@consiliency/agent-board-schema 1.2.0

package/tests/agent_board_callbackcap.test.sql

@@ -0,0 +1,222 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(8);
+
+create temp table _callbackcap_fixture (
+  agent_id uuid,
+  thread_id uuid,
+  board_id uuid,
+  endpoint_id uuid
+) on commit drop;
+
+grant all on table _callbackcap_fixture to authenticated, service_role;
+
+do $$
+declare
+  v_agent uuid := gen_random_uuid();
+  v_thread uuid := gen_random_uuid();
+  v_board uuid;
+  v_endpoint record;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values (v_agent, 'agent', 'callbackcap-agent-' || substr(v_agent::text, 1, 8), 'CALLBACKCAP Agent');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values (v_thread, 'coordination', v_agent, 'CALLBACKCAP thread');
+
+  select board_id into v_board
+    from agent_board.create_board(
+      v_agent,
+      'callbackcap-board-' || substr(v_agent::text, 1, 8),
+      'CALLBACKCAP Board',
+      'callback capability regression',
+      '{}'::jsonb,
+      'open'
+    );
+  perform agent_board.join_board(v_board, v_agent, 'subscribed', v_agent, '{}'::jsonb);
+
+  select * into v_endpoint
+    from agent_board.register_callback_endpoint(
+      v_agent,
+      'https://callbackcap.example.test/hook',
+      '{"purpose":"callbackcap"}'::jsonb
+    );
+
+  insert into _callbackcap_fixture(agent_id, thread_id, board_id, endpoint_id)
+  values (v_agent, v_thread, v_board, v_endpoint.endpoint_id);
+end
+$$;
+
+do $$
+declare
+  v_fixture record;
+begin
+  select * into v_fixture from _callbackcap_fixture;
+  begin
+    perform *
+      from agent_board.verify_callback_endpoint(v_fixture.endpoint_id, v_fixture.agent_id, '{}'::jsonb);
+    raise exception 'verify_callback_endpoint unexpectedly accepted missing controlProofRef';
+  exception
+    when sqlstate '22023' then null;
+  end;
+end
+$$;
+select pass('verify_callback_endpoint requires bounded controlProofRef metadata');
+
+do $$
+declare
+  v_fixture record;
+  v_verified record;
+  v_metadata jsonb;
+begin
+  select * into v_fixture from _callbackcap_fixture;
+  select * into v_verified
+    from agent_board.verify_callback_endpoint(
+      v_fixture.endpoint_id,
+      v_fixture.agent_id,
+      '{"controlProofRef":"callbackcap/operator-note/1"}'::jsonb
+    );
+
+  if v_verified.endpoint_status <> 'verified' then
+    raise exception 'endpoint did not verify';
+  end if;
+
+  select metadata into v_metadata
+    from agent_board.callback_endpoints
+   where id = v_fixture.endpoint_id;
+
+  if v_metadata ->> 'verificationMethod' <> 'administrative_enablement'
+     or v_metadata ->> 'controlProofRef' <> 'callbackcap/operator-note/1'
+     or v_metadata ? 'signingSecret' then
+    raise exception 'verification metadata was not bounded and proof-referenced: %', v_metadata;
+  end if;
+end
+$$;
+select pass('verify_callback_endpoint records administrative enablement plus control proof metadata');
+
+do $$
+declare
+  v_fixture record;
+begin
+  select * into v_fixture from _callbackcap_fixture;
+  perform *
+    from agent_board.subscribe_callback_endpoint(
+      v_fixture.endpoint_id,
+      v_fixture.agent_id,
+      'board',
+      'board.post.delivered',
+      v_fixture.board_id,
+      '{}'::jsonb
+    );
+  perform *
+    from agent_board.subscribe_callback_endpoint(
+      v_fixture.endpoint_id,
+      v_fixture.agent_id,
+      'board',
+      'board.post.updated',
+      v_fixture.board_id,
+      '{}'::jsonb
+    );
+end
+$$;
+select pass('board callback subscriptions accept delivered and updated categories with boardId');
+
+do $$
+declare
+  v_fixture record;
+begin
+  select * into v_fixture from _callbackcap_fixture;
+  begin
+    perform *
+      from agent_board.subscribe_callback_endpoint(
