@consiliency/agent-board-schema 1.2.0 → 1.4.0

package/tests/agent_board_enroll_pop_binding.test.sql

@@ -0,0 +1,131 @@
+-- MBPORTALGATE SL-2 pgTAP: the PoP-binding suite for enroll_federated_identity.
+--
+-- Proves the proof-of-possession + fingerprint contract the /enroll EF depends on:
+--   * the DB-recomputed sha256:base64url fingerprint is BYTE-IDENTICAL to the value an
+--     independent client (WebCrypto) computes over the same base64url key STRING
+--     (client<->DB round-trip);
+--   * p_pop_verified must be true (false / null -> raise, no writes);
+--   * the RPC recomputes-and-asserts the fingerprint (a tampered fingerprint -> raise);
+--   * a duplicate fingerprint (a key already enrolled) -> raise, dedup on the UNIQUE index;
+--   * malformed / placeholder / wrong-format keys -> raise;
+--   * p_actor_sub is audit-only: present-non-empty succeeds + is captured; empty -> raise.
+-- Runs as postgres (service_role-equivalent for _is_service_role()).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(18);
+
+-- Client<->DB fingerprint round-trip (B2 raw-byte scheme): the DB derivation over the
+-- DECODED 32 key bytes must equal the constant an independent tool (Node crypto,
+-- matching WebCrypto + the client child_keygen keyRef) computed over the same raw bytes.
+select is(
+  'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate('eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0','-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'='),
+  'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+  'the DB raw-byte fingerprint derivation round-trips the independently-computed client value (key 1)');
+select is(
+  'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate('yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk','-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'='),
+  'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+  'the DB raw-byte fingerprint derivation round-trips the independently-computed client value (key 2)');
+
+create temp table _p (
+  iss text, aud text, sub text, claim jsonb,
+  pub1 text, fp1 text, pub2 text, fp2 text
+) on commit drop;
+do $$
+declare s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+begin
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://fed-pop-'||s||'.test', 'message-board', true, true, '{board:send}', '{}', '{agent,human}');
+  insert into _p values (
+    'https://fed-pop-'||s||'.test', 'message-board', 'portal|'||s,
+    jsonb_build_object('sub','portal|'||s,'act',jsonb_build_object('sub','act|'||s)),
+    'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk', 'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA');
+end
+$$;
+
+-- Happy path with a present, non-empty actor_sub -> succeeds and is audited (key 1).
+select lives_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,%L,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-ok', pub1, fp1, 'act|present') from _p),
+  'enroll with a present non-empty actor_sub and verified PoP succeeds');
+select is(
+  (select e.human_identity_claim->'act'->>'sub' from agent_board.enrollment_federation_audit e
+     join agent_board.agents a on a.id=e.agent_id where a.handle='pop-ok'),
+  (select claim->'act'->>'sub' from _p),
+  'the act.sub is captured (audit-only) in the enrollment claim snapshot');
+
+-- Duplicate fingerprint: re-enrolling key 1 raises (dedup on the UNIQUE index).
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-dup', pub1, fp1) from _p),
+  '23505', null, 'a duplicate fingerprint (key already enrolled) is rejected');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k where k.fingerprint = (select fp1 from _p)),
+  1, 'the duplicate attempt did not enroll a second key with the same fingerprint');
+
+-- B2: a NON-CANONICAL base64url encoding of an already-enrolled key (same 32 raw bytes,
+-- 2 don't-care low bits flipped) is rejected as non-canonical (22023) BEFORE the dedup
+-- check — so one private key can NEVER back multiple agents (the 4-strings-one-key
+-- aliasing attack that broke revocation isolation).
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-alias1', 'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f1', fp1) from _p),
+  '22023', null, 'a non-canonical base64url alias of an enrolled key is rejected (aliasing attack blocked)');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-alias2', 'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f2', fp1) from _p),
+  '22023', null, 'a second non-canonical alias of the same key is also rejected');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k where k.fingerprint = (select fp1 from _p)),
+  1, 'the aliasing attempts enrolled NO extra key/agent (one private key -> exactly one agent)');
+
+-- PoP gate: p_pop_verified false / null -> raise, and NO agent is written.
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,false,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-false', pub2, fp2) from _p),
+  '42501', null, 'p_pop_verified=false is refused');
+select is(
+  (select count(*)::int from agent_board.agents a where a.handle = 'pop-false'),
+  0, 'a refused (pop=false) enrollment wrote no agent (no partial write)');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,NULL,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-null', pub2, fp2) from _p),
+  '42501', null, 'p_pop_verified=null is refused');
+
+-- Fingerprint tamper: supplied fingerprint != in-DB recompute -> raise, no write.
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-tamper', pub2, 'sha256:'||repeat('B',43)) from _p),
+  '22023', null, 'a tampered fingerprint (!= in-DB derive of the key) is rejected');
+select is(
+  (select count(*)::int from agent_board.agents a where a.handle = 'pop-tamper'),
+  0, 'a tampered-fingerprint enrollment wrote no agent');
+
+-- Malformed / placeholder / wrong-format keys -> raise.
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,'not-a-valid-43char-key','raw_ed25519_base64url','sha256:'||%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-malformed', repeat('C',43)) from _p),
+  '22023', null, 'a malformed (non-43-base64url) public key is rejected');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-zero', repeat('A',43),
+     'sha256:'||rtrim(translate(encode(extensions.digest(convert_to(repeat('A',43),'UTF8'),'sha256'),'base64'),'+/','-_'),'=')) from _p),
+  '22023', null, 'the all-zero small-order placeholder key is rejected');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'spki_pem',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-fmt', pub2, fp2) from _p),
+  '22023', null, 'a non-raw_ed25519_base64url public_key_format is rejected');
+
+-- actor_sub present-but-empty -> raise (present means a real delegated actor).
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,'','agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-emptyact', pub2, fp2) from _p),
+  '22023', null, 'a present-but-empty actor_sub is rejected');
+
+select finish();
+
+rollback;

