@consiliency/agent-board-schema 1.2.0 → 1.4.0

package/tests/agent_board_inbox_rpcs.test.sql

@@ -130,7 +130,7 @@ select ok(
 
 select ok(
   (
-    select count(distinct routine_name) = 12
+    select count(distinct routine_name) = 16
       from information_schema.routine_privileges
      where specific_schema = 'agent_board'
        and routine_name in (
@@ -154,11 +154,11 @@ select ok(
        and grantee = 'authenticated'
        and privilege_type = 'EXECUTE'
   )
-  and not has_function_privilege('authenticated', 'agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'EXECUTE')
-  and not has_function_privilege('authenticated', 'agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)', 'EXECUTE')
-  and not has_function_privilege('authenticated', 'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'EXECUTE')
-  and not has_function_privilege('authenticated', 'agent_board.create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)', 'EXECUTE'),
-  'authenticated keeps non-delivery inbox RPCs while signed delivery RPC overloads stay gateway-only'
+  and has_function_privilege('authenticated', 'agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'EXECUTE')
+  and has_function_privilege('authenticated', 'agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)', 'EXECUTE')
+  and has_function_privilege('authenticated', 'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'EXECUTE')
+  and has_function_privilege('authenticated', 'agent_board.create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)', 'EXECUTE'),
+  'authenticated keeps non-delivery inbox RPCs and holds the MBSESSION re-granted scoped-send RPCs'
 );
 
 select ok(

package/tests/agent_board_mint_fleet_agent_session.test.sql

@@ -0,0 +1,290 @@
+-- MBSESSION SL-1 pgTAP: whole-principal fleet_agent_session mint + lineage liveness.
+--
+-- Proves _agent_principal_active walks the full lineage, and mint_fleet_agent_session
+-- mints only for an active principal with a valid/unconsumed challenge and an
+-- active/unrevoked signing key (capping the TTL at 900), raising on every failure
+-- clause — including the canonical REFRESH-AFTER-REVOCATION proof (a fresh re-mint
+-- after revoking the key / suspending an ancestor RAISES; not old-token expiry).
+--
+-- Runs as postgres (service_role-equivalent for _is_service_role()); mint is
+-- service_role-only and trusts the p_agent_id it is handed.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(29);
+
+create temp table _mint_fx (
+  a1 uuid, key_a1 uuid, ch_happy uuid, ch_ttl uuid, ch_consumed uuid, ch_expired uuid, ch_mismatch uuid,
+  a3 uuid, key_a3 uuid, ch_revkey uuid,
+  a4 uuid, key_a4 uuid, ch_expkey uuid,
+  a5 uuid, key_a5 uuid, ch_inactagent uuid,
+  r_susp uuid, c_susp uuid, key_csusp uuid, ch_inactanc uuid,
+  a6 uuid,
+  a7 uuid, key_a7 uuid, ch_refkey_a uuid, ch_refkey_b uuid,
+  r2 uuid, c2 uuid, key_c2 uuid, ch_refanc_a uuid, ch_refanc_b uuid
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  u_a1 uuid; u_a3 uuid; u_a4 uuid; u_a6 uuid; u_a7 uuid; u_csusp uuid; u_r2 uuid; u_c2 uuid;
+  v_a1 uuid := gen_random_uuid(); v_a3 uuid := gen_random_uuid(); v_a4 uuid := gen_random_uuid();
+  v_a5 uuid := gen_random_uuid(); v_a6 uuid := gen_random_uuid(); v_a7 uuid := gen_random_uuid();
+  v_rsusp uuid := gen_random_uuid(); v_csusp uuid := gen_random_uuid();
+  v_r2 uuid := gen_random_uuid(); v_c2 uuid := gen_random_uuid();
+  k_a1 uuid := gen_random_uuid(); k_a3 uuid := gen_random_uuid(); k_a4 uuid := gen_random_uuid();
+  k_a5 uuid := gen_random_uuid(); k_csusp uuid := gen_random_uuid(); k_a7 uuid := gen_random_uuid();
+  k_c2 uuid := gen_random_uuid();