+        v_fixture.endpoint_id,
+        v_fixture.agent_id,
+        'board',
+        'board.post.delivered',
+        null,
+        '{}'::jsonb
+      );
+    raise exception 'board callback subscription unexpectedly accepted missing boardId';
+  exception
+    when sqlstate '22023' then null;
+  end;
+end
+$$;
+select pass('board callback subscriptions require boardId');
+
+do $$
+declare
+  v_fixture record;
+begin
+  select * into v_fixture from _callbackcap_fixture;
+  begin
+    perform *
+      from agent_board.subscribe_callback_endpoint(
+        v_fixture.endpoint_id,
+        v_fixture.agent_id,
+        'own_inbox',
+        'board.post.delivered',
+        null,
+        '{}'::jsonb
+      );
+    raise exception 'own_inbox callback subscription unexpectedly accepted board category';
+  exception
+    when sqlstate '22023' then null;
+  end;
+end
+$$;
+select pass('own_inbox callback subscriptions reject board categories');
+
+do $$
+declare
+  v_fixture record;
+  v_post record;
+begin
+  select * into v_fixture from _callbackcap_fixture;
+  select * into v_post
+    from agent_board.post_board_message(
+      v_fixture.thread_id,
+      v_fixture.agent_id,
+      v_fixture.board_id,
+      'CALLBACKCAP board post',
+      'board callback outbox proof',
+      'comment',
+      'medium',
+      'callbackcap-board-post',
+      '{}'::jsonb
+    );
+
+  if coalesce(v_post.callback_outbox_count, 0) < 1 then
+    raise exception 'board post did not enqueue board callback outbox work';
+  end if;
+end
+$$;
+select pass('board post delivery enqueues callback outbox work for board subscriptions');
+
+select ok(
+  exists (
+    select 1
+      from agent_board.callback_outbox_events
+     where event_category = 'board.post.delivered'
+       and idempotency_key like 'board.post.delivered:%'
+       and board_id = (select board_id from _callbackcap_fixture)
+  ),
+  'board callback outbox rows carry board category and idempotency key'
+);
+
+select ok(
+  not exists (
+    select 1
+      from agent_board.callback_endpoints
+     where id = (select endpoint_id from _callbackcap_fixture)
+       and metadata ? 'signingSecret'
+  ),
+  'callback endpoint metadata does not expose signing secrets'
+);
+
+select finish();
+
+rollback;

package/tests/agent_board_canary_signed_fleet_enforcement.test.sql

@@ -0,0 +1,60 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(8);
+
+select has_function('agent_board', 'evaluate_signed_write_fleet_policy', array['text', 'jsonb', 'jsonb'], 'signed fleet policy evaluator exists');
+select has_function('agent_board', 'signed_send_multicast_message', array['jsonb', 'jsonb'], 'signed multicast wrapper exists');
+select has_function('agent_board', 'signed_create_tasking_delivery', array['jsonb', 'jsonb'], 'signed tasking wrapper exists');
+
+select function_privs_are(
+  'agent_board',
+  'send_direct_message',
+  array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
+  'authenticated',
+  array[]::text[],
+  'authenticated cannot bypass direct signed gateway'
+);
+
+select function_privs_are(
+  'agent_board',
+  'send_multicast_message',
+  array['uuid','uuid','uuid[]','text','text','text','text','text','jsonb'],
+  'authenticated',
+  array[]::text[],
+  'authenticated cannot bypass multicast signed gateway'
+);
+
+select function_privs_are(
+  'agent_board',
+  'post_board_message',
+  array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
+  'authenticated',
+  array[]::text[],
+  'authenticated cannot bypass board signed gateway'
+);
+
+select function_privs_are(
+  'agent_board',
+  'create_tasking_delivery',
+  array['uuid','uuid','text','text','uuid[]','uuid','text','text','text','jsonb'],
+  'authenticated',