package/tests/agent_board_enroll_rate_cap.test.sql

@@ -0,0 +1,53 @@
+-- MBHARDEN SL-1 pgTAP: check_and_bump_enroll_rate allows <=limit calls per source
+-- per rolling window and rejects past the limit; sources are independent; the
+-- reject path records nothing; and execute is revoked from anon/authenticated.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(10);
+
+select has_function(
+  'agent_board', 'check_and_bump_enroll_rate', array['text', 'integer', 'interval'],
+  'check_and_bump_enroll_rate(text, integer, interval) exists');
+select has_table(
+  'agent_board', 'enroll_rate_events', 'enroll_rate_events counter table exists');
+
+-- Source A: limit 3 in a 1-minute window. First three allowed, fourth rejected.
+select is(
+  agent_board.check_and_bump_enroll_rate('src-a', 3, interval '1 minute'),
+  true, '1st call for src-a is allowed');
+select is(
+  agent_board.check_and_bump_enroll_rate('src-a', 3, interval '1 minute'),
+  true, '2nd call for src-a is allowed');
+select is(
+  agent_board.check_and_bump_enroll_rate('src-a', 3, interval '1 minute'),
+  true, '3rd call for src-a is allowed (at the limit)');
+select is(
+  agent_board.check_and_bump_enroll_rate('src-a', 3, interval '1 minute'),
+  false, '4th call for src-a is rejected (over the cap)');
+
+-- A different source is bounded independently.
+select is(
+  agent_board.check_and_bump_enroll_rate('src-b', 3, interval '1 minute'),
+  true, 'a different source is counted independently');
+
+-- The reject path records nothing: src-a still has exactly its 3 allowed events.
+select is(
+  (select count(*)::int from agent_board.enroll_rate_events where source = 'src-a'),
+  3, 'the over-cap reject recorded no event (only the 3 allowed remain)');
+
+-- Privilege: execute revoked from anon and authenticated.
+select function_privs_are(
+  'agent_board', 'check_and_bump_enroll_rate', array['text', 'integer', 'interval'],
+  'anon', array[]::text[],
+  'check_and_bump_enroll_rate execute is revoked from anon');
+select function_privs_are(
+  'agent_board', 'check_and_bump_enroll_rate', array['text', 'integer', 'interval'],
+  'authenticated', array[]::text[],
+  'check_and_bump_enroll_rate execute is revoked from authenticated');
+
+select finish();
+
+rollback;

