@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/agent_board_mint_fleet_agent_session.test.sql

@@ -80,17 +80,17 @@ begin
   -- Signing keys.
   insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
   values
-    (k_a1, v_a1, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a1::text,'-',''),43,'A'), 'active', 'proven'),
-    (k_a5, v_a5, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a5::text,'-',''),43,'A'), 'active', 'proven'),
-    (k_csusp, v_csusp, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_csusp::text,'-',''),43,'A'), 'active', 'proven'),
-    (k_a7, v_a7, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a7::text,'-',''),43,'A'), 'active', 'proven'),
-    (k_c2, v_c2, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_c2::text,'-',''),43,'A'), 'active', 'proven');
+    (k_a1, v_a1, 'primary', 1, public.test_pubkey(k_a1::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_a1::text), 'active', 'proven'),
+    (k_a5, v_a5, 'primary', 1, public.test_pubkey(k_a5::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_a5::text), 'active', 'proven'),
+    (k_csusp, v_csusp, 'primary', 1, public.test_pubkey(k_csusp::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_csusp::text), 'active', 'proven'),
+    (k_a7, v_a7, 'primary', 1, public.test_pubkey(k_a7::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_a7::text), 'active', 'proven'),
+    (k_c2, v_c2, 'primary', 1, public.test_pubkey(k_c2::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_c2::text), 'active', 'proven');
   -- Revoked key.
   insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state, revoked_at)
-  values (k_a3, v_a3, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a3::text,'-',''),43,'A'), 'revoked', 'revoked', now());
+  values (k_a3, v_a3, 'primary', 1, public.test_pubkey(k_a3::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_a3::text), 'revoked', 'revoked', now());
   -- Expired key.
   insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
-  values (k_a4, v_a4, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a4::text,'-',''),43,'A'), 'expired', 'expired');
+  values (k_a4, v_a4, 'primary', 1, public.test_pubkey(k_a4::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_a4::text), 'expired', 'expired');
 
   -- Challenges. Pending + unexpired unless noted.
   insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at, consumed_at)
@@ -156,7 +156,7 @@ begin
   insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id, granted_scopes, grant_expires_at)
   values (v_ce, v_root, v_root, v_pol, jsonb_build_array('scope:a'), now() - interval '1 minute');
   insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
-  values (k_ce, v_ce, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_ce::text,'-',''),43,'A'), 'active', 'proven');
+  values (k_ce, v_ce, 'primary', 1, public.test_pubkey(k_ce::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_ce::text), 'active', 'proven');
   insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at)
   values (ch_ce, k_ce, v_ce, ch_ce::text, 'x', 'pending', now() + interval '10 minutes');
 
@@ -166,7 +166,7 @@ begin
   insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id, granted_scopes, grant_expires_at)
   values (v_cl, v_root, v_root, v_pol, jsonb_build_array('scope:a'), now() + interval '2 hours');
   insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
-  values (k_cl, v_cl, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_cl::text,'-',''),43,'A'), 'active', 'proven');
+  values (k_cl, v_cl, 'primary', 1, public.test_pubkey(k_cl::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_cl::text), 'active', 'proven');
   insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at)
   values
     (ch_cl, k_cl, v_cl, ch_cl::text, 'x', 'pending', now() + interval '10 minutes'),
@@ -176,7 +176,7 @@ begin
   insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id)
   values (v_et, 'agent', 'gr-et-'||s, 'ET', 'active', u_et);
   insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state, expires_at)
-  values (k_et, v_et, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_et::text,'-',''),43,'A'), 'active', 'proven', now() - interval '1 minute');
+  values (k_et, v_et, 'primary', 1, public.test_pubkey(k_et::text), 'raw_ed25519_base64url', public.test_key_fingerprint(k_et::text), 'active', 'proven', now() - interval '1 minute');
   insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at)
   values (ch_et, k_et, v_et, ch_et::text, 'x', 'pending', now() + interval '10 minutes');
 

package/tests/agent_board_mint_harden.test.sql

@@ -0,0 +1,303 @@
+-- MINTHARDEN (#138) pgTAP — child-key fingerprint integrity + EF-mediated authenticated
+-- minting hardening. Every property is mutation-oriented (CLAUDE.md rule #2):
+--
+--   * catalog-derived fingerprint-writer SWEEP (a new string-derivation writer names
+--     itself) — rule #1;
+--   * table-boundary integrity TRIGGER (direct DML the sweep cannot see);
+--   * mint raw-byte fingerprint + cross-path dedup (same key => same fingerprint across
+--     mint and enroll, so the UNIQUE backstop finally bites);
+--   * non-positive-TTL floor;
+--   * F1 authenticated (self-service) RE-CLAMP of max_active_children and TTL ceiling —
+--     the stored caps are NOT trusted (a root can self-widen its policy, #142) — vs the
+--     operator path which keeps its latitude;
+--   * per-root provisioning RATE cap on the authenticated path only;
+--   * EXECUTE class: mint stays service_role-only (topology A; the EF is the auth surface).