+  ch_happy uuid := gen_random_uuid(); ch_ttl uuid := gen_random_uuid(); ch_consumed uuid := gen_random_uuid();
+  ch_expired uuid := gen_random_uuid(); ch_mismatch uuid := gen_random_uuid(); ch_revkey uuid := gen_random_uuid();
+  ch_expkey uuid := gen_random_uuid(); ch_inactagent uuid := gen_random_uuid(); ch_inactanc uuid := gen_random_uuid();
+  ch_refkey_a uuid := gen_random_uuid(); ch_refkey_b uuid := gen_random_uuid();
+  ch_refanc_a uuid := gen_random_uuid(); ch_refanc_b uuid := gen_random_uuid();
+begin
+  u_a1 := public.ensure_github_user('mint-a1-'||s, 'mint-a1-'||s||'@example.test', 'mint-a1-'||s, 'A1');
+  u_a3 := public.ensure_github_user('mint-a3-'||s, 'mint-a3-'||s||'@example.test', 'mint-a3-'||s, 'A3');
+  u_a4 := public.ensure_github_user('mint-a4-'||s, 'mint-a4-'||s||'@example.test', 'mint-a4-'||s, 'A4');
+  u_a6 := public.ensure_github_user('mint-a6-'||s, 'mint-a6-'||s||'@example.test', 'mint-a6-'||s, 'A6');
+  u_a7 := public.ensure_github_user('mint-a7-'||s, 'mint-a7-'||s||'@example.test', 'mint-a7-'||s, 'A7');
+  u_csusp := public.ensure_github_user('mint-cs-'||s, 'mint-cs-'||s||'@example.test', 'mint-cs-'||s, 'CS');
+  u_r2 := public.ensure_github_user('mint-r2-'||s, 'mint-r2-'||s||'@example.test', 'mint-r2-'||s, 'R2');
+  u_c2 := public.ensure_github_user('mint-c2-'||s, 'mint-c2-'||s||'@example.test', 'mint-c2-'||s, 'C2');
+
+  -- Active auth-bound singles (each a distinct auth_user_id for the active-unique index).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id)
+  values
+    (v_a1, 'agent', 'mint-a1-'||s, 'A1', 'active', u_a1),
+    (v_a3, 'agent', 'mint-a3-'||s, 'A3', 'active', u_a3),
+    (v_a4, 'agent', 'mint-a4-'||s, 'A4', 'active', u_a4),
+    (v_a6, 'agent', 'mint-a6-'||s, 'A6', 'active', u_a6),
+    (v_a7, 'agent', 'mint-a7-'||s, 'A7', 'active', u_a7);
+
+  -- Suspended single (no auth binding needed; exempt from the active-unique index).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status)
+  values (v_a5, 'agent', 'mint-a5-'||s, 'A5', 'suspended');
+
+  -- Suspended-ancestor chain: root suspended, child active.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status)
+  values (v_rsusp, 'agent', 'mint-rs-'||s, 'RS', 'suspended');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, parent_agent_id, root_agent_id)
+  values (v_csusp, 'agent', 'mint-cs-'||s, 'CS', 'active', u_csusp, v_rsusp, v_rsusp);
+
+  -- Active chain (used for full-lineage-true and refresh-after-revocation-ancestor).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id)
+  values (v_r2, 'agent', 'mint-r2-'||s, 'R2', 'active', u_r2);
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, parent_agent_id, root_agent_id)
+  values (v_c2, 'agent', 'mint-c2-'||s, 'C2', 'active', u_c2, v_r2, v_r2);
+
+  -- Signing keys.
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values
+    (k_a1, v_a1, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a1::text,'-',''),43,'A'), 'active', 'proven'),
+    (k_a5, v_a5, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a5::text,'-',''),43,'A'), 'active', 'proven'),
+    (k_csusp, v_csusp, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_csusp::text,'-',''),43,'A'), 'active', 'proven'),
+    (k_a7, v_a7, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a7::text,'-',''),43,'A'), 'active', 'proven'),
+    (k_c2, v_c2, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_c2::text,'-',''),43,'A'), 'active', 'proven');
+  -- Revoked key.
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state, revoked_at)
+  values (k_a3, v_a3, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a3::text,'-',''),43,'A'), 'revoked', 'revoked', now());
+  -- Expired key.
