@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/agent_board_outbox_wake_ordering.test.sql

@@ -0,0 +1,452 @@
+-- OUTBOXWAKE / #187 — monotonic wake ordering for the notification outbox.
+--
+-- WHAT THIS FILE PINS, and why each assertion is shaped the way it is:
+--
+--   * WO-1 SHAPE — `callback_outbox_events.seq` exists, is bigint, is NOT NULL, and is
+--     GENERATED **ALWAYS** (`pg_attribute.attidentity = 'a'`). `by default` would be
+--     'd' and would make the ordering evidence caller-suppliable; that is the whole
+--     property, so it is read from the catalog and not inferred from the DDL text.
+--   * WO-2 EVIDENCE — an INSERT that names `seq` is REJECTED by the server (428C9).
+--     A shape assertion alone would not prove the server enforces it.
+--   * WO-3 CLASS — catalog-derived, per repo rule #1. The writer set comes from
+--     `pg_get_functiondef`, not from a list written here, so a NEW writer fails and
+--     NAMES ITSELF. The companion assertion closes the only escape hatch that
+--     `generated always` leaves open: `overriding system value`. Neither has an
+--     exemption list; each named writer is ALSO positively checked (WO-6/WO-7) to
+--     actually produce monotonic seq, so this is not an argument from absence.
+--   * WO-4 ORDERING — the uuid tiebreak is GONE from claim_callback_outbox_events and
+--     `seq` replaced it, checked against the catalog body.
+--   * WO-5 RESTATEMENT — the claim function was DROPPED and recreated (its return type
+--     changed), which discards the ACL and the COMMENT and re-grants EXECUTE to PUBLIC
+--     by default. These assertions fail if the migration forgot to restate them.
+--   * WO-6/WO-7 BEHAVIOUR — the acceptance criteria: a real fan-out through the real
+--     writer, in ONE transaction, yields N distinct ordered seq while `created_at` is
+--     byte-identical across all N; a bounded claim takes the LOWEST seq; and the queue is
+--     partitioned by STATUS so nothing is handed out twice or dropped.
+--
+-- WHAT THIS FILE DELIBERATELY DOES NOT ASSERT: that `seq > my cursor` recovers everything
+-- unhandled. `seq` is monotonic in ASSIGNMENT order, not COMMIT order, so a late-committing
+-- transaction lands below an already-persisted cursor. See the WO-7 block for the two
+-- assertions that were removed for encoding that false property.
+--
+-- Allow-side calls are wrapped in lives_ok(...) with a SEPARATE state check
+-- (message-board#113): a bare `is((select ... from rpc(...)), ...)` aborts the
+-- transaction on a raise, pgTAP emits NO `not ok`, and every later assertion in the
+-- file silently does not run.
+
+begin;
+
+select plan(37);
+
+-- ---------------------------------------------------------------------------
+-- WO-1 SHAPE
+-- ---------------------------------------------------------------------------
+select has_column('agent_board', 'callback_outbox_events', 'seq',
+  'WO-1 callback_outbox_events has a seq column');
+select col_type_is('agent_board', 'callback_outbox_events', 'seq', 'bigint',
+  'WO-1 seq is bigint');
+select col_not_null('agent_board', 'callback_outbox_events', 'seq',
+  'WO-1 seq is not null');
+
+select is(
+  (select a.attidentity
+     from pg_attribute a
+    where a.attrelid = 'agent_board.callback_outbox_events'::regclass
+      and a.attname = 'seq'),
+  'a',
+  'WO-1 seq is GENERATED ALWAYS as identity (attidentity=a), not BY DEFAULT (d) -- the value is evidence of write order and must not be caller-suppliable');
+
+select ok(
+  (select bool_or(i.indisunique)