+--
+-- Allow-side assertions use lives_ok(...) + a separate state read (never
+-- is((select ... from mint(...)))) so an allow that silently raises cannot pass green (#113).
+-- Runs as postgres (service_role-equivalent); p_self_service=true simulates the EF-forwarded
+-- authenticated call (the EF binds root==session; that binding is tested in the EF suite).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(31);
+
+create temp table _mh (
+  owner_id uuid,
+  r_key uuid, r_wide uuid, r_capnull uuid, r_rate uuid,
+  d_dup uuid, t_agent uuid,
+  k_dup text, k9 text, ktrig1 text, ktrig2 text
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  u_owner uuid;
+  v_r_key uuid := gen_random_uuid();
+  v_r_wide uuid := gen_random_uuid();
+  v_r_capnull uuid := gen_random_uuid();
+  v_r_rate uuid := gen_random_uuid();
+  v_d_dup uuid := gen_random_uuid();
+  v_t_agent uuid := gen_random_uuid();
+  v_k_dup text := rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+  v_k9 text := rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+  v_ktrig1 text := rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+  v_ktrig2 text := rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+  v_child uuid;
+  i int;
+begin
+  u_owner := public.ensure_github_user('mh-own-'||s, 'mh-own-'||s||'@example.test', 'mh-own-'||s, 'MH Owner');
+
+  -- r_key: root_minted, requires a child signing key, uncapped -> fingerprint + dedup + key tests.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+  values (v_r_key, 'agent', 'mh-rkey-'||s, 'MH RKey', 'active', u_owner);
+  insert into agent_board.delegation_policies(root_agent_id, mode, max_depth, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_r_key, 'root_minted', 1, jsonb_build_array('scope:a'), interval '8 hours', true);
+
+  -- r_wide: operator_vetted, uncapped, 30-day ceiling, no key -> F1 TTL clamp (op vs self).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+  values (v_r_wide, 'agent', 'mh-rwide-'||s, 'MH RWide', 'active', u_owner);
+  insert into agent_board.delegation_policies(root_agent_id, mode, max_depth, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_r_wide, 'root_minted', 1, jsonb_build_array('scope:a'), interval '30 days', false);
+
+  -- r_capnull: operator-set max_active_children=100 (a self-widened row), no key -> F1 cap
+  -- clamp. Pre-load 25 LIVE grants: self-service clamps to 25 (raise); operator keeps 100.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+  values (v_r_capnull, 'agent', 'mh-rcap-'||s, 'MH RCap', 'active', u_owner);
+  insert into agent_board.delegation_policies(root_agent_id, mode, max_depth, max_active_children, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_r_capnull, 'root_minted', 1, 100, jsonb_build_array('scope:a'), interval '8 hours', false);
+  for i in 1..25 loop
+    v_child := gen_random_uuid();
+    insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+    values (v_child, 'agent', 'mh-cap-child-'||s||'-'||i, 'MH Cap Child', 'active', u_owner);
+    insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id, granted_scopes, grant_expires_at)
+    select v_child, v_r_capnull, v_r_capnull, dp.id, '[]'::jsonb, now() + interval '1 hour'
+      from agent_board.delegation_policies dp where dp.root_agent_id = v_r_capnull;
+  end loop;
+
+  -- r_rate: uncapped, no key -> rate cap test. Pre-load 25 rate events (at the cap).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+  values (v_r_rate, 'agent', 'mh-rrate-'||s, 'MH RRate', 'active', u_owner);
+  insert into agent_board.delegation_policies(root_agent_id, mode, max_depth, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_r_rate, 'root_minted', 1, jsonb_build_array('scope:a'), interval '8 hours', false);
+  for i in 1..25 loop
+    insert into agent_board.child_mint_rate_events(root_agent_id, created_at) values (v_r_rate, now());
+  end loop;
+
+  -- d_dup: a dummy agent already holding the raw key k_dup (helper fingerprint) -> the
+  -- cross-path dedup collision target.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+  values (v_d_dup, 'agent', 'mh-ddup-'||s, 'MH DDup', 'active', u_owner);
+  insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (v_d_dup, 'primary', 1, v_k_dup, 'raw_ed25519_base64url', agent_board._raw_key_fingerprint(v_k_dup), 'active', 'proven');
+
+  -- t_agent: holder for the trigger integrity tests.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+  values (v_t_agent, 'agent', 'mh-trig-'||s, 'MH Trig', 'active', u_owner);
+
+  insert into _mh values (u_owner, v_r_key, v_r_wide, v_r_capnull, v_r_rate, v_d_dup, v_t_agent,
+                          v_k_dup, v_k9, v_ktrig1, v_ktrig2);
+end
+$$;
+
+-- ===========================================================================
+-- A. Catalog-derived fingerprint-writer sweep (rule #1) + helper derivation.
