uuid, 'unknown new owner') $$,
+    (select m3 from _reclaim_fx), gen_random_uuid(), (select operator from _reclaim_fx)),
+  '22023', NULL, 'validate: reclaim to an unknown new owner raises'
+);
+-- (23) unknown provenance
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_machine(%L::uuid, %L::uuid, %L::uuid, 'unknown provenance') $$,
+    (select m3 from _reclaim_fx), (select new_owner from _reclaim_fx), gen_random_uuid()),
+  '22023', NULL, 'validate: reclaim with an unknown reclaimed_by agent raises'
+);
+-- (24) destination domain not owned by the new owner (here dom_old is owned by the squatter).
+-- MUTATION PIN: skipping the p_new_trust_domain_id validation lets this through → no raise → flips.
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_machine(%L::uuid, %L::uuid, %L::uuid, 'domain not owned by new owner', %L::uuid) $$,
+    (select m3 from _reclaim_fx), (select new_owner from _reclaim_fx), (select operator from _reclaim_fx), (select dom_old from _reclaim_fx)),
+  '42501', NULL, 'validate: a destination domain not owned by the new owner is rejected'
+);
+
+------------------------------------------------------------------------------------------
+-- CLASS (rule #1 / EC-4): catalog-derived — register_fleet_machine + reclaim_fleet_machine are the
+-- ONLY writers of fleet_machines.owner_agent_id. A future owner-writer appears here BY NAME.
+-- WRITER = a function whose definition either INSERTs owner_agent_id into fleet_machines (register)
+-- or UPDATEs fleet_machines assigning owner_agent_id (reclaim). Reads (WHERE owner_agent_id = ...)
+-- do not match. Aggregates excluded (pg_get_functiondef errors; prokind='f').
+------------------------------------------------------------------------------------------
+-- (25)
+select is(
+  (
+    select string_agg(proname, ', ' order by proname)
+      from (
+        select p.proname
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+         where n.nspname = 'agent_board'
+           and p.prokind = 'f'
+           and (
+             pg_get_functiondef(p.oid) ~ 'insert into agent_board\.fleet_machines\s*\([^)]*owner_agent_id'
+             or pg_get_functiondef(p.oid) ~ 'update agent_board\.fleet_machines[^;]*owner_agent_id\s*='
+           )
+      ) writers
+  ),
+  'reclaim_fleet_machine, register_fleet_machine',
+  'class: register + reclaim are the only writers of fleet_machines.owner_agent_id (a new writer names itself)'
+);
+
+------------------------------------------------------------------------------------------
+-- AUDIT APPEND (#150 SHOULD-FIX, rule #2): a SECOND reclaim of the same machine APPENDS to
+-- metadata.reclaim_history rather than overwriting it, so prior reclaim records are preserved.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform * from agent_board.reclaim_fleet_machine(
+    (select m1 from _reclaim_fx), (select victim from _reclaim_fx),
+    (select operator from _reclaim_fx), 'second arbitration on the same machine');
+end
+$$;
+-- (26) MUTATION PIN: reverting the audit to overwrite (a single-element array / flat keys) leaves
+-- reclaim_history at length 1 → this flips.