package/tests/agent_board_enrollment_audit_content.test.sql

@@ -0,0 +1,134 @@
+-- MBFED SL-2 pgTAP (Lane B): enrollment-audit content + no-write-path-read invariant.
+--
+-- Proves enroll_federated_identity writes exactly ONE enrollment_federation_audit row
+-- whose human_identity_claim equals the supplied snapshot verbatim, that the audit
+-- table carries NO Portal session/MFA/availability/liveness column (it is a static
+-- enrollment-time claim snapshot), and that NO write-path RPC reads that table — the
+-- audit is never consulted as a live trust signal. Runs as postgres.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(11);
+
+create temp table _acfx (agent uuid, claim jsonb) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_agent uuid;
+  v_claim jsonb := jsonb_build_object('sub','portal|'||s,'name','Fed '||s,'groups',jsonb_build_array('eng','fed'));
+  -- A valid unique 43-char base64url key + its matching (RPC-recomputed) fingerprint.
+  v_pub text := rtrim(translate(encode(extensions.digest(convert_to('k-acfx-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp text;
+begin
+  v_fp := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://mock-portal-'||s||'.test', 'message-board', true, true, '{board:send}', '{board:x}', '{agent,human}');
+
+  select e.agent_id into v_agent
+    from agent_board.enroll_federated_identity(
+      'https://mock-portal-'||s||'.test', 'message-board', 'portal|'||s,
+      v_claim, 'acfx-'||s, v_pub, 'raw_ed25519_base64url', v_fp, true, null, 'human', '{board:send}', '{board:x}') e;
+
+  insert into _acfx values (v_agent, v_claim);
+end
+$$;
+
+-- Exactly one audit row, with the verbatim claim snapshot. -------------------------
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit where agent_id = (select agent from _acfx)),
+  1, 'enroll_federated_identity writes exactly one enrollment_federation_audit row');
+select is(
+  (select human_identity_claim from agent_board.enrollment_federation_audit where agent_id = (select agent from _acfx)),
+  (select claim from _acfx),
+  'human_identity_claim equals the supplied snapshot verbatim');
+select is(
+  (select granted_scopes from agent_board.enrollment_federation_audit where agent_id = (select agent from _acfx)),
+  '{board:send}'::text[],
+  'granted_scopes records the in-ceiling requested scopes');
+
+-- The audit is a STATIC snapshot: no Portal session/MFA/availability/liveness column.
+select hasnt_column('agent_board', 'enrollment_federation_audit', 'portal_session_id',
+  'audit has no portal_session_id column');
+select is(
+  (select count(*)::int
+     from information_schema.columns
+    where table_schema = 'agent_board'
+      and table_name = 'enrollment_federation_audit'
+      and (column_name ~* '(session|mfa|liveness|availability|reachab|online|heartbeat)')),
+  0, 'audit table carries no Portal session/MFA/liveness/availability column (static snapshot only)');
+
+-- The audit exists and stores the enrollment-time snapshot, not a live signal. ------
+select has_column('agent_board', 'enrollment_federation_audit', 'human_identity_claim', 'audit stores human_identity_claim');
+select has_column('agent_board', 'enrollment_federation_audit', 'enrolled_at', 'audit stores enrolled_at (enrollment-time)');
+
+-- No write-path RPC reads enrollment_federation_audit. Only the enroll RPC (which
+-- WRITES it) may reference the table; nothing on the send/session path reads it. ----
+select is(
+  (select count(*)::int from (
+     select pg_get_functiondef(p.oid) as def, p.proname
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and p.proname <> 'enroll_federated_identity'
+   ) d
+   where lower(d.def) like '%enrollment_federation_audit%'),
+  0, 'no agent_board RPC other than enroll_federated_identity references enrollment_federation_audit');
+select is(
+  (select count(*)::int from (
+     select pg_get_functiondef(p.oid) as def
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and p.proname in (
+          'mint_fleet_agent_session', 'post_board_message', 'send_direct_message',
+          'send_multicast_message', 'create_tasking_delivery', 'revoke_agent')
+   ) d
+   where lower(d.def) like '%enrollment_federation_audit%'),
+  0, 'no send/session/revoke write-path RPC reads the enrollment audit table');
+
+-- #6 fix: the authenticated SELECT policy is scoped to the owning principal
+-- (agent_id = current_agent_id()), not `using (true)`. Two enrolled human
+-- principals; principal A must NOT see principal B's PII-bearing audit row.
+create temp table _rls (a_agent uuid, a_user uuid, b_agent uuid) on commit drop;
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text,1,8),'-','');
+  v_a_agent uuid; v_a_user uuid; v_b_agent uuid;
+  v_pub_a text := rtrim(translate(encode(extensions.digest(convert_to('k-rls-a-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_pub_b text := rtrim(translate(encode(extensions.digest(convert_to('k-rls-b-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp_a text; v_fp_b text;
+begin
+  v_fp_a := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub_a,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp_b := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub_b,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://rls-portal-'||s||'.test','message-board',true,true,'{board:send}','{board:x}','{agent,human}');
+  select e.agent_id, e.auth_user_id into v_a_agent, v_a_user
+    from agent_board.enroll_federated_identity('https://rls-portal-'||s||'.test','message-board','portal|a-'||s,
+      jsonb_build_object('sub','portal|a-'||s,'name','A'), 'rls-a-'||s, v_pub_a,'raw_ed25519_base64url',v_fp_a,true,null,'human','{board:send}','{board:x}') e;
+  select e.agent_id into v_b_agent
+    from agent_board.enroll_federated_identity('https://rls-portal-'||s||'.test','message-board','portal|b-'||s,
+      jsonb_build_object('sub','portal|b-'||s,'name','B'), 'rls-b-'||s, v_pub_b,'raw_ed25519_base64url',v_fp_b,true,null,'human','{board:send}','{board:x}') e;
+  insert into _rls values (v_a_agent, v_a_user, v_b_agent);
+end
+$$;
+grant select on _rls to authenticated;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role','authenticated', true);
+select set_config('request.jwt.claim.sub', (select a_user from _rls)::text, true);
+
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e where e.agent_id = (select b_agent from _rls)),
+  0, 'agent A cannot read agent B''s enrollment audit row (RLS scoped to owning principal, not using(true))');
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e where e.agent_id = (select a_agent from _rls)),
+  1, 'agent A can read its own enrollment audit row');
+
+reset role;
+
+select finish();
+
+rollback;