+-- ===========================================================================
+select has_function('agent_board', '_raw_key_fingerprint', array['text'], '_raw_key_fingerprint exists');
+
+-- No function INSERTing an agent_signing_keys.fingerprint bypasses the shared helper —
+-- a new divergent writer appears in this string and names itself.
+-- The MATERIALIZED CTE restricts pg_get_functiondef to agent_board NORMAL functions
+-- (prokind='f') first — otherwise the planner may evaluate it over pg_catalog aggregates
+-- (array_agg) and raise "X is an aggregate function".
+select is(
+  (with fns as materialized (
+     select p.oid, p.proname
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board' and p.prokind = 'f')
+   select coalesce(string_agg(proname, ', ' order by proname), '')
+     from fns
+    where pg_get_functiondef(oid) ~* 'insert[[:space:]]+into[[:space:]]+(agent_board\.)?agent_signing_keys'
+      and pg_get_functiondef(oid) ~ 'fingerprint'
+      and pg_get_functiondef(oid) !~ '_raw_key_fingerprint'),
+  '',
+  'no agent_signing_keys.fingerprint writer bypasses _raw_key_fingerprint (catalog-derived; a new writer names itself)');
+
+-- Positive: both live fingerprint writers derive through the helper.
+select ok(
+  (with fns as materialized (
+     select p.oid
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board' and p.prokind = 'f'
+        and p.proname in ('mint_delegated_child', 'enroll_federated_identity'))
+   select bool_and(pg_get_functiondef(oid) ~ '_raw_key_fingerprint') from fns),
+  'mint_delegated_child and enroll_federated_identity both derive via _raw_key_fingerprint');
+
+-- The helper derives over the RAW bytes, not the base64url string (revert => this flips).
+select is(
+  (select agent_board._raw_key_fingerprint(k9) from _mh),
+  (select 'sha256:' || rtrim(translate(encode(extensions.digest(
+     decode(translate(k9, '-_', '+/') || '=', 'base64'), 'sha256'), 'base64'), '+/', '-_'), '=') from _mh),
+  '_raw_key_fingerprint hashes the RAW 32 bytes');
+select ok(
+  (select agent_board._raw_key_fingerprint(k9) <> 'sha256:' || rtrim(translate(encode(extensions.digest(
+     convert_to(k9, 'UTF8'), 'sha256'), 'base64'), '+/', '-_'), '=') from _mh),
+  'the raw-byte fingerprint differs from the retired base64url-STRING derivation');
+
+-- ===========================================================================
+-- B. Table-boundary integrity trigger (catches direct/dynamic DML).
+-- ===========================================================================
+-- A raw key with a MISMATCHED fingerprint is rejected at the table boundary.
+select throws_ok(
+  (select format($q$insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+                    values (%L::uuid, 'bad', 1, %L, 'raw_ed25519_base64url', 'sha256:'||repeat('Z',43), 'active', 'proven')$q$,
+     t_agent, ktrig1) from _mh),
+  '23514', null, 'trigger rejects a raw key whose fingerprint != the raw-byte derivation');
+
+-- A raw key with the CORRECT fingerprint is accepted (lives_ok + state read, #113).
+select lives_ok(
+  (select format($q$insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+                    values (%L::uuid, 'good', 1, %L, 'raw_ed25519_base64url', agent_board._raw_key_fingerprint(%L), 'active', 'proven')$q$,
+     t_agent, ktrig1, ktrig1) from _mh),
+  'trigger accepts a raw key whose fingerprint matches the derivation');
+select is(
+  (select fingerprint from agent_board.agent_signing_keys k, _mh
+    where k.agent_id = _mh.t_agent and k.key_id = 'good'),
+  (select agent_board._raw_key_fingerprint(ktrig1) from _mh),
+  'the accepted key stored the raw-byte fingerprint');
+
+-- UPDATE-ing public_key to a different key while keeping the old fingerprint is rejected.