+     from pg_index i
+     join pg_class c on c.oid = i.indexrelid
+    where i.indrelid = 'agent_board.callback_outbox_events'::regclass
+      and pg_get_indexdef(i.indexrelid) ~ '\(seq\)$'),
+  'WO-1 a UNIQUE index enforces seq uniqueness');
+
+select ok(
+  (select count(*) = 1
+     from pg_index i
+    where i.indrelid = 'agent_board.callback_outbox_events'::regclass
+      and pg_get_indexdef(i.indexrelid) ~ '\(recipient_agent_id, seq\)$'),
+  'WO-1 (recipient_agent_id, seq) index exists -- the consumer access path is "rows for me newer than my cursor"');
+
+select isnt(
+  (select col_description('agent_board.callback_outbox_events'::regclass, a.attnum)
+     from pg_attribute a
+    where a.attrelid = 'agent_board.callback_outbox_events'::regclass
+      and a.attname = 'seq'),
+  null,
+  'WO-1 seq carries a COMMENT stating what it is evidence of');
+
+-- ---------------------------------------------------------------------------
+-- WO-3 CLASS (catalog-derived; stated before the fixture so it cannot depend on it)
+-- ---------------------------------------------------------------------------
+-- The writer set is READ FROM THE CATALOG. A new function that inserts into the
+-- outbox changes this string, fails the assertion, and prints its own name in the
+-- diff -- which is the only way a completeness claim survives contact with a future
+-- change (repo rule #1).
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prokind = 'f'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~ 'insert into agent_board\.callback_outbox_events'),
+  '_queue_board_post_callbacks, _queue_inbox_callbacks',
+  'WO-3 CLASS: the catalog names exactly the two known outbox writers -- a new writer fails here and NAMES ITSELF');
+
+-- `generated always` is enforced by the server, and OVERRIDING SYSTEM VALUE is its
+-- ONLY bypass. Asserting the empty set over the whole schema (not over a hand list of
+-- writers) means a future writer cannot quietly assert an ordering it did not earn.
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prokind = 'f'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~* 'insert into agent_board\.callback_outbox_events'
+      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~* 'overriding\s+(system|user)\s+value'),
+  '',
+  'WO-3 CLASS: no outbox writer uses OVERRIDING SYSTEM VALUE -- the identity bypass stays closed');
+
+-- ---------------------------------------------------------------------------
+-- WO-4 ORDERING
+-- ---------------------------------------------------------------------------
+select ok(
+  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~ 'order by coe\.available_at asc, coe\.seq asc'
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  'WO-4 claim_callback_outbox_events orders candidates by (available_at, seq)');
+
+select ok(
+  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            !~ 'coe\.id asc'
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  'WO-4 the random-uuid tiebreak (coe.id asc) is GONE from the claim ordering');
+
+-- This is the PIN for "the batch is returned in seq order", and it is a source check
+-- on purpose. The behavioural assertion below (WO-7, "RETURNED in seq order") does NOT
+-- pin it: deleting `order by u.seq asc` from the function leaves the plan feeding the
+-- ordered candidate CTE straight through, so the observed order stays ascending and the
+-- mutation produces NO failure. A property no mutation can break is not covered, so the
+-- pin has to be stated where the mutation actually lands.