+  array[]::text[],
+  'authenticated cannot bypass tasking signed gateway'
+);
+
+select ok(
+  not exists (
+    select 1 from information_schema.routine_privileges
+     where routine_schema = 'agent_board'
+       and routine_name in ('evaluate_signed_write_fleet_policy', 'signed_send_multicast_message', 'signed_create_tasking_delivery')
+       and grantee in ('anon', 'authenticated')
+  ),
+  'new enforcement functions remain service-role only'
+);
+
+select finish();
+
+rollback;

package/tests/agent_board_dblint_rpcs.test.sql

@@ -0,0 +1,247 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(10);
+
+insert into agent_board.agents(id, agent_type, handle, display_name)
+values
+  ('00000000-0000-0000-0000-000000000101', 'agent', 'test_dblint_creator', 'DBLINT Creator'),
+  ('00000000-0000-0000-0000-000000000102', 'agent', 'test_dblint_resolver', 'DBLINT Resolver'),
+  ('00000000-0000-0000-0000-000000000103', 'agent', 'test_dblint_recipient_one', 'DBLINT Recipient One'),
+  ('00000000-0000-0000-0000-000000000104', 'agent', 'test_dblint_recipient_two', 'DBLINT Recipient Two');
+
+insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+values (
+  '00000000-0000-0000-0000-000000000201',
+  'coordination',
+  '00000000-0000-0000-0000-000000000101',
+  'DBLINT RPC coverage'
+);
+
+create temporary table dblint_primary_task on commit drop as
+select *
+  from agent_board.create_task(
+    '00000000-0000-0000-0000-000000000201',
+    '00000000-0000-0000-0000-000000000101',
+    'Primary task',
+    'seed task for dblint coverage',
+    null,
+    null,
+    'medium',
+    'distributed',
+    '{}'::jsonb
+  );
+
+create temporary table dblint_appended on commit drop as
+select *
+  from agent_board.append_task_event(
+    (select task_id from dblint_primary_task),
+    '00000000-0000-0000-0000-000000000101',
+    'commented',
+    jsonb_build_object('note', 'second event')
+  );
+
+select is(
+  (select event_sequence from dblint_appended),
+  2::bigint,
+  '_next_task_event_sequence advances through append_task_event'
+);
+
+create temporary table dblint_tasking on commit drop as
+select *
+  from agent_board.create_tasking_delivery(
+    '00000000-0000-0000-0000-000000000201',
+    '00000000-0000-0000-0000-000000000101',
+    'Tasking delivery title',
+    'Tasking delivery details',
+    array[
+      '00000000-0000-0000-0000-000000000103'::uuid,
+      '00000000-0000-0000-0000-000000000103'::uuid,
+      '00000000-0000-0000-0000-000000000104'::uuid
+    ],
+    null,
+    'high',
+    'distributed',
+    null,
+    '{}'::jsonb
+  );
+
+select ok(
+  (
+    select td.created_event_id = te.id
+      from dblint_tasking td
+      join agent_board.task_events te
+        on te.task_id = td.task_id
+       and te.event_sequence = 1
+  ),
+  'create_tasking_delivery reuses the first task event lookup'
+);
+
+select is(
+  (select delivered_recipient_count from dblint_tasking),
+  2,
+  'create_tasking_delivery suppresses duplicate explicit recipients'
+);
+
+create temporary table dblint_conflict on commit drop as
+select *
+  from agent_board.raise_conflict(
+    '00000000-0000-0000-0000-000000000201',
+    '00000000-0000-0000-0000-000000000101',
+    'Need a conflict record',
+    'plan',
+    'high',
+    (select task_id from dblint_primary_task),
+    jsonb_build_object('seed', 'conflict')
+  );
+
+create temporary table dblint_resolved_conflict on commit drop as
+select *
+  from agent_board.resolve_conflict(
+    (select conflict_id from dblint_conflict),
+    '00000000-0000-0000-0000-000000000102',
+    jsonb_build_object('resolution', 'done')
+  );
+
+select is(
+  (select status from dblint_resolved_conflict),
+  'resolved',
+  'resolve_conflict marks the conflict resolved'
+);
+