+select throws_ok(
+  (select format($q$update agent_board.agent_signing_keys set public_key = %L
+                     where agent_id = %L::uuid and key_id = 'good'$q$, ktrig2, t_agent) from _mh),
+  '23514', null, 'trigger rejects an UPDATE that swaps public_key without re-deriving the fingerprint');
+
+-- An UPDATE that touches neither key nor fingerprint is NOT re-validated (legacy rows stay operable).
+select lives_ok(
+  (select format($q$update agent_board.agent_signing_keys set metadata = jsonb_build_object('touched', true)
+                     where agent_id = %L::uuid and key_id = 'good'$q$, t_agent) from _mh),
+  'trigger skips an unrelated-column UPDATE (no key/fingerprint change)');
+
+-- MUST-FIX A: a public_key_format TOGGLE cannot smuggle a mismatched fingerprint into a raw
+-- row. Non-raw formats skip validation, so every transition INTO the raw format is validated.
+select lives_ok(
+  (select format($q$insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+                    values (%L::uuid, 'toggle', 2, %L, 'raw_ed25519_base64url', agent_board._raw_key_fingerprint(%L), 'active', 'proven')$q$,
+     t_agent, ktrig2, ktrig2) from _mh),
+  'seed a valid raw key for the format-toggle test');
+select lives_ok(
+  (select format($q$update agent_board.agent_signing_keys set public_key_format = 'spki_pem', fingerprint = 'sha256:'||repeat('Z',43)
+                     where agent_id = %L::uuid and key_id = 'toggle'$q$, t_agent) from _mh),
+  'flipping a key to a non-raw format is exempt (non-raw fingerprints are out of scope)');
+select throws_ok(
+  (select format($q$update agent_board.agent_signing_keys set public_key_format = 'raw_ed25519_base64url'
+                     where agent_id = %L::uuid and key_id = 'toggle'$q$, t_agent) from _mh),
+  '23514', null, 'flipping BACK to raw re-validates the fingerprint (toggle bypass closed)');
+
+-- ===========================================================================
+-- C. mint raw-byte fingerprint + cross-path dedup.
+-- ===========================================================================
+select lives_ok(
+  (select format($q$create temp table _m9 as select * from agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), %L)$q$,
+     r_key, 'mh-c9-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), k9) from _mh),
+  'operator mint with a signing key succeeds');
+select is(
+  (select k.fingerprint from agent_board.agent_signing_keys k
+    where k.agent_id = (select child_agent_id from _m9)),
+  (select agent_board._raw_key_fingerprint(k9) from _mh),
+  'minted child key stored the RAW-byte fingerprint (single-sourced with enroll)');
+
+-- Cross-path dedup: minting a child with a key already registered (d_dup) collides on the
+-- shared raw fingerprint. Under the retired string derivation the fingerprints differed and
+-- this mint SUCCEEDED — the mutation that reverts mint to string form flips this to a pass.
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), %L)$q$,
+     r_key, 'mh-dup-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), k_dup) from _mh),
+  '23505', null, 'minting a child with an already-registered key is rejected (shared raw fingerprint dedup)');
+
+-- ===========================================================================
+-- D. Non-positive-TTL floor (unconditional).
+-- ===========================================================================
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), null, interval '0')$q$,
+     r_wide, 'mh-t0-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _mh),
+  '22023', 'non_positive_ttl: requested grant TTL must be positive',
+  'mint rejects a zero TTL (immediately-expired grant escapes the child count)');
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), null, interval '-1 hour')$q$,
+     r_wide, 'mh-tn-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _mh),
+  '22023', 'non_positive_ttl: requested grant TTL must be positive',
+  'mint rejects a negative TTL');
+
+-- ===========================================================================
+-- E. F1 — authenticated (self-service) re-clamp vs operator latitude.
+-- ===========================================================================
+-- Operator path: the 30-day stored ceiling is honored (no clamp).
+select lives_ok(
+  (select format($q$create temp table _m_op_ttl as select * from agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), null, null, false)$q$,
+     r_wide, 'mh-opttl-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _mh),
+  'operator mint under a 30-day ceiling succeeds');
+select ok(
+  (select grant_expires_at > now() + interval '25 days' from _m_op_ttl),
+  'operator path is NOT TTL-clamped (grant honors the 30-day ceiling)');
+
+-- Self-service path: the ceiling is re-clamped to <= 24h regardless of the stored 30 days.