+select ok(
+  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~ 'order by u\.seq asc'
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  'WO-4 the claimed batch is RETURNED ordered by seq, not merely selected in seq order');
+
+select ok(
+  (select 'outbox_seq' = any(p.proargnames)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  'WO-4 the claim RPC returns outbox_seq, so a worker can persist a cursor');
+
+-- ---------------------------------------------------------------------------
+-- WO-5 ACL + COMMENT restated after DROP FUNCTION
+-- ---------------------------------------------------------------------------
+select ok(
+  has_function_privilege('service_role', 'agent_board.claim_callback_outbox_events(integer)', 'EXECUTE'),
+  'WO-5 service_role EXECUTE was re-granted after the drop/recreate');
+
+select ok(
+  not has_function_privilege('authenticated', 'agent_board.claim_callback_outbox_events(integer)', 'EXECUTE'),
+  'WO-5 authenticated has NO EXECUTE -- recreating a definer function re-grants PUBLIC by default');
+
+select ok(
+  not has_function_privilege('anon', 'agent_board.claim_callback_outbox_events(integer)', 'EXECUTE'),
+  'WO-5 anon has NO EXECUTE on the claim RPC');
+
+select is(
+  (select count(*)::integer
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname = 'claim_callback_outbox_events'
+      and array_to_string(coalesce(p.proacl, '{}'::aclitem[]), ',') ~ '(^|,)=X/'),
+  0,
+  'WO-5 PUBLIC holds no EXECUTE entry in the claim RPC ACL');
+
+select isnt(
+  (select obj_description(p.oid, 'pg_proc')
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  null,
+  'WO-5 the COMMENT discarded by DROP FUNCTION was restated');
+
+-- The five assertions above name ONE function, which is exactly the shape that has failed
+-- here before: they verify the function this migration happens to touch, and say nothing
+-- about the next one. These two are the class, derived from pg_catalog with NO exemption
+-- list: every SECURITY DEFINER function whose body reaches callback_outbox_events must be
+-- closed to PUBLIC/anon/authenticated and open to service_role. A function added to this
+-- migration (or any later one) that forgets its revoke or its grant fails here and PRINTS
+-- ITS OWN NAME. Verified exemption-free at the time of writing: all eight members of the
+-- class satisfy both directions, so neither assertion passes by finding nothing.
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and p.prosecdef
+      and pg_get_functiondef(p.oid) ~ 'callback_outbox_events'
+      and (has_function_privilege('public', p.oid, 'EXECUTE')
+        or has_function_privilege('anon', p.oid, 'EXECUTE')
+        or has_function_privilege('authenticated', p.oid, 'EXECUTE'))),
+  '',
+  'WO-5 CLASS: no SECURITY DEFINER function reaching callback_outbox_events is executable by PUBLIC, anon, or authenticated -- DROP FUNCTION discards the ACL and CREATE re-grants PUBLIC');
+
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and p.prosecdef
+      and pg_get_functiondef(p.oid) ~ 'callback_outbox_events'
+      and not has_function_privilege('service_role', p.oid, 'EXECUTE')),
+  '',
+  'WO-5 CLASS: every SECURITY DEFINER function reaching callback_outbox_events is executable by service_role -- a dropped-and-recreated function that lost its grant names itself here');
+
+-- ---------------------------------------------------------------------------
+-- Fixture: a real board fan-out. Five subscribers, one verified endpoint each.
+-- ---------------------------------------------------------------------------
+-- claim_callback_outbox_events polls the GLOBAL ready queue. Neutralize any rows a
+-- previous fixture left ready so this file controls the claim; the surrounding
+-- transaction rolls it back.
+update agent_board.callback_outbox_events
+   set outbox_status = 'delivered',
+       delivered_at = coalesce(delivered_at, now()),
+       updated_at = now()
+ where outbox_status in ('pending', 'retryable')
+   and available_at <= now();
+
+insert into agent_board.agents(id, agent_type, handle, display_name, status)
+values ('18700000-0000-4000-8000-000000000000', 'agent', 'wake187-sender', 'Wake187 Sender', 'active');
+insert into agent_board.agents(id, agent_type, handle, display_name, status)
+select ('18700000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'agent', 'wake187-sub-' || n, 'Wake187 Subscriber ' || n, 'active'
+  from generate_series(1, 5) n;
+
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+values ('18701000-0000-4000-8000-000000000001', 'wake187-board', 'Wake187 Board',
+        '18700000-0000-4000-8000-000000000000', 'open', 'active');
+
+insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+values ('18702000-0000-4000-8000-000000000001', 'coordination',
+        '18700000-0000-4000-8000-000000000000', 'Wake187 thread',
+        '18701000-0000-4000-8000-000000000001');
+
+insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, message_type, body)
+values ('18703000-0000-4000-8000-000000000001', '18702000-0000-4000-8000-000000000001',
+        '18700000-0000-4000-8000-000000000000', 1, 'comment', 'wake187 board post');
+
+insert into agent_board.board_memberships(id, board_id, agent_id, role, membership_state, created_by_agent_id)
+select ('18704000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       '18701000-0000-4000-8000-000000000001',
+       ('18700000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'member', 'joined', '18700000-0000-4000-8000-000000000000'
+  from generate_series(1, 5) n;
+
+insert into agent_board.callback_endpoints(id, owner_agent_id, endpoint_url, endpoint_status, verification_requested_at, verified_at)
+select ('18705000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       ('18700000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'https://example.test/wake187/' || n,
+       'verified', now(), now()
+  from generate_series(1, 5) n;
+
+insert into agent_board.callback_subscriptions(
+  id, endpoint_id, agent_id, subscription_scope, event_category,
+  board_id, board_membership_id, subscription_status)
+select ('18706000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       ('18705000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       ('18700000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'board', 'board.post.delivered',
+       '18701000-0000-4000-8000-000000000001',
+       ('18704000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'active'
+  from generate_series(1, 5) n;
+
+-- ---------------------------------------------------------------------------
+-- WO-6 FAN-OUT: one transaction, one statement, five rows.