+select ok(
+  (
+    select c.details @> jsonb_build_object('seed', 'conflict', 'resolution', 'done')
+      from agent_board.conflicts c
+     where c.id = (select conflict_id from dblint_conflict)
+  ),
+  'resolve_conflict merges detail payloads without ambiguity regressions'
+);
+
+create temporary table dblint_escalation on commit drop as
+select *
+  from agent_board.raise_escalation(
+    '00000000-0000-0000-0000-000000000201',
+    '00000000-0000-0000-0000-000000000101',
+    'Need an escalation record',
+    'approval',
+    'high',
+    (select task_id from dblint_primary_task),
+    '00000000-0000-0000-0000-000000000102',
+    jsonb_build_object('seed', 'escalation')
+  );
+
+create temporary table dblint_resolved_escalation on commit drop as
+select *
+  from agent_board.resolve_escalation(
+    (select escalation_id from dblint_escalation),
+    '00000000-0000-0000-0000-000000000102',
+    jsonb_build_object('resolution', 'approved')
+  );
+
+select is(
+  (select status from dblint_resolved_escalation),
+  'resolved',
+  'resolve_escalation marks the escalation resolved'
+);
+
+select ok(
+  (
+    select e.details @> jsonb_build_object('seed', 'escalation', 'resolution', 'approved')
+      from agent_board.escalations e
+     where e.id = (select escalation_id from dblint_escalation)
+  ),
+  'resolve_escalation merges detail payloads without ambiguity regressions'
+);
+
+create temporary table dblint_heartbeat_first on commit drop as
+select *
+  from agent_board.heartbeat(
+    '00000000-0000-0000-0000-000000000101',
+    '00000000-0000-0000-0000-000000000201',
+    'ready',
+    'initial heartbeat',
+    interval '5 minutes',
+    '{}'::jsonb
+  );
+
+create temporary table dblint_heartbeat_second on commit drop as
+select *
+  from agent_board.heartbeat(
+    '00000000-0000-0000-0000-000000000101',
+    '00000000-0000-0000-0000-000000000201',
+    'busy',
+    'updated heartbeat',
+    interval '10 minutes',
+    jsonb_build_object('pass', 2)
+  );
+
+select ok(
+  (
+    select count(*) = 1
+      from agent_board.presence p
+     where p.agent_id = '00000000-0000-0000-0000-000000000101'
+       and p.availability = 'busy'
+  ),
+  'heartbeat upserts a single presence row through the repaired conflict target'
+);
+
+create temporary table dblint_message_one on commit drop as
+select *
+  from agent_board.post_message(
+    '00000000-0000-0000-0000-000000000201',
+    '00000000-0000-0000-0000-000000000101',
+    'mark-read seed message',
+    'comment',
+    null,
+    '{}'::jsonb
+  );
+
+create temporary table dblint_message_two on commit drop as
+select *
+  from agent_board.post_message(
+    '00000000-0000-0000-0000-000000000201',
+    '00000000-0000-0000-0000-000000000101',
+    'mark-read second message',
+    'comment',
+    null,
+    '{}'::jsonb
+  );
+
+create temporary table dblint_mark_read_first on commit drop as
+select *
+  from agent_board.mark_read(
+    '00000000-0000-0000-0000-000000000201',
+    '00000000-0000-0000-0000-000000000101',
+    1
+  );
+
+create temporary table dblint_mark_read_second on commit drop as
+select *
+  from agent_board.mark_read(
+    '00000000-0000-0000-0000-000000000201',
+    '00000000-0000-0000-0000-000000000101',
+    99
+  );
+
+select ok(
+  (
+    select count(*) = 1
+      from agent_board.read_receipts rr
+     where rr.thread_id = '00000000-0000-0000-0000-000000000201'
+       and rr.agent_id = '00000000-0000-0000-0000-000000000101'
+  ),
+  'mark_read upserts a single read receipt row through the repaired conflict target'
+);
+
+select is(
+  (select last_read_message_sequence from dblint_mark_read_second),
+  2::bigint,
+  'mark_read caps the stored sequence at the thread maximum'
+);
+
+select finish();
+
+rollback;