+select lives_ok(
+  (select format($q$create temp table _m_ss_ttl as select * from agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), null, null, true)$q$,
+     r_wide, 'mh-ssttl-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _mh),
+  'self-service mint under a 30-day stored ceiling succeeds');
+select ok(
+  (select grant_expires_at <= now() + interval '24 hours' + interval '1 minute' from _m_ss_ttl),
+  'self-service path re-clamps the TTL ceiling to <= 24h (stored 30-day ceiling NOT trusted)');
+
+-- Self-service cap: stored max_active_children=100 is re-clamped to 25; with 25 live grants
+-- the self-service mint is refused (the mutation dropping the clamp lets a 26th through).
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), null, null, true)$q$,
+     r_capnull, 'mh-sscap-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _mh),
+  '42501', 'max_active_children: root has reached its active delegated-child ceiling',
+  'self-service re-clamps max_active_children to 25 (stored 100 NOT trusted)');
+
+-- Operator path under the SAME 100-cap policy + 25 live grants still mints (its latitude).
+select lives_ok(
+  (select format($q$create temp table _m_op_cap as select * from agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), null, null, false)$q$,
+     r_capnull, 'mh-opcap-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _mh),
+  'operator path honors the stored 100 cap (25 < 100 => mint succeeds)');
+select is((select count(*) from _m_op_cap), 1::bigint,
+  'operator cap mint produced exactly one child (not a silent zero-row pass)');
+
+-- ===========================================================================
+-- F. Per-root provisioning RATE cap (authenticated path only).
+-- ===========================================================================
+-- r_rate has 25 rate events (at the cap) and 0 live grants, so only the rate cap can fire.
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), null, null, true)$q$,
+     r_rate, 'mh-ssrate-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _mh),
+  '42501', 'mint_rate_exceeded: root has reached its provisioning rate cap for the current window',
+  'self-service mint is refused once the per-root provisioning rate cap is reached');
+
+-- The operator path is NOT rate-capped (the same full rate table does not block it).
+select lives_ok(
+  (select format($q$create temp table _m_op_rate as select * from agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), null, null, false)$q$,
+     r_rate, 'mh-oprate-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _mh),
+  'operator path is not rate-capped (mints despite a full rate table)');
+select is((select count(*) from _m_op_rate), 1::bigint,
+  'operator rate-path mint produced exactly one child (not a silent zero-row pass)');
+
+-- ===========================================================================
+-- G. EXECUTE class — mint stays service_role-only (topology A; EF is the auth surface).
+-- ===========================================================================
+select ok(not has_function_privilege('authenticated',
+  'agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean)', 'EXECUTE'),
+  'authenticated has NO direct EXECUTE on mint_delegated_child (EF-mediated only)');
+select ok(not has_function_privilege('anon',
+  'agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean)', 'EXECUTE'),
+  'anon has NO EXECUTE on mint_delegated_child');
+select ok(has_function_privilege('service_role',
+  'agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean)', 'EXECUTE'),
+  'service_role retains EXECUTE on mint_delegated_child');
+
+select finish();
+rollback;

package/tests/agent_board_mint_harden_backfill.test.sql

@@ -0,0 +1,95 @@
+-- MINTHARDEN (#138) pgTAP — data-derived fingerprint BACKFILL (20260822000200).
+--
+-- Behavioural (message-board#103 seed hook): tests/seeds/20260822000200_*.pre.sql planted a
+-- string-era mint child key (canonical public_key, base64url-STRING fingerprint) BEFORE the
+-- backfill ran. These assertions prove the SHIPPED backfill re-derived it to the raw-byte
+-- fingerprint — a mutation removing the re-derivation UPDATE leaves the stale value and the
+-- first assertion fails. The canonicalization helper and the fail-closed cross-owner
+-- collision report are pinned directly (the collision path cannot be exercised as a live
+-- migration abort without failing the replay, so its DETECTOR is pinned on constructed data).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+select plan(10);
+
+-- Existence.
+select has_function('agent_board', '_raw_key_canonical', array['text'], '_raw_key_canonical exists');
+select has_function('agent_board', '_raw_fingerprint_backfill_collisions', '_raw_fingerprint_backfill_collisions exists');
+
+-- (1) The seeded string-era row was re-derived to the RAW-byte fingerprint.