+-- ---------------------------------------------------------------------------
+-- The capture tables are created EMPTY first and the call INSERTs into them. If a
+-- call raises, lives_ok reports a named `not ok` AND every later assertion still runs
+-- against an empty table -- whereas `create temp table ... as select` would leave the
+-- table missing, abort the transaction, and silently truncate the plan (#113).
+create temp table wake187_fanout(inserted_count integer);
+select lives_ok($$
+  insert into wake187_fanout
+  select agent_board._queue_board_post_callbacks(
+    '18701000-0000-4000-8000-000000000001'::uuid,
+    '18703000-0000-4000-8000-000000000001'::uuid,
+    'Wake187 subject', 'Wake187 preview', 'high', '{}'::jsonb) as inserted_count
+$$, 'WO-6 the board fan-out writer runs [call succeeds]');
+
+select is(
+  (select inserted_count from wake187_fanout),
+  5,
+  'WO-6 _queue_board_post_callbacks wrote one outbox row per subscriber');
+
+create temp table wake187_rows as
+select id, seq, created_at, recipient_agent_id
+  from agent_board.callback_outbox_events
+ where board_id = '18701000-0000-4000-8000-000000000001';
+
+select is(
+  (select count(distinct created_at)::integer from wake187_rows),
+  1,
+  'WO-6 all five rows share ONE created_at -- now() is transaction_timestamp(), so the fan-out CANNOT be ordered by time');
+
+select is(
+  (select count(distinct seq)::integer from wake187_rows),
+  5,
+  'WO-6 the same five rows have five DISTINCT seq values');
+
+select is(
+  (select (max(seq) - min(seq) + 1)::integer from wake187_rows),
+  5,
+  'WO-6 the five seq values are contiguous -- a total order with no gap or reuse');
+
+-- ---------------------------------------------------------------------------
+-- WO-7 CLAIM DETERMINISM + CURSOR RECOVERY (acceptance criteria 2 and 3)
+-- ---------------------------------------------------------------------------
+create temp table wake187_batch1(outbox_event_id uuid, outbox_seq bigint);
+select lives_ok($$
+  insert into wake187_batch1
+  select outbox_event_id, outbox_seq from agent_board.claim_callback_outbox_events(2)
+$$, 'WO-7 a bounded claim runs [call succeeds]');
+
+select is(
+  (select count(*)::integer from wake187_batch1),
+  2,
+  'WO-7 the bounded claim returned exactly the requested batch size');
+
+-- The defect: with a random-uuid tiebreak over identical timestamps, WHICH two rows a
+-- batch of two takes was arbitrary. It must now be the two lowest seq.
+select is(
+  (select array_agg(outbox_seq order by outbox_seq) from wake187_batch1),
+  (select array_agg(seq order by seq) from (select seq from wake187_rows order by seq limit 2) lo),
+  'WO-7 the claim took the two LOWEST seq rows -- deterministic across identical created_at');
+
+-- Corroboration only, NOT the pin: removing the ORDER BY from the returned batch does
+-- not make this fail (see the WO-4 source assertion above for why).