+select is(
+  (select jsonb_array_length(metadata -> 'reclaim_history') from agent_board.fleet_machines where id = (select m1 from _reclaim_fx)),
+  2,
+  'audit: a repeated reclaim appends to reclaim_history (prior record preserved)'
+);
+
+------------------------------------------------------------------------------------------
+-- CLAIM RELEASE (#150 codex MUST-FIX 2, m6): a squatter's ACTIVE machine claim on the reclaimed
+-- fingerprint is released so the new owner can acquire immediately. Acquire as service_role with
+-- explicit agent_ids (service_role short-circuits authority; _resolved_actor_agent_id returns the
+-- passed id). FUTURE lease so acquire_claim's own stale-sweep does not clear it — only reclaim's
+-- release does (else the pin is fake).
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform * from agent_board.acquire_claim(
+    (select squatter from _reclaim_fx), 'machine', (select fp6 from _reclaim_fx), now() + interval '1 hour');
+  perform * from agent_board.reclaim_fleet_machine(
+    (select m6 from _reclaim_fx), (select new_owner from _reclaim_fx),
+    (select operator from _reclaim_fx), 'reclaim releases the squatter claim');
+end
+$$;
+
+-- (27) STATE PIN: the squatter's claim on the fingerprint is released. MUTATION PIN: skipping the
+-- claim-release step leaves it 'active'.
+select is(
+  (select status from agent_board.claims
+     where resource_kind = 'machine' and resource_key = (select fp6 from _reclaim_fx)
+       and agent_id = (select squatter from _reclaim_fx)),
+  'released',
+  'claim: reclaim releases the squatter''s active machine claim on the fingerprint'
+);
+
+-- (28) AVAILABILITY: the new owner can now acquire the machine claim. MUTATION PIN: skipping the
+-- claim release leaves the squatter's active claim → acquire raises 23505 → this lives_ok flips.
+select lives_ok(
+  $$ select * from agent_board.acquire_claim(
+       (select new_owner from _reclaim_fx), 'machine', (select fp6 from _reclaim_fx), now() + interval '1 hour') $$,
+  'claim: the new owner can acquire the reclaimed machine claim immediately after reclaim'
+);
+
+------------------------------------------------------------------------------------------
+-- DEFENSIVE (#150 codex, m7): reclaiming to a new owner who ALREADY holds a binding on the machine
+-- must NOT revoke the new owner's own binding.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform * from agent_board.reclaim_fleet_machine(
+    (select m7 from _reclaim_fx), (select new_owner from _reclaim_fx),
+    (select operator from _reclaim_fx), 'reclaim preserves the new owner binding');
+end
+$$;
+-- (29) MUTATION PIN: dropping `and fma.agent_id <> p_new_owner_agent_id` from the binding revoke
+-- revokes the new owner's own binding → this flips.
+select is(
+  (select lifecycle_state from agent_board.fleet_machine_agents
+     where machine_id = (select m7 from _reclaim_fx) and agent_id = (select new_owner from _reclaim_fx)),
+  'active',
+  'defensive: reclaim does not revoke the new owner''s own existing binding'
+);
+
+select * from finish();
+
+rollback;