+select is(
+  (select fingerprint from agent_board.agent_signing_keys where id = 'fb111111-0000-4b11-8000-000000000201'),
+  public.test_key_fingerprint('fbfill-legacy-1'),
+  'backfill re-derived the string-era mint key fingerprint to the raw-byte value');
+
+-- (2) ...and it is NOT the retired base64url-STRING derivation any more.
+select ok(
+  (select fingerprint <> 'sha256:' || rtrim(translate(encode(
+     extensions.digest(convert_to(public.test_pubkey('fbfill-legacy-1'), 'UTF8'), 'sha256'), 'base64'), '+/', '-_'), '=')
+     from agent_board.agent_signing_keys where id = 'fb111111-0000-4b11-8000-000000000201'),
+  'the backfilled fingerprint is no longer the base64url-STRING form');
+
+-- (3/4/5) _raw_key_canonical: canonicalizes a non-canonical alias, is idempotent on the
+-- canonical form, and returns NULL on a non-32-byte value. repeat('A',42)||'B' is a
+-- non-canonical alias of the 32-zero-byte key (repeat('A',43)).
+select is(agent_board._raw_key_canonical(repeat('A', 42) || 'B'), repeat('A', 43),
+  '_raw_key_canonical collapses a non-canonical alias to the canonical key');
+select is(agent_board._raw_key_canonical(repeat('A', 43)), repeat('A', 43),
+  '_raw_key_canonical is idempotent on an already-canonical key');
+select ok(agent_board._raw_key_canonical('too-short') is null,
+  '_raw_key_canonical returns NULL for a value that is not 32 raw bytes');
+
+-- (6) Cross-IDENTITY collision detector. Two scenarios, both = one keypair backing two
+-- AGENTS (a canonical key + its alias, DISTINCT stored fingerprints so the UNIQUE is not
+-- hit). Built under session_replication_role=replica to bypass the integrity trigger; rolled
+-- back with the test.
+--   Scenario 1 (cross-OWNER): agents aa/ab under owners oa/ob share the zero key.
+--   Scenario 2 (same-OWNER, two agents): agents ac/ad under one owner oc share the 'Q' key —
+--   MUST-FIX B: auto-dedup must NOT delete a different agent's binding, so this ABORTS too.
+do $$
+declare
+  oa uuid; ob uuid; oc uuid;
+  aa uuid := gen_random_uuid();
+  ab uuid := gen_random_uuid();
+  ac uuid := gen_random_uuid();
+  ad uuid := gen_random_uuid();
+begin
+  oa := public.ensure_github_user('mhcoll-a', 'mhcoll-a@example.test', 'mhcoll-a', 'Coll A');
+  ob := public.ensure_github_user('mhcoll-b', 'mhcoll-b@example.test', 'mhcoll-b', 'Coll B');
+  oc := public.ensure_github_user('mhcoll-c', 'mhcoll-c@example.test', 'mhcoll-c', 'Coll C');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (aa, 'agent', 'mhcoll-a-agent', 'Coll A Agent', 'active', oa, oa),
+         (ab, 'agent', 'mhcoll-b-agent', 'Coll B Agent', 'active', ob, ob),
+         (ac, 'agent', 'mhcoll-c-agent', 'Coll C Agent', 'active', oc, oc),
+         (ad, 'agent', 'mhcoll-d-agent', 'Coll D Agent', 'active', null, oc);
+
+  set local session_replication_role = replica;
+  -- Scenario 1: cross-owner, zero key (repeat('A',43)) + its alias (repeat('A',42)||'B').
+  insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (aa, 'primary', 1, repeat('A', 43), 'raw_ed25519_base64url', agent_board._raw_key_fingerprint(repeat('A', 43)), 'active', 'proven'),
+         (ab, 'primary', 1, repeat('A', 42) || 'B', 'raw_ed25519_base64url', 'sha256:' || repeat('C', 43), 'active', 'proven');
+  -- Scenario 2: same owner (oc), 'Q' key (repeat('Q',43)) + its alias (repeat('Q',42)||'R').
