@consiliency/agent-board-schema 1.2.0

package/tests/agent_board_inbox_schema.test.sql

@@ -0,0 +1,355 @@
+begin;
+
+select plan(24);
+
+select has_table('agent_board', 'boards', 'boards table exists');
+select has_table('agent_board', 'board_memberships', 'board_memberships table exists');
+select has_table('agent_board', 'delivery_recipients', 'delivery_recipients table exists');
+select has_table('agent_board', 'inbox_items', 'inbox_items table exists');
+select has_table('agent_board', 'callback_endpoints', 'callback_endpoints table exists');
+select has_table('agent_board', 'callback_subscriptions', 'callback_subscriptions table exists');
+select has_table('agent_board', 'callback_outbox_events', 'callback_outbox_events table exists');
+select has_table('agent_board', 'callback_delivery_attempts', 'callback_delivery_attempts table exists');
+
+select has_column('agent_board', 'inbox_items', 'action_state', 'inbox_items stores compact action state');
+select has_column('agent_board', 'inbox_items', 'fetch_descriptor', 'inbox_items stores canonical fetch descriptors');
+select has_column('agent_board', 'callback_outbox_events', 'idempotency_key', 'callback outbox stores durable idempotency keys');
+select has_column('agent_board', 'callback_delivery_attempts', 'next_retry_at', 'delivery attempts store retry schedule metadata');
+
+select ok(
+  (
+    select relrowsecurity
+    from pg_class
+    where relnamespace = 'agent_board'::regnamespace
+      and relname = 'boards'
+  ),
+  'boards has RLS enabled'
+);
+
+select ok(
+  (
+    select relrowsecurity
+    from pg_class
+    where relnamespace = 'agent_board'::regnamespace
+      and relname = 'inbox_items'
+  ),
+  'inbox_items has RLS enabled'
+);
+
+select ok(
+  (
+    select relrowsecurity
+    from pg_class
+    where relnamespace = 'agent_board'::regnamespace
+      and relname = 'callback_outbox_events'
+  ),
+  'callback_outbox_events has RLS enabled'
+);
+
+select ok(
+  (
+    select relrowsecurity
+    from pg_class
+    where relnamespace = 'agent_board'::regnamespace
+      and relname = 'callback_delivery_attempts'
+  ),
+  'callback_delivery_attempts has RLS enabled'
+);
+
+select ok(
+  exists (
+    select 1
+    from pg_indexes
+    where schemaname = 'agent_board'
+      and tablename = 'board_memberships'
+      and indexname = 'idx_agent_board_board_memberships_active_unique'
+  ),
+  'board_memberships enforces one active membership per board and agent'
+);
+
+select ok(
+  exists (
+    select 1
+    from pg_indexes
+    where schemaname = 'agent_board'
+      and tablename = 'delivery_recipients'
+      and indexname = 'idx_agent_board_delivery_recipients_unique_source_recipient'
+  ),
+  'delivery_recipients suppresses duplicate source-plus-recipient rows'
+);
+
+select ok(
+  exists (
+    select 1
+    from pg_indexes
+    where schemaname = 'agent_board'
+      and tablename = 'inbox_items'
+      and indexname = 'idx_agent_board_inbox_items_agent_pending'
+  ),
+  'inbox_items has a pending-action index for per-agent triage queries'
+);
+
+select ok(
+  exists (
+    select 1
+    from pg_indexes
+    where schemaname = 'agent_board'
+      and tablename = 'callback_outbox_events'
+      and indexname = 'idx_agent_board_callback_outbox_events_poll'
+  ),
+  'callback_outbox_events has a polling index for pending and retryable rows'
+);
+
+select ok(
+  exists (
+    select 1
+    from pg_indexes
+    where schemaname = 'agent_board'
+      and tablename = 'callback_delivery_attempts'
+      and indexname = 'idx_agent_board_callback_delivery_attempts_retry_schedule'
+      and indexdef ilike '%attempt_outcome = ''retryable_failure''%'
+  ),
+  'callback_delivery_attempts has a retry scheduling index'
+);
+
+select ok(
+  (
+    select count(*) = 8
+    from pg_policies
+    where schemaname = 'agent_board'
+      and policyname in (
+        'agent_board_service_all_boards',
+        'agent_board_service_all_board_memberships',