package/tests/agent_board_fleet_agent_session_class.test.sql

@@ -0,0 +1,64 @@
+-- MBSESSION SL-1 pgTAP: nonfleet_sessions.identity_class admits fleet_agent_session
+-- (plus the 4 legacy classes), rejects an unknown class, and the TTL pin caps a
+-- fleet_agent_session to <= 900s while legacy classes keep the 3600 default.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(10);
+
+-- All five valid identity classes are admitted (TTL within the fleet pin bound).
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-eph', 'fac-eph', 'ephemeral_child', now() + interval '1 hour', 900)$$,
+  'ephemeral_child identity_class is admitted');
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-hw', 'fac-hw', 'hosted_workload', now() + interval '1 hour', 900)$$,
+  'hosted_workload identity_class is admitted');
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-rs', 'fac-rs', 'remote_sandbox', now() + interval '1 hour', 900)$$,
+  'remote_sandbox identity_class is admitted');
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-inv', 'fac-inv', 'invited_external', now() + interval '1 hour', 900)$$,
+  'invited_external identity_class is admitted');
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-fas', 'fac-fas', 'fleet_agent_session', now() + interval '15 minutes', 900)$$,
+  'fleet_agent_session identity_class is admitted (new 5th class)');
+
+-- A legacy class still keeps the 3600 default (fleet pin does not apply to it).
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at)
+      values ('fac-hw3600', 'fac-hw3600', 'hosted_workload', now() + interval '1 hour')$$,
+  'a legacy class row with the 3600 default is unaffected by the fleet TTL pin');
+
+-- An unknown identity_class is rejected by the re-added CHECK.
+select throws_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-bogus', 'fac-bogus', 'not_a_real_class', now() + interval '1 hour', 900)$$,
+  '23514', null,
+  'an unknown identity_class violates nonfleet_sessions_identity_class_check');
+
+-- fleet_agent_session at exactly 900s is allowed; above 900s violates the TTL pin.
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-fas900', 'fac-fas900', 'fleet_agent_session', now() + interval '15 minutes', 900)$$,
+  'fleet_agent_session at the 900s boundary is admitted');
+select throws_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-fas901', 'fac-fas901', 'fleet_agent_session', now() + interval '15 minutes', 901)$$,
+  '23514', null,
+  'fleet_agent_session with max_ttl_seconds > 900 violates nonfleet_sessions_fleet_ttl_pin');
+select throws_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at)
+      values ('fac-fas3600', 'fac-fas3600', 'fleet_agent_session', now() + interval '15 minutes')$$,
+  '23514', null,
+  'fleet_agent_session cannot inherit the 3600 max_ttl_seconds default');
+
+select finish();
+
+rollback;