+  insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (ac, 'primary', 1, repeat('Q', 43), 'raw_ed25519_base64url', agent_board._raw_key_fingerprint(repeat('Q', 43)), 'active', 'proven'),
+         (ad, 'primary', 1, repeat('Q', 42) || 'R', 'raw_ed25519_base64url', 'sha256:' || repeat('D', 43), 'active', 'proven');
+  set local session_replication_role = default;
+end
+$$;
+
+select ok(
+  (select count(*) from agent_board._raw_fingerprint_backfill_collisions()) >= 2,
+  'the detector flags BOTH the cross-owner and the same-owner two-agent collisions');
+select is(
+  (select array_length(agent_ids, 1) from agent_board._raw_fingerprint_backfill_collisions()
+    where computed_fingerprint = agent_board._raw_key_fingerprint(repeat('A', 43))),
+  2,
+  'the cross-owner colliding fingerprint spans exactly 2 agents');
+select is(
+  (select owner_count from agent_board._raw_fingerprint_backfill_collisions()
+    where computed_fingerprint = agent_board._raw_key_fingerprint(repeat('Q', 43))),
+  1::bigint,
+  'MUST-FIX B: a same-owner TWO-AGENT collision is flagged (owner_count=1) — dedup must not delete a different agent''s key');
+
+select finish();
+rollback;

package/tests/agent_board_obsgate.test.sql

@@ -0,0 +1,178 @@
+-- OBSGATE (#78) pgTAP: an observer with board-thread access can no longer author via the
+-- low-level post_message; the board send-role gate now applies to board-linked threads at the
+-- post_message chokepoint, while board-less threads (DM/multicast) and service_role are
+-- unaffected.
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- (''/service_role => true, 'authenticated' => false), request.jwt.claim.sub picks the actor.
+--
+-- The DENY assertion (observer post_message raises 42501) is the mutation pin: drop the guard
+-- in post_message and it stops raising -> the test fails. The ALLOW twins (member posts, a
+-- board-less thread posts, service_role posts) guard against over-blocking / regression.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(13);
+
+create temp table _og_fixture (
+  board uuid,
+  board2 uuid,
+  member_agent uuid,
+  observer_agent uuid,
+  board_thread uuid,
+  boardless_thread uuid,
+  tasking_thread uuid,
+  multi_thread uuid,
+  member_user uuid,
+  observer_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_member_user uuid;
+  v_observer_user uuid;
+  v_creator uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_observer uuid := gen_random_uuid();
+  v_board uuid;
+  v_board2 uuid;
+  v_board_thread uuid := gen_random_uuid();
+  v_boardless_thread uuid := gen_random_uuid();
+  v_tasking_thread uuid := gen_random_uuid();
+  v_multi_thread uuid := gen_random_uuid();
+begin
+  v_member_user := public.ensure_github_user('og-member-' || v_suffix, 'og-member-' || v_suffix || '@example.test', 'og-member-' || v_suffix, 'OG Member');
+  v_observer_user := public.ensure_github_user('og-observer-' || v_suffix, 'og-observer-' || v_suffix || '@example.test', 'og-observer-' || v_suffix, 'OG Observer');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_creator, 'agent', 'og-creator-' || v_suffix, 'OG Creator', 'active', null, null),
+    (v_member, 'agent', 'og-member-' || v_suffix, 'OG Member', 'active', v_member_user, v_member_user),
+    (v_observer, 'agent', 'og-observer-' || v_suffix, 'OG Observer', 'active', v_observer_user, v_observer_user);
+
+  select board_id into v_board
+    from agent_board.create_board(v_creator, 'og-board-' || v_suffix, 'OG Board', 'obsgate test', '{}'::jsonb, 'private');
+  select board_id into v_board2
+    from agent_board.create_board(v_creator, 'og-board2-' || v_suffix, 'OG Board 2', 'obsgate test 2', '{}'::jsonb, 'private');
+
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_member, 'joined', v_creator, 'member'),
+    (v_board, v_observer, 'joined', v_creator, 'observer');
+
+  -- Both threads authored by the member. The board thread will be stamped + fanned below; the
+  -- board-less thread stays unlinked.
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values
+    (v_board_thread, 'coordination', v_member, 'OG board thread'),
+    (v_boardless_thread, 'coordination', v_member, 'OG board-less thread'),
+    (v_tasking_thread, 'coordination', v_member, 'OG tasking thread'),
+    (v_multi_thread, 'coordination', v_creator, 'OG multi-board thread');
+
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', v_member_user::text, true);
+  -- The member (non-observer) posts a board message: fans delivery to all members (giving the
+  -- observer thread access) AND stamps threads.board_id via _upsert_delivery_recipient.
+  perform agent_board.post_board_message(v_board_thread, v_member, v_board, 'seed', 'seed body');
+  -- A tasking fan is TASK-sourced (source_message_id null): exercises the stamp resolving the
+  -- thread from source_task_id so this path is not a bypass (was the #78 round-1 panel finding).