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (k_a4, v_a4, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_a4::text,'-',''),43,'A'), 'expired', 'expired');
+
+  -- Challenges. Pending + unexpired unless noted.
+  insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at, consumed_at)
+  values
+    (ch_happy, k_a1, v_a1, ch_happy::text, 'agent-signing-key-proof.v1:'||ch_happy||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_ttl, k_a1, v_a1, ch_ttl::text, 'agent-signing-key-proof.v1:'||ch_ttl||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_consumed, k_a1, v_a1, ch_consumed::text, 'agent-signing-key-proof.v1:'||ch_consumed||':n', 'consumed', now() + interval '10 minutes', now()),
+    (ch_expired, k_a1, v_a1, ch_expired::text, 'agent-signing-key-proof.v1:'||ch_expired||':n', 'pending', now() - interval '1 minute', null),
+    (ch_mismatch, k_a1, v_a1, ch_mismatch::text, 'agent-signing-key-proof.v1:'||ch_mismatch||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_revkey, k_a3, v_a3, ch_revkey::text, 'agent-signing-key-proof.v1:'||ch_revkey||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_expkey, k_a4, v_a4, ch_expkey::text, 'agent-signing-key-proof.v1:'||ch_expkey||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_inactagent, k_a5, v_a5, ch_inactagent::text, 'agent-signing-key-proof.v1:'||ch_inactagent||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_inactanc, k_csusp, v_csusp, ch_inactanc::text, 'agent-signing-key-proof.v1:'||ch_inactanc||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_refkey_a, k_a7, v_a7, ch_refkey_a::text, 'agent-signing-key-proof.v1:'||ch_refkey_a||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_refkey_b, k_a7, v_a7, ch_refkey_b::text, 'agent-signing-key-proof.v1:'||ch_refkey_b||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_refanc_a, k_c2, v_c2, ch_refanc_a::text, 'agent-signing-key-proof.v1:'||ch_refanc_a||':n', 'pending', now() + interval '10 minutes', null),
+    (ch_refanc_b, k_c2, v_c2, ch_refanc_b::text, 'agent-signing-key-proof.v1:'||ch_refanc_b||':n', 'pending', now() + interval '10 minutes', null);
+
+  insert into _mint_fx values (
+    v_a1, k_a1, ch_happy, ch_ttl, ch_consumed, ch_expired, ch_mismatch,
+    v_a3, k_a3, ch_revkey,
+    v_a4, k_a4, ch_expkey,
+    v_a5, k_a5, ch_inactagent,
+    v_rsusp, v_csusp, k_csusp, ch_inactanc,
+    v_a6,
+    v_a7, k_a7, ch_refkey_a, ch_refkey_b,
+    v_r2, v_c2, k_c2, ch_refanc_a, ch_refanc_b
+  );
+end
+$$;
+
+-- #4/#10/#12 fixture: delegation-grant liveness, nonce binding, key-expiry. --------
+create temp table _grant_fx (
+  c_exp uuid, key_exp uuid, ch_exp uuid,
+  c_live uuid, key_live uuid, ch_live uuid, ch_wrong uuid,
+  a_expts uuid, key_expts uuid, ch_expts uuid
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  u_root uuid; u_ce uuid; u_cl uuid; u_et uuid;
+  v_root uuid := gen_random_uuid();
+  v_pol uuid := gen_random_uuid();
+  v_ce uuid := gen_random_uuid(); v_cl uuid := gen_random_uuid(); v_et uuid := gen_random_uuid();
+  k_ce uuid := gen_random_uuid(); k_cl uuid := gen_random_uuid(); k_et uuid := gen_random_uuid();
+  ch_ce uuid := gen_random_uuid(); ch_cl uuid := gen_random_uuid();
+  ch_wrong uuid := gen_random_uuid(); ch_et uuid := gen_random_uuid();
+begin
+  u_root := public.ensure_github_user('gr-root-'||s, 'gr-root-'||s||'@example.test', 'gr-root-'||s, 'GR');
+  u_ce := public.ensure_github_user('gr-ce-'||s, 'gr-ce-'||s||'@example.test', 'gr-ce-'||s, 'CE');
+  u_cl := public.ensure_github_user('gr-cl-'||s, 'gr-cl-'||s||'@example.test', 'gr-cl-'||s, 'CL');
+  u_et := public.ensure_github_user('gr-et-'||s, 'gr-et-'||s||'@example.test', 'gr-et-'||s, 'ET');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id)
+  values (v_root, 'agent', 'gr-root-'||s, 'GR', 'active', u_root);
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes, child_ttl_ceiling)
+  values (v_pol, v_root, 'root_minted', jsonb_build_array('scope:a'), interval '8 hours');
+
+  -- Child with an EXPIRED governing grant (grant_expires_at in the past).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, parent_agent_id, root_agent_id)
+  values (v_ce, 'agent', 'gr-ce-'||s, 'CE', 'active', u_ce, v_root, v_root);
+  insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id, granted_scopes, grant_expires_at)
+  values (v_ce, v_root, v_root, v_pol, jsonb_build_array('scope:a'), now() - interval '1 minute');