package/tests/agent_board_fleet_policy_default_deny.test.sql

@@ -0,0 +1,149 @@
+-- MBSENDAUTHZ SL-2 pgTAP: the non-fleet fail-open in evaluate_signed_write_fleet_policy
+-- is now mode-gated per sender-fleet-scope (fail_open_preserved / observe / deny)
+-- with a tight non-fleet allowlist. Fleet-resolvable senders are unaffected.
+--
+-- Runs as the postgres db role in a service_role context (the function requires
+-- service role); request.jwt.claim.role is left '' so _is_service_role() is true.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(13);
+
+create temp table _fpd_fixture (
+  ff_sender uuid,
+  ob_sender uuid,
+  dn_sender uuid,
+  dn2_sender uuid,
+  al_sender uuid,
+  fleet_sender uuid,
+  owner_agent uuid
+) on commit drop;
+
+do $$
+declare
+  v_ff uuid := gen_random_uuid();
+  v_ob uuid := gen_random_uuid();
+  v_dn uuid := gen_random_uuid();
+  v_dn2 uuid := gen_random_uuid();
+  v_al uuid := gen_random_uuid();
+  v_fleet uuid := gen_random_uuid();
+  v_owner uuid := gen_random_uuid();
+  v_domain uuid;
+  v_machine uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_ff, 'agent', 'fpd-ff', 'FPD FailOpen'),
+    (v_ob, 'agent', 'fpd-ob', 'FPD Observe'),
+    (v_dn, 'agent', 'fpd-dn', 'FPD Deny'),
+    (v_dn2, 'agent', 'fpd-dn2', 'FPD Deny2'),
+    (v_al, 'agent', 'fpd-al', 'FPD Allowlisted'),
+    (v_fleet, 'agent', 'fpd-fleet', 'FPD Fleet'),
+    (v_owner, 'agent', 'fpd-owner', 'FPD Owner');
+
+  -- A fleet-resolvable sender: active trust domain + machine + agent mapping.
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at, metadata)
+  values ('fpd-tailnet', 'FPD Tailnet', 'tailnet', v_owner, 'active', now(), '{"invitationState":"owner_approved"}'::jsonb);
+  select id into v_domain from agent_board.fleet_trust_domains where slug = 'fpd-tailnet';
+  select machine_id into v_machine
+    from agent_board.register_fleet_machine(v_owner, v_domain, 'fpd-machine', 'sha256:fpd-machine', 'portal', '{"redacted":true}'::jsonb);
+  insert into agent_board.fleet_machine_agents(machine_id, agent_id, agent_role)
+  values (v_machine, v_fleet, 'phase_worker');
+
+  insert into _fpd_fixture values (v_ff, v_ob, v_dn, v_dn2, v_al, v_fleet, v_owner);
+end
+$$;
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- Signature ------------------------------------------------------------------
+select has_function('agent_board', 'evaluate_signed_write_fleet_policy', array['text', 'jsonb', 'jsonb'],
+  'evaluate_signed_write_fleet_policy(text,jsonb,jsonb) exists');
+
+-- Phase A: no flag row => fail_open_preserved (unchanged behavior) ------------
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select ff_sender from _fpd_fixture)::text, 'verification_status', 'verified'))),
+  true, 'no flag row: non-fleet sender passes (fail-open preserved)');
+
+select is(
+  (select count(*)::int from agent_board.send_authz_telemetry
+    where kind = 'would_be_deny' and actor_agent_id = (select ff_sender from _fpd_fixture)),
+  0, 'fail_open_preserved records no would_be_deny telemetry');
+
+-- Phase B: observe => allow AND record exactly one would_be_deny row ----------
+insert into agent_board.fleet_send_enforcement_flags(scope_key, mode) values ('nonfleet', 'observe');