package/tests/agent_board_fleet_machines_rls.test.sql

@@ -0,0 +1,79 @@
+-- #132 — the fleet_machines authenticated SELECT policy must let a bound agent (and the owner)
+-- read its machine, and no one else. Before the correlation fix the binding arm was dead
+-- (`fma.machine_id = fma.id`), so assertion 1 is the mutation pin: it returns 0 with the bug and
+-- 1 with the fix. Runs the RLS probes under `set local role authenticated` (RLS is bypassed for
+-- the postgres/superuser connection, so the fixture is built as postgres then probed as
+-- authenticated with request.jwt.claim.sub selecting the actor).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public;
+
+begin;
+
+select plan(4);
+
+do $$
+declare
+  v_owner_user uuid; v_bound_user uuid; v_nonbound_user uuid;
+begin
+  v_owner_user    := public.ensure_github_user('fm132-owner', 'fm132-owner@example.test', 'fm132-owner', 'FM132 Owner');
+  v_bound_user    := public.ensure_github_user('fm132-bound', 'fm132-bound@example.test', 'fm132-bound', 'FM132 Bound');
+  v_nonbound_user := public.ensure_github_user('fm132-non',   'fm132-non@example.test',   'fm132-non',   'FM132 NonBound');
+
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    ('fee70000-0000-0000-0000-00000000a001', 'agent', 'agent', 'fm132-owner', 'FM132 Owner',    'active', v_owner_user, v_owner_user),
+    ('fee70000-0000-0000-0000-00000000a002', 'agent', 'agent', 'fm132-bound', 'FM132 Bound',    'active', v_bound_user, v_bound_user),
+    ('fee70000-0000-0000-0000-00000000a003', 'agent', 'agent', 'fm132-non',   'FM132 NonBound', 'active', v_nonbound_user, v_nonbound_user);
+
+  insert into agent_board.fleet_trust_domains(id, slug, display_name, domain_kind, owner_agent_id)
+  values ('fee70000-0000-0000-0000-0000000000d1', 'fm132-domain', 'FM132 Domain', 'tailnet', 'fee70000-0000-0000-0000-00000000a001');
+
+  insert into agent_board.fleet_machines(id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint, lifecycle_state)
+  values ('fee70000-0000-0000-0000-0000000000c1', 'fee70000-0000-0000-0000-0000000000d1', 'fee70000-0000-0000-0000-00000000a001', 'FM132 Machine', 'fm132-fingerprint', 'active');
+
+  -- active binding: the BOUND agent runs on the machine.
+  insert into agent_board.fleet_machine_agents(id, machine_id, agent_id, lifecycle_state)
+  values ('fee70000-0000-0000-0000-0000000000e1', 'fee70000-0000-0000-0000-0000000000c1', 'fee70000-0000-0000-0000-00000000a002', 'active');
+
+  perform set_config('_fm132.owner', v_owner_user::text, true);
+  perform set_config('_fm132.bound', v_bound_user::text, true);
+  perform set_config('_fm132.non',   v_nonbound_user::text, true);
+end
+$$;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- THE FIX (mutation pin): a bound agent sees its machine via the binding arm. Was 0 (dead
+-- self-comparison), now 1.
+select set_config('request.jwt.claim.sub', current_setting('_fm132.bound'), true);
+select is(
+  (select count(*)::int from agent_board.fleet_machines where id = 'fee70000-0000-0000-0000-0000000000c1'),
+  1, 'a bound active agent can SELECT its own machine (correlation fixed)');
+
+-- a non-bound agent sees nothing.
+select set_config('request.jwt.claim.sub', current_setting('_fm132.non'), true);
+select is(
+  (select count(*)::int from agent_board.fleet_machines where id = 'fee70000-0000-0000-0000-0000000000c1'),
+  0, 'a non-bound agent cannot see the machine');
+
+-- the owner sees it via the owner arm (unaffected by the fix).
+select set_config('request.jwt.claim.sub', current_setting('_fm132.owner'), true);
+select is(
+  (select count(*)::int from agent_board.fleet_machines where id = 'fee70000-0000-0000-0000-0000000000c1'),
+  1, 'the machine owner can SELECT its machine (owner arm)');
+
+-- a REVOKED binding no longer grants visibility.
+reset role;
+update agent_board.fleet_machine_agents set lifecycle_state = 'revoked', revoked_at = now()
+ where id = 'fee70000-0000-0000-0000-0000000000e1';
+set local role authenticated;
+select set_config('request.jwt.claim.sub', current_setting('_fm132.bound'), true);
+select is(
+  (select count(*)::int from agent_board.fleet_machines where id = 'fee70000-0000-0000-0000-0000000000c1'),
+  0, 'a revoked binding no longer grants machine visibility');
+
+reset role;
+select * from finish();
+
+rollback;

package/tests/agent_board_fleet_policy.test.sql

@@ -110,8 +110,8 @@ begin
 
   insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
   values
-    (v_sender, 'primary', 1, repeat('A', 43), 'raw_ed25519_base64url', 'sha256:' || repeat('A', 43), 'active', 'proven'),
-    (v_revoked_key_sender, 'revoked', 1, repeat('B', 43), 'raw_ed25519_base64url', 'sha256:' || repeat('B', 43), 'active', 'proven');
+    (v_sender, 'primary', 1, public.test_pubkey(v_sender::text), 'raw_ed25519_base64url', public.test_key_fingerprint(v_sender::text), 'active', 'proven'),
+    (v_revoked_key_sender, 'revoked', 1, public.test_pubkey(v_revoked_key_sender::text), 'raw_ed25519_base64url', public.test_key_fingerprint(v_revoked_key_sender::text), 'active', 'proven');
 
   select id into v_signing_key from agent_board.agent_signing_keys where agent_id = v_sender;
   select id into v_revoked_signing_key from agent_board.agent_signing_keys where agent_id = v_revoked_key_sender;