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (k_ce, v_ce, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_ce::text,'-',''),43,'A'), 'active', 'proven');
+  insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at)
+  values (ch_ce, k_ce, v_ce, ch_ce::text, 'x', 'pending', now() + interval '10 minutes');
+
+  -- Child with a LIVE governing grant (positive control + spare challenge for nonce test).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, parent_agent_id, root_agent_id)
+  values (v_cl, 'agent', 'gr-cl-'||s, 'CL', 'active', u_cl, v_root, v_root);
+  insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id, granted_scopes, grant_expires_at)
+  values (v_cl, v_root, v_root, v_pol, jsonb_build_array('scope:a'), now() + interval '2 hours');
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (k_cl, v_cl, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_cl::text,'-',''),43,'A'), 'active', 'proven');
+  insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at)
+  values
+    (ch_cl, k_cl, v_cl, ch_cl::text, 'x', 'pending', now() + interval '10 minutes'),
+    (ch_wrong, k_cl, v_cl, ch_wrong::text, 'x', 'pending', now() + interval '10 minutes');
+
+  -- Independent agent with an ACTIVE key whose expires_at is in the past (#12).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id)
+  values (v_et, 'agent', 'gr-et-'||s, 'ET', 'active', u_et);
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state, expires_at)
+  values (k_et, v_et, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(k_et::text,'-',''),43,'A'), 'active', 'proven', now() - interval '1 minute');
+  insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at)
+  values (ch_et, k_et, v_et, ch_et::text, 'x', 'pending', now() + interval '10 minutes');
+
+  insert into _grant_fx values (v_ce, k_ce, ch_ce, v_cl, k_cl, ch_cl, ch_wrong, v_et, k_et, ch_et);
+end
+$$;
+
+-- Function existence -----------------------------------------------------------
+select has_function('agent_board', 'mint_fleet_agent_session', array['uuid','text','uuid','uuid','integer'], 'mint_fleet_agent_session exists');
+select has_function('agent_board', '_agent_principal_active', array['uuid'], '_agent_principal_active exists');
+
+-- _agent_principal_active lineage semantics ------------------------------------
+select is(agent_board._agent_principal_active((select a1 from _mint_fx)), true, 'active unparented agent is principal-active');
+select is(agent_board._agent_principal_active((select c2 from _mint_fx)), true, 'active full lineage (child + active root) is principal-active');
+select is(agent_board._agent_principal_active((select c_susp from _mint_fx)), false, 'a non-active (suspended) ancestor fails the whole principal');
+select is(agent_board._agent_principal_active((select a5 from _mint_fx)), false, 'a non-active agent is not principal-active');
+select is(agent_board._agent_principal_active(gen_random_uuid()), false, 'a non-existent agent is not principal-active');
+
+-- Happy mint + TTL cap ---------------------------------------------------------
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_happy, key_a1, a1) from _mint_fx),
+  'mint succeeds for an active principal with a valid unconsumed challenge and active key');
+select is(
+  (select count(*)::int from agent_board.nonfleet_sessions
+    where agent_id = (select a1 from _mint_fx) and identity_class = 'fleet_agent_session'),
+  1, 'the happy mint inserted exactly one fleet_agent_session row for the agent');
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid, 3600)$q$, ch_ttl, key_a1, a1) from _mint_fx),
+  'mint with p_max_ttl_seconds = 3600 succeeds');
+select is(
+  (select max(max_ttl_seconds) from agent_board.nonfleet_sessions
+    where agent_id = (select a1 from _mint_fx) and identity_class = 'fleet_agent_session'),
+  900, 'mint caps max_ttl_seconds at 900 even when 3600 is requested');
+select ok(
+  (select bool_and(expires_at <= now() + interval '900 seconds') from agent_board.nonfleet_sessions
+    where agent_id = (select a1 from _mint_fx) and identity_class = 'fleet_agent_session'),
+  'every minted fleet_agent_session expires within 900 seconds');
+
+-- Rejection matrix (each raises; no row minted) --------------------------------
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_revkey, key_a3, a3) from _mint_fx),