+
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select ob_sender from _fpd_fixture)::text,
+                       'signed_write', jsonb_build_object('origin', 'host')))),
+  true, 'observe mode: non-fleet sender still passes');
+
+select is(
+  (select count(*)::int from agent_board.send_authz_telemetry
+    where kind = 'would_be_deny' and actor_agent_id = (select ob_sender from _fpd_fixture)),
+  1, 'observe mode records exactly one would_be_deny telemetry row');
+
+-- Phase C: deny => deny non-allowlisted, admit allowlisted (tight) -----------
+update agent_board.fleet_send_enforcement_flags set mode = 'deny' where scope_key = 'nonfleet';
+insert into agent_board.nonfleet_sender_allowlist(agent_id, reason)
+values ((select al_sender from _fpd_fixture), 'sl2 test: enumerated legitimate flow');
+
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select dn_sender from _fpd_fixture)::text))),
+  false, 'deny mode: non-allowlisted non-fleet sender is denied');
+
+select is(
+  (select denial_class from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select dn_sender from _fpd_fixture)::text))),
+  'nonfleet_sender_denied', 'deny mode: denial_class is nonfleet_sender_denied');
+
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select al_sender from _fpd_fixture)::text))),
+  true, 'deny mode: allowlisted non-fleet sender is admitted');
+
+-- Tight allowlist: a different, non-enumerated non-fleet sender stays denied.
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select dn2_sender from _fpd_fixture)::text))),
+  false, 'deny mode: allowlist is tight — a non-enumerated sender is still denied');
+
+-- Boardless send_direct_message path is gated (scope resolves before any board).
+select is(
+  (select denial_class from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', jsonb_build_object('p_recipient_agent_id', gen_random_uuid()::text),
+    jsonb_build_object('agent_id', (select dn_sender from _fpd_fixture)::text))),
+  'nonfleet_sender_denied', 'deny mode gates the boardless send_direct_message path (scope before board)');
+
+-- Fleet-resolvable sender is unaffected by the non-fleet deny flag.
+-- An unhandled operation returns allowed=true for a fleet sender (v_machine_id
+-- not null), proving it never enters the non-fleet branch.
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'noop_operation', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select fleet_sender from _fpd_fixture)::text, 'verification_status', 'verified'))),
+  true, 'fleet-resolvable sender is unaffected by the non-fleet deny flag');
+
+-- Grants preserved -----------------------------------------------------------
+select function_privs_are(
+  'agent_board', 'evaluate_signed_write_fleet_policy', array['text', 'jsonb', 'jsonb'],
+  'authenticated', array[]::text[], 'evaluate_signed_write_fleet_policy execute is revoked from authenticated');
+select function_privs_are(
+  'agent_board', 'evaluate_signed_write_fleet_policy', array['text', 'jsonb', 'jsonb'],
+  'service_role', array['EXECUTE'], 'evaluate_signed_write_fleet_policy execute is granted to service_role');
+
+select finish();
+
+rollback;