+select is(
+  (select array_agg(outbox_seq) from wake187_batch1),
+  (select array_agg(outbox_seq order by outbox_seq) from wake187_batch1),
+  'WO-7 the batch is observed in seq order [corroborates WO-4; the ORDER BY itself is pinned there]');
+
+-- WHAT WAS HERE BEFORE, AND WHY IT IS GONE. Two assertions used to partition this queue
+-- with `seq > cursor` / `seq <= cursor` and call the result lossless recovery. Inside one
+-- transaction that is true, and it generalises to a property that IS FALSE: `seq` is
+-- monotonic in ASSIGNMENT order, not in COMMIT order, so a transaction that inserts early
+-- and commits late lands BELOW a cursor a consumer has already persisted and is skipped.
+-- The isolation spec proves exactly that (`late_committer_holds_a_lower_seq_than_the_
+-- persisted_cursor`), and `agent-board-runtime/src/notifications.ts` really does gate on
+-- it: `shouldReplayMissedEvent` returns `Number(stored) < hint.sequence`. An assertion
+-- that encodes a false property is worse than no assertion, so both are replaced by the
+-- property that actually holds and that the claim path actually relies on: the queue is
+-- partitioned by STATUS, not by seq.
+select is(
+  (select array_agg(coe.seq order by coe.seq)
+     from agent_board.callback_outbox_events coe
+    where coe.board_id = '18701000-0000-4000-8000-000000000001'
+      and coe.outbox_status = 'pending'),
+  (select array_agg(r.seq order by r.seq)
+     from wake187_rows r
+    where r.seq not in (select outbox_seq from wake187_batch1)),
+  'WO-7 the rows still pending are EXACTLY the ones the claim did not take -- the claim path is lossless because it partitions on STATUS, never on seq');
+
+select is(
+  (select array_agg(coe.seq order by coe.seq)
+     from agent_board.callback_outbox_events coe
+    where coe.board_id = '18701000-0000-4000-8000-000000000001'
+      and coe.outbox_status = 'delivering'),
+  (select array_agg(outbox_seq order by outbox_seq) from wake187_batch1),
+  'WO-7 the rows now delivering are EXACTLY the claimed batch -- no row is handed out twice and none is silently dropped');
+
+create temp table wake187_batch2(outbox_event_id uuid, outbox_seq bigint);
+select lives_ok($$
+  insert into wake187_batch2
+  select outbox_event_id, outbox_seq from agent_board.claim_callback_outbox_events(10)
+$$, 'WO-7 the follow-up claim runs [call succeeds]');
+
+select is(
+  (select array_agg(outbox_seq order by outbox_seq) from wake187_batch2),
+  (select array_agg(seq order by seq) from (select seq from wake187_rows order by seq offset 2) hi),
+  'WO-7 the follow-up claim takes the remaining rows in seq order, resuming exactly where the cursor stopped');
+
+-- ---------------------------------------------------------------------------
+-- WO-2 EVIDENCE: the identity is not caller-suppliable (checked against the SERVER,
+-- not the DDL text). Stated last so its failed INSERT cannot disturb the fixture.
+-- ---------------------------------------------------------------------------
+select throws_ok($$
+  insert into agent_board.callback_outbox_events(
+    seq, endpoint_id, subscription_id, recipient_agent_id, board_id,
+    event_category, delivery_mode, source_kind, source_message_id,
+    idempotency_key, priority)
+  values (
+    999999, '18705000-0000-4000-8000-000000000001'::uuid,
+    '18706000-0000-4000-8000-000000000001'::uuid,
+    '18700000-0000-4000-8000-000000000001'::uuid,
+    '18701000-0000-4000-8000-000000000001'::uuid,
+    'board.post.delivered', 'board', 'message',
+    '18703000-0000-4000-8000-000000000001'::uuid,
+    'wake187:forged-seq', 'high')
+$$, '428C9',
+   null,
+   'WO-2 an INSERT that supplies seq is REJECTED by the server -- GENERATED ALWAYS, so write order cannot be forged');
+
+-- The second writer, positively: it is subject to the same identity and its row lands
+-- ABOVE the fan-out. An enumeration (WO-3) that named a writer doing neither would be
+-- an exemption asserted by absence, which is how a hole hid here before.