+  '42501', null, 'mint rejects a revoked signing key');
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_expkey, key_a4, a4) from _mint_fx),
+  '42501', null, 'mint rejects an expired signing key');
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_inactagent, key_a5, a5) from _mint_fx),
+  '42501', null, 'mint rejects a non-active agent');
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_inactanc, key_csusp, c_susp) from _mint_fx),
+  '42501', null, 'mint rejects an agent with a non-active ancestor (_agent_principal_active false)');
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_consumed, key_a1, a1) from _mint_fx),
+  '23505', null, 'mint rejects an already-consumed challenge');
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_expired, key_a1, a1) from _mint_fx),
+  '22023', null, 'mint rejects an expired challenge');
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_mismatch, key_a1, a6) from _mint_fx),
+  '42501', null, 'mint rejects a challenge not bound to the supplied agent');
+
+-- Refresh-after-revocation: KEY revoked after a successful mint -----------------
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_refkey_a, key_a7, a7) from _mint_fx),
+  'refresh(key): first mint succeeds while the key is active');
+update agent_board.agent_signing_keys
+   set status = 'revoked', proof_state = 'revoked', revoked_at = now(), updated_at = now()
+ where id = (select key_a7 from _mint_fx);
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_refkey_b, key_a7, a7) from _mint_fx),
+  '42501', null, 'refresh(key): a fresh re-mint AFTER key revocation raises (not old-token expiry)');
+
+-- Refresh-after-revocation: ANCESTOR suspended after a successful mint ----------
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_refanc_a, key_c2, c2) from _mint_fx),
+  'refresh(ancestor): first mint succeeds while the whole lineage is active');
+update agent_board.agents set status = 'suspended', updated_at = now()
+ where id = (select r2 from _mint_fx);
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_refanc_b, key_c2, c2) from _mint_fx),
+  '42501', null, 'refresh(ancestor): a fresh re-mint AFTER suspending an ancestor raises');
+
+-- #4 governing delegation-grant liveness -------------------------------------
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_exp, key_exp, c_exp) from _grant_fx),
+  '42501', null, 'mint rejects a root_minted child whose governing delegation grant is expired (#4)');
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_live, key_live, c_live) from _grant_fx),
+  'mint succeeds for a root_minted child whose governing grant is live (#4 positive control)');
+
+-- #10 nonce binding: a correct challenge/key/agent but WRONG nonce is rejected ----
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %2$L::text, %3$L::uuid, %4$L::uuid)$q$, ch_wrong, 'not-the-bound-nonce', key_live, c_live) from _grant_fx),
+  '42501', null, 'mint rejects a valid challenge presented with the wrong nonce (#10)');
+
+-- #12 mint also rejects an active key past its expires_at -------------------------
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_expts, key_expts, a_expts) from _grant_fx),
+  '42501', null, 'mint rejects an active signing key whose expires_at is in the past (#12)');
+
+-- Privileges -------------------------------------------------------------------
+select function_privs_are(
+  'agent_board', 'mint_fleet_agent_session', array['uuid','text','uuid','uuid','integer'],
+  'authenticated', array[]::text[], 'mint_fleet_agent_session execute is revoked from authenticated');
+select function_privs_are(
+  'agent_board', '_agent_principal_active', array['uuid'],
+  'authenticated', array[]::text[], '_agent_principal_active execute is revoked from authenticated');
+
+select finish();
+
+rollback;

package/tests/agent_board_nonfleet_session_reaper.test.sql

@@ -0,0 +1,61 @@
+-- MBSESSION SL-1 pgTAP: reap_expired_nonfleet_sessions removes only non-revoked rows
+-- past expires_at (subject to the grace interval), returns the affected count, and is
+-- revoked from authenticated.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(10);
+
+select has_function(
+  'agent_board', 'reap_expired_nonfleet_sessions', array['interval'],
+  'reap_expired_nonfleet_sessions(interval) exists');
+
+-- Seed: expired-old (>7d), expired-recent (<7d), future, and revoked-but-expired.
+insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+values
+  ('reap-old', 'reap-old', 'fleet_agent_session', now() - interval '30 days', 900),
+  ('reap-recent', 'reap-recent', 'fleet_agent_session', now() - interval '1 hour', 900),
+  ('reap-future', 'reap-future', 'fleet_agent_session', now() + interval '10 minutes', 900);
+insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds, revoked_at)
+values
+  ('reap-revoked', 'reap-revoked', 'fleet_agent_session', now() - interval '30 days', 900, now());
+
+-- Default 7-day grace: removes only the 30-day-old non-revoked row.
+select is(
+  agent_board.reap_expired_nonfleet_sessions(),
+  1::bigint, 'default (7 day) reap removes exactly the one row expired > 7 days ago');
+select ok(
+  not exists (select 1 from agent_board.nonfleet_sessions where id = 'reap-old'),
+  'the 30-day-old row was deleted');
+select ok(
+  exists (select 1 from agent_board.nonfleet_sessions where id = 'reap-recent'),
+  'the 1-hour-old row survives the 7-day grace');
+select ok(
+  exists (select 1 from agent_board.nonfleet_sessions where id = 'reap-revoked'),
+  'a revoked row is never reaped (partial-index predicate revoked_at is null)');
+
+-- Zero grace: removes any non-revoked row past expires_at (the recent one) but not future/revoked.
+select is(
+  agent_board.reap_expired_nonfleet_sessions(interval '0 seconds'),
+  1::bigint, 'zero-grace reap removes exactly the remaining past-expires_at non-revoked row');
+select ok(
+  not exists (select 1 from agent_board.nonfleet_sessions where id = 'reap-recent'),
+  'the 1-hour-old row is deleted under zero grace');
+select ok(
+  exists (select 1 from agent_board.nonfleet_sessions where id = 'reap-future'),
+  'a not-yet-expired row is never reaped');
+select ok(
+  exists (select 1 from agent_board.nonfleet_sessions where id = 'reap-revoked'),
+  'the revoked row still survives zero-grace reaping');
+
+-- Privilege: revoked from authenticated.
+select function_privs_are(
+  'agent_board', 'reap_expired_nonfleet_sessions', array['interval'],
+  'authenticated', array[]::text[],
+  'reap_expired_nonfleet_sessions execute is revoked from authenticated');
+
+select finish();
+
+rollback;

package/tests/agent_board_portal_offline_invariant.test.sql

@@ -0,0 +1,130 @@
+-- MBFED SL-2 pgTAP (Lane B): the load-bearing Portal-offline negative-dependency
+-- invariant (IF-5).
+--
+-- Behavioral (primary): a FEDERATED-ENROLLED agent (established via
+-- enroll_federated_identity, then given a signing key) completes the full lifecycle
+-- PoP auth -> mint_fleet_agent_session -> send -> revoke with NO live Portal present
+-- and /enroll unreachable, and board writes are unaffected. Nothing on this path reads
+-- a Portal issuer/JWKS/URL — the pgTAP replay contacts no network and depends on no
+-- Portal artifact beyond the inert allowlist seed.
+--
+-- Grep (paired supplement): no write/session-path RPC body (the 8 core send RPCs +
+-- mint_fleet_agent_session) references a Portal issuer/JWKS/OIDC string or the /enroll
+-- surface. The Portal surface is confined to supabase/functions/enroll/** + the
+-- identity_providers seed (the file-side session/** boundary is enforced by
+-- supabase/functions/session/session.test.ts). Runs as postgres.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(10);
+
+create temp table _pofx (
+  agent uuid, auth_user uuid, key uuid, ch uuid, board uuid, thread uuid
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_agent uuid; v_auth uuid;
+  v_key uuid := gen_random_uuid();
+  v_ch uuid := gen_random_uuid();
+  v_board uuid; v_thread uuid := gen_random_uuid();
+  -- A valid unique 43-char base64url enrollment key + its matching (RPC-recomputed) fp.