+  perform agent_board.create_tasking_delivery(v_tasking_thread, v_member, 'task title', 'details', null, v_board);
+
+  -- Multi-board thread: fan the SAME thread to v_board then v_board2 (as operator). first-board-wins
+  -- means it stamps to v_board and is NEVER left NULL (the round-2 codex finding).
+  perform set_config('request.jwt.claim.role', 'service_role', true);
+  perform set_config('request.jwt.claim.sub', '', true);
+  perform agent_board.post_board_message(v_multi_thread, v_creator, v_board, 'm1', 'first board');
+  perform agent_board.post_board_message(v_multi_thread, v_creator, v_board2, 'm2', 'second board');
+
+  insert into _og_fixture values
+    (v_board, v_board2, v_member, v_observer, v_board_thread, v_boardless_thread, v_tasking_thread, v_multi_thread, v_member_user, v_observer_user);
+end
+$$;
+
+-- existence + stamp -----------------------------------------------------------
+select has_function('agent_board', '_current_agent_can_post_to_thread', array['uuid'], '_current_agent_can_post_to_thread exists');
+
+select is(
+  (select board_id from agent_board.threads where id = (select board_thread from _og_fixture)),
+  (select board from _og_fixture),
+  'the board thread was stamped with its board_id on first board delivery');
+
+select is(
+  (select post_policy from agent_board.threads where id = (select board_thread from _og_fixture)),
+  'inherit', 'threads default to post_policy = inherit');
+
+-- THE FIX (mutation pin): an observer with thread access cannot author via post_message -------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select observer_user from _og_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.post_message(%L::uuid, %L::uuid, 'obs body')$q$,
+     board_thread, observer_agent) from _og_fixture),
+  '42501', 'thread posting requires a non-observer board role',
+  'observer cannot author into a board thread via post_message (bypass closed)');
+
+-- multi-board thread: stamped to the FIRST board (never left NULL) — round-2 panel finding ----
+select is(
+  (select board_id from agent_board.threads where id = (select multi_thread from _og_fixture)),
+  (select board from _og_fixture),
+  'a multi-board thread is stamped first-board-wins, never left NULL (no access-only bypass)');
+
+-- tasking-fan path (TASK-sourced delivery) also stamps + gates (round-1 panel bypass, closed) --
+select is(
+  (select board_id from agent_board.threads where id = (select tasking_thread from _og_fixture)),
+  (select board from _og_fixture),
+  'a tasking-fanned thread is stamped too (stamp resolves the thread from source_task_id)');
+
+select set_config('request.jwt.claim.sub', (select observer_user from _og_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.post_message(%L::uuid, %L::uuid, 'obs via tasking')$q$,
+     tasking_thread, observer_agent) from _og_fixture),
+  '42501', 'thread posting requires a non-observer board role',
+  'observer cannot author into a tasking-fanned board thread via post_message (bypass closed)');
+
+-- observer is still blocked at post_board_message too (existing gate intact) -----------------
+select set_config('request.jwt.claim.sub', (select observer_user from _og_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     board_thread, observer_agent, board) from _og_fixture),
+  '42501', 'board send requires a non-observer board role',
+  'observer still blocked at post_board_message (unchanged)');
+
+-- ALLOW twins ---------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select member_user from _og_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.post_message(%L::uuid, %L::uuid, 'member body')$q$,
+     board_thread, member_agent) from _og_fixture),
+  'a non-observer member may author into the board thread via post_message');
+
+select lives_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     board_thread, member_agent, board) from _og_fixture),
+  'a non-observer member may post_board_message (control)');
+
+-- board-less thread: no board link -> access-only, no role gate (no regression) --------------
+select lives_ok(
+  (select format($q$select agent_board.post_message(%L::uuid, %L::uuid, 'boardless body')$q$,
+     boardless_thread, member_agent) from _og_fixture),
+  'a board-less thread is unaffected by the board role gate (access-only)');
+
+-- service_role carve-out: may post to the board thread regardless of role -------------------
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($q$select agent_board.post_message(%L::uuid, %L::uuid, 'svc body')$q$,
+     board_thread, observer_agent) from _og_fixture),
+  'service_role may post to a board thread regardless of board role (carve-out)');
+
+-- the new SECURITY DEFINER predicate carries no PUBLIC EXECUTE (MBHARDEN #118) --------------
+select set_config('request.jwt.claim.role', '', true);
+select ok(
+  not has_function_privilege('public', 'agent_board._current_agent_can_post_to_thread(uuid)', 'EXECUTE'),
+  '_current_agent_can_post_to_thread carries no PUBLIC EXECUTE (class invariant)');
+
+select * from finish();
+
+rollback;