+insert into agent_board.delivery_recipients(id, delivery_mode, recipient_agent_id, source_kind, source_message_id)
+values ('18707000-0000-4000-8000-000000000001', 'direct',
+        '18700000-0000-4000-8000-000000000001', 'message',
+        '18703000-0000-4000-8000-000000000001');
+
+insert into agent_board.inbox_items(
+  id, delivery_recipient_id, recipient_agent_id, delivery_mode, source_kind,
+  source_message_id, subject, preview, priority, action_state,
+  visible_in_inbox, visible_in_board_feed, fetch_descriptor)
+values ('18708000-0000-4000-8000-000000000001', '18707000-0000-4000-8000-000000000001',
+        '18700000-0000-4000-8000-000000000001', 'direct', 'message',
+        '18703000-0000-4000-8000-000000000001', 'Wake187 inbox', 'Wake187 inbox preview',
+        'high', 'new', true, false, '{}'::jsonb);
+
+insert into agent_board.callback_subscriptions(
+  id, endpoint_id, agent_id, subscription_scope, event_category, subscription_status)
+values ('18709000-0000-4000-8000-000000000001', '18705000-0000-4000-8000-000000000001',
+        '18700000-0000-4000-8000-000000000001', 'own_inbox', 'inbox.item.delivered', 'active');
+
+create temp table wake187_inbox(inserted_count integer);
+select lives_ok($$
+  insert into wake187_inbox
+  select agent_board._queue_inbox_callbacks(
+    '18708000-0000-4000-8000-000000000001'::uuid, 'inbox.item.delivered') as inserted_count
+$$, 'WO-6 the inbox fan-out writer runs [call succeeds]');
+
+select is(
+  (select inserted_count from wake187_inbox),
+  1,
+  'WO-6 _queue_inbox_callbacks wrote its outbox row');
+
+select ok(
+  (select coe.seq > (select max(seq) from wake187_rows)
+     from agent_board.callback_outbox_events coe
+    where coe.idempotency_key = 'inbox.item.delivered:18708000-0000-4000-8000-000000000001:18709000-0000-4000-8000-000000000001'),
+  'WO-6 the second writer shares the SAME sequence -- its row sorts strictly after the earlier fan-out, so the order is schema-wide, not per-writer');
+
+select * from finish();
+
+rollback;

package/tests/agent_board_portal_offline_invariant.test.sql

@@ -47,14 +47,14 @@ begin
   select e.agent_id, e.auth_user_id into v_agent, v_auth
     from agent_board.enroll_federated_identity(
       'https://mock-portal-'||s||'.test', 'message-board', 'portal|'||s,
-      jsonb_build_object('sub','portal|'||s),
+      jsonb_build_object('iss','https://mock-portal-'||s||'.test','aud','message-board','sub','portal|'||s),
       'pofx-'||s, v_pub, 'raw_ed25519_base64url', v_fp, true, null, 'agent', '{board:send}', '{}') e;
 
   -- A SECOND signing key (key_version 2; enroll auto-enrolled version 1) + a pending
   -- challenge bound to it, so the mint step below can drive PoP -> mint deterministically.
   insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
-  values (v_key, v_agent, 'primary', 2, repeat('A',43), 'raw_ed25519_base64url',
-          'sha256:'||rpad(replace(v_key::text,'-',''),43,'A'), 'active', 'proven');
+  values (v_key, v_agent, 'primary', 2, public.test_pubkey(v_key::text), 'raw_ed25519_base64url',
+          public.test_key_fingerprint(v_key::text), 'active', 'proven');
   insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at, consumed_at)
   values (v_ch, v_key, v_agent, v_ch::text, 'agent-signing-key-proof.v1:'||v_ch||':n', 'pending', now() + interval '10 minutes', null);
 
@@ -97,6 +97,17 @@ select lives_ok(
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);
 
+-- The send LANDED, not merely raised no exception (message-board#87): the prior
+-- lives_ok proves no error, but the header's "board writes are unaffected" claim
+-- needs the fan-out write to be observable. Assert the board post produced board
+-- delivery rows for the board — the write path executed Portal-offline.