+  v_pub text := rtrim(translate(encode(extensions.digest(convert_to('k-pofx-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp text;
+begin
+  v_fp := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  -- Approved test provider (in-transaction only; the shipped seed stays inert).
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://mock-portal-'||s||'.test', 'message-board', true, true, '{board:send}', '{}', '{agent}');
+
+  -- Federated enrollment (PoP-at-enroll) establishes the human owner + the agent +
+  -- its own auth.users + an active proven signing key (enrollment-only Portal touch).
+  select e.agent_id, e.auth_user_id into v_agent, v_auth
+    from agent_board.enroll_federated_identity(
+      'https://mock-portal-'||s||'.test', 'message-board', 'portal|'||s,
+      jsonb_build_object('sub','portal|'||s),
+      'pofx-'||s, v_pub, 'raw_ed25519_base64url', v_fp, true, null, 'agent', '{board:send}', '{}') e;
+
+  -- A SECOND signing key (key_version 2; enroll auto-enrolled version 1) + a pending
+  -- challenge bound to it, so the mint step below can drive PoP -> mint deterministically.
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (v_key, v_agent, 'primary', 2, repeat('A',43), 'raw_ed25519_base64url',
+          'sha256:'||rpad(replace(v_key::text,'-',''),43,'A'), 'active', 'proven');
+  insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at, consumed_at)
+  values (v_ch, v_key, v_agent, v_ch::text, 'agent-signing-key-proof.v1:'||v_ch||':n', 'pending', now() + interval '10 minutes', null);
+
+  -- A board + membership + thread so the enrolled agent can send.
+  select board_id into v_board
+    from agent_board.create_board(v_agent, 'pofx-board-'||s, 'POFX Board', 'portal-offline', '{}'::jsonb, 'private');
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values (v_board, v_agent, 'joined', v_agent, 'member');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values (v_thread, 'coordination', v_agent, 'POFX thread');
+
+  insert into _pofx values (v_agent, v_auth, v_key, v_ch, v_board, v_thread);
+end
+$$;
+
+-- The federated-enrolled agent is a fully active board principal. -----------------
+select is(agent_board._agent_principal_active((select agent from _pofx)), true,
+  'the federated-enrolled agent is principal-active (no Portal dependency)');
+
+-- PoP auth -> mint: the DB session mint succeeds with no Portal artifact. ----------
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch, key, agent) from _pofx),
+  'mint_fleet_agent_session succeeds for the enrolled agent (Portal-offline)');
+select is(
+  (select count(*)::int from agent_board.nonfleet_sessions
+    where agent_id = (select agent from _pofx) and identity_class = 'fleet_agent_session'),
+  1, 'the mint inserted exactly one fleet_agent_session row');
+
+-- send: an authenticated board-member send succeeds (board writes unaffected). -----
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select auth_user from _pofx)::text, true);
+select is(agent_board._is_service_role(), false, 'send runs on the authenticated path (not service_role)');
+select lives_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     thread, agent, board) from _pofx),
+  'the enrolled agent completes a board-member send (Portal-offline behavioral)');
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- revoke: the lifecycle terminates cleanly; the agent is no longer active. ---------
+select lives_ok(
+  (select format($q$select agent_board.revoke_agent(%L::uuid, 'portal-offline lifecycle test')$q$, agent) from _pofx),
+  'revoke_agent succeeds (auth -> mint -> send -> revoke completes Portal-independently)');
+select isnt(
+  (select status from agent_board.agents where id = (select agent from _pofx)),
+  'active', 'the revoked agent is no longer active');
+
+-- Grep (paired supplement): the DB write/session path references no Portal string. --
+select is(
+  (select count(*)::int from (
+     select pg_get_functiondef(p.oid) as def
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and p.proname in (
+          'mint_fleet_agent_session', 'post_board_message', 'send_direct_message',
+          'send_multicast_message', 'create_tasking_delivery')
+   ) d
+   where lower(d.def) ~ '(portal|jwks|\.well-known|openid|oidc)'),
+  0, 'no write/session-path RPC body references a Portal issuer/JWKS/OIDC string');
+select is(
+  (select count(*)::int from (
+     select pg_get_functiondef(p.oid) as def
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and p.proname in (
+          'mint_fleet_agent_session', 'post_board_message', 'send_direct_message',
+          'send_multicast_message', 'create_tasking_delivery')
+   ) d
+   where lower(d.def) ~ '(enroll_federated_identity|/enroll)'),
+  0, 'no write/session-path RPC body references the /enroll enrollment surface');
+
+select finish();
+
+rollback;

package/tests/agent_board_resigning_refresh.test.sql

@@ -0,0 +1,73 @@
+-- MBDELEG SL-2 pgTAP (IF-0-MBDELEG-4): re-signing refresh + credential demotion.