package/tests/agent_board_fleet_registry.test.sql

@@ -40,8 +40,8 @@ select fk_ok('agent_board', 'fleet_machine_agents', 'signing_key_id', 'agent_boa
 select fk_ok('agent_board', 'fleet_receive_policies', 'recipient_agent_id', 'agent_board', 'agents', 'id', 'receive policies reference recipient agents');
 
 select ok(
-  exists (select 1 from agent_board.schema_version where version = 7),
-  'schema_version advanced to fleet store version 7'
+  exists (select 1 from agent_board.schema_version where version >= 7),
+  'schema_version advanced to at least fleet store version 7'
 );
 
 select ok(

package/tests/agent_board_identity_providers.test.sql

@@ -0,0 +1,104 @@
+-- MBFED SL-1 / MBPORTALGATE SL-1 pgTAP: identity_providers mirrors workload_providers
+-- (shape + RLS + grants), the real Portal contract row is seeded INERT with the frozen
+-- resource-audience + actor_claim, and enroll_federated_identity is service_role-only
+-- (revoked from authenticated). Runs as postgres.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(21);
+
+-- Shape ------------------------------------------------------------------------
+select has_table('agent_board', 'identity_providers', 'identity_providers table exists');
+select col_is_pk('agent_board', 'identity_providers', 'id', 'id is the primary key');
+select col_is_unique('agent_board', 'identity_providers', array['issuer', 'audience'],
+  'unique(issuer, audience) mirrors workload_providers');
+select has_column('agent_board', 'identity_providers', 'policy_approved', 'has policy_approved');
+select col_default_is('agent_board', 'identity_providers', 'policy_approved', 'false',
+  'policy_approved defaults false (no provider auto-approved)');
+
+-- MBPORTALGATE: actor_claim column (forward-only, default 'act.sub') ------------
+select has_column('agent_board', 'identity_providers', 'actor_claim',
+  'MBPORTALGATE adds the actor_claim column (forward-only)');
+select col_default_is('agent_board', 'identity_providers', 'actor_claim', 'act.sub',
+  'actor_claim defaults to act.sub (audit-only delegated-actor claim)');
+
+-- RLS (deny-anon + authenticated-read-true, exactly like workload_providers) ----
+select ok(
+  (select relrowsecurity from pg_class c join pg_namespace n on n.oid=c.relnamespace
+    where n.nspname='agent_board' and c.relname='identity_providers'),
+  'identity_providers has RLS enabled');
+select is(
+  (select count(*)::int from pg_policy pol join pg_class c on c.oid=pol.polrelid
+     join pg_namespace n on n.oid=c.relnamespace
+    where n.nspname='agent_board' and c.relname='identity_providers'
+      and pol.polname='identity_providers_deny_anon'),
+  1, 'identity_providers_deny_anon policy exists');
+select is(
+  (select pg_get_expr(polqual, polrelid) from pg_policy pol join pg_class c on c.oid=pol.polrelid
+     join pg_namespace n on n.oid=c.relnamespace
+    where n.nspname='agent_board' and c.relname='identity_providers'
+      and pol.polname='identity_providers_authenticated_read'),
+  'true', 'authenticated read predicate is true (global registry, fleet-readable)');
+
+-- Grants: select->authenticated, select/insert/update->service_role ------------
+select ok(
+  has_table_privilege('authenticated', 'agent_board.identity_providers', 'SELECT'),
+  'authenticated has SELECT on identity_providers');
+select ok(
+  not has_table_privilege('authenticated', 'agent_board.identity_providers', 'INSERT'),
+  'authenticated has NO INSERT on identity_providers (mirrors workload_providers)');
+select ok(
+  has_table_privilege('service_role', 'agent_board.identity_providers', 'INSERT'),
+  'service_role has INSERT on identity_providers');
+select ok(
+  has_table_privilege('service_role', 'agent_board.identity_providers', 'UPDATE'),
+  'service_role has UPDATE on identity_providers');
+
+-- Seed policy: the shipped seed carries NO policy_approved=true row -------------
+select is(
+  (select count(*)::int from agent_board.identity_providers where policy_approved),
+  0, 'no seeded identity provider ships policy_approved=true (approval is operational)');
+
+-- MBPORTALGATE: the REAL Portal row is present and INERT -----------------------
+-- Frozen resource-audience constant, asserted byte-identical (IF-0-MBPORTALGATE-1/2).
+select is(
+  (select count(*)::int from agent_board.identity_providers
+    where issuer = 'https://portal.consiliency.io'
+      and audience = 'https://message-board.consiliency.io'
+      and supported
+      and not policy_approved
+      and subject_claim = 'sub'
+      and actor_claim = 'act.sub'),
+  1, 'real Portal row present, INERT (policy_approved=false), frozen subject/actor_claim');
+select is(
+  (select audience from agent_board.identity_providers
+    where issuer = 'https://portal.consiliency.io'),
+  'https://message-board.consiliency.io',
+  'real Portal audience is byte-identical to the frozen resource constant (RFC 8707)');
+select is(
+  (select policy_approved from agent_board.identity_providers
+    where issuer = 'https://portal.consiliency.io'
+      and audience = 'https://message-board.consiliency.io'),
+  false, 'real Portal row ships INERT (policy_approved=false) — approval is operational');
+
+-- The pre-existing mock row is untouched (still present, still inert) -----------
+select is(
+  (select count(*)::int from agent_board.identity_providers
+    where issuer = 'https://mock-portal.test'
+      and audience = 'message-board'
+      and supported
+      and not policy_approved),
+  1, 'the mock issuer row is untouched (present, supported, inert)');
+
+-- enroll_federated_identity is service_role-only (reworked 13-arg signature) ----
+select function_privs_are(
+  'agent_board', 'enroll_federated_identity',
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]'],
+  'authenticated', array[]::text[],
+  'reworked enroll_federated_identity execute is revoked from authenticated');
+
+select finish();
+
+rollback;