+select ok(
+  exists(
+    select 1 from agent_board.delivery_recipients
+     where board_id = (select board from _pofx)
+       and delivery_mode = 'board'),
+  'the Portal-offline board-member send landed board delivery rows (board writes unaffected)');
+
 -- revoke: the lifecycle terminates cleanly; the agent is no longer active. ---------
 select lives_ok(
   (select format($q$select agent_board.revoke_agent(%L::uuid, 'portal-offline lifecycle test')$q$, agent) from _pofx),

package/tests/agent_board_pubexec_class.test.sql

@@ -0,0 +1,53 @@
+-- MBHARDEN / #118 — no agent_board SECURITY DEFINER function may carry a PUBLIC EXECUTE
+-- ACL. CREATE FUNCTION defaults EXECUTE to PUBLIC; a SECURITY DEFINER function runs as the
+-- schema owner, so a stray PUBLIC grant lets any authenticated caller drive owner-privileged
+-- logic. #97 closed mark_retention_metadata; 20260812000100 closes the other five.
+--
+-- Assertions are catalog-derived (the durable class invariant) plus two named pins for the
+-- genuine holes, and one over-revoke guard. Each is mutation-pinned:
+--   * removing ANY of the five revokes -> the class count becomes >= 1 -> assert 1 fails.
+--   * removing the _record_signed_write_evidence / _resolve_addressing_recipient_rows revoke
+--     -> its named assert flips to true -> fails.
+--   * "fixing" the invariant by nuking authenticated grants instead of PUBLIC -> assert 4
+--     (an intentionally authenticated SECURITY DEFINER RPC) fails.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public;
+
+begin;
+
+select plan(4);
+
+-- The class invariant. PUBLIC is the `=X` pseudo-grantee; has_function_privilege('public',…)
+-- is true ONLY when PUBLIC itself holds EXECUTE, so intentional named grants (e.g. to
+-- authenticated) do not trip this.
+select is(
+  (select count(*)::int
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and p.prosecdef
+      and has_function_privilege('public', p.oid, 'EXECUTE')),
+  0,
+  'class invariant: no agent_board SECURITY DEFINER function carries a PUBLIC EXECUTE ACL');
+
+-- Named pin: the forge hole. Authenticated must not be able to INSERT forged signed-write
+-- attestations by calling the evidence recorder directly.
+select ok(
+  not has_function_privilege('authenticated', 'agent_board._record_signed_write_evidence(text,uuid,text,jsonb,jsonb)', 'EXECUTE'),
+  'authenticated cannot execute _record_signed_write_evidence (attestation forge)');
+
+-- Named pin: the enumeration leak. Authenticated must not be able to run the actor-spoofable
+-- directory resolver directly, bypassing resolve_recipients'' session rebind.
+select ok(
+  not has_function_privilege('authenticated', 'agent_board._resolve_addressing_recipient_rows(uuid,jsonb)', 'EXECUTE'),
+  'authenticated cannot execute _resolve_addressing_recipient_rows (directory leak)');
+
+-- Over-revoke guard: the invariant targets PUBLIC, not intended named grants. A SECURITY
+-- DEFINER RPC deliberately granted to authenticated must keep working.
+select ok(
+  has_function_privilege('authenticated', 'agent_board.get_schema_version()', 'EXECUTE'),
+  'intended authenticated grant on a SECURITY DEFINER RPC is preserved');
+
+select * from finish();
+
+rollback;