+--
+-- Proves that after the migration: rotate_agent_token (the 30-day refresh exchange)
+-- RAISES a deprecation error (no session issued); a newly issued agent_credentials
+-- row is an enrollment/lineage record (metadata.credential_role='enrollment', not
+-- session-exchangeable); and re-signing STILL works — a valid PoP challenge ->
+-- mint_fleet_agent_session mints a <=900s session for the same agent.
+--
+-- Runs as postgres (service_role-equivalent; provision_agent + mint are service-side).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(5);
+
+create temp table _resign_fx (agent_id uuid, credential_id uuid, key_id uuid, challenge_id uuid) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  u_owner uuid;
+  v_agent uuid; v_cred uuid;
+  v_key uuid := gen_random_uuid(); v_ch uuid := gen_random_uuid();
+begin
+  u_owner := public.ensure_github_user('resign-own-'||s, 'resign-own-'||s||'@example.test', 'resign-own-'||s, 'OWN');
+
+  -- Provision an agent through the credential choke point (_issue_agent_credential).
+  select agent_id, credential_id into v_agent, v_cred
+    from agent_board.provision_agent('resign-a-'||s, 'agent', '[]'::jsonb, u_owner);
+
+  -- Enroll an active, proven signing key + a pending challenge so the agent can re-sign.
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (v_key, v_agent, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(v_key::text,'-',''),43,'A'), 'active', 'proven');
+  insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at)
+  values (v_ch, v_key, v_agent, v_ch::text, 'agent-signing-key-proof.v1:'||v_ch||':n', 'pending', now() + interval '10 minutes');
+
+  insert into _resign_fx values (v_agent, v_cred, v_key, v_ch);
+end
+$$;
+
+-- 1. rotate_agent_token (the 30-day refresh exchange) is retired -> raises 0A000.
+select throws_ok(
+  (select format($q$select agent_board.rotate_agent_token(%L::uuid)$q$, agent_id) from _resign_fx),
+  '0A000', null, 'rotate_agent_token raises a deprecation error (no session exchanged)');
+
+-- 2. The issued credential is an enrollment/lineage record, not a session token.
+select is(
+  (select ac.metadata->>'credential_role' from agent_board.agent_credentials ac
+    where ac.id = (select credential_id from _resign_fx)),
+  'enrollment', 'a newly issued agent_credentials row is tagged credential_role=enrollment');
+
+-- 3. Re-signing still refreshes: PoP challenge -> mint_fleet_agent_session mints.
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, challenge_id, key_id, agent_id) from _resign_fx),
+  're-signing still refreshes: a valid PoP -> mint_fleet_agent_session mints a session');
+
+-- 4. Exactly one fleet_agent_session was minted for the agent.
+select is(
+  (select count(*)::int from agent_board.nonfleet_sessions
+    where agent_id = (select agent_id from _resign_fx) and identity_class = 'fleet_agent_session'),
+  1, 're-signing minted exactly one fleet_agent_session for the agent');
+
+-- 5. The minted session is pinned to <=900s.
+select ok(
+  (select bool_and(max_ttl_seconds <= 900 and expires_at <= now() + interval '900 seconds')
+     from agent_board.nonfleet_sessions
+    where agent_id = (select agent_id from _resign_fx) and identity_class = 'fleet_agent_session'),
+  'the re-signed session is pinned to a <=900s TTL');
+
+select finish();
+
+rollback;