+        'agent_board_service_all_delivery_recipients',
+        'agent_board_service_all_inbox_items',
+        'agent_board_service_all_callback_endpoints',
+        'agent_board_service_all_callback_subscriptions',
+        'agent_board_service_all_callback_outbox_events',
+        'agent_board_service_all_callback_delivery_attempts'
+      )
+  ),
+  'new inbox-schema tables inherit service_role-only write posture'
+);
+
+select ok(
+  (
+    select count(*) = 0
+    from pg_policies
+    where schemaname = 'agent_board'
+      and tablename in (
+        'boards',
+        'board_memberships',
+        'delivery_recipients',
+        'inbox_items',
+        'callback_endpoints',
+        'callback_subscriptions',
+        'callback_outbox_events',
+        'callback_delivery_attempts'
+      )
+      and cmd in ('INSERT', 'UPDATE', 'DELETE')
+      and roles && array['authenticated'::name]
+  ),
+  'new inbox-schema tables expose no authenticated write policies'
+);
+
+do $$
+declare
+  v_sender uuid := gen_random_uuid();
+  v_recipient uuid := gen_random_uuid();
+  v_board_member uuid := gen_random_uuid();
+  v_thread uuid := gen_random_uuid();
+  v_message uuid := gen_random_uuid();
+  v_board uuid;
+  v_membership uuid;
+  v_direct_recipient uuid;
+  v_board_recipient uuid;
+  v_inbox_item uuid;
+  v_endpoint uuid;
+  v_subscription uuid;
+  v_outbox uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_sender, 'agent', 'test_inboxschema_sender', 'Inbox Sender'),
+    (v_recipient, 'agent', 'test_inboxschema_recipient', 'Inbox Recipient'),
+    (v_board_member, 'agent', 'test_inboxschema_board_member', 'Board Member');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values (v_thread, 'coordination', v_sender, 'Inbox schema test thread');
+
+  insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, message_type, body)
+  values (v_message, v_thread, v_sender, 1, 'comment', 'schema test message');
+
+  insert into agent_board.boards(slug, name, created_by_agent_id)
+  values ('test-inboxschema-board', 'Inbox Schema Test Board', v_sender)
+  returning id into v_board;
+
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id)
+  values (v_board, v_board_member, 'joined', v_sender)
+  returning id into v_membership;
+
+  insert into agent_board.delivery_recipients(delivery_mode, recipient_agent_id, source_kind, source_message_id)
+  values ('direct', v_recipient, 'message', v_message)
+  returning id into v_direct_recipient;
+
+  insert into agent_board.delivery_recipients(
+    delivery_mode,
+    recipient_agent_id,
+    source_kind,
+    source_message_id,
+    board_id,
+    board_membership_id
+  )
+  values ('board', v_board_member, 'message', v_message, v_board, v_membership)
+  returning id into v_board_recipient;
+
+  insert into agent_board.inbox_items(
+    delivery_recipient_id,
+    recipient_agent_id,
+    board_id,
+    delivery_mode,
+    source_kind,
+    source_message_id,
+    subject,
+    preview,
+    priority,
+    action_state,
+    visible_in_inbox,
+    visible_in_board_feed,
+    fetch_descriptor
+  )
+  values (
+    v_board_recipient,
+    v_board_member,
+    v_board,
+    'board',
+    'message',
+    v_message,
+    'Board update',
+    'Compact preview',
+    'high',
+    'new',
+    true,
+    true,
+    jsonb_build_object('surface', 'board', 'targetId', v_board::text, 'view', 'agent_board.v_board_feed', 'filters', jsonb_build_object(), 'reason', 'board delivery')
+  )
+  returning id into v_inbox_item;
+
+  insert into agent_board.callback_endpoints(owner_agent_id, endpoint_url, endpoint_status, verification_requested_at)
+  values (v_board_member, 'https://example.test/agent-board-callback', 'pending_verification', now())
+  returning id into v_endpoint;
+
+  insert into agent_board.callback_subscriptions(
+    endpoint_id,
+    agent_id,
+    subscription_scope,
+    event_category,
+    board_id,
+    board_membership_id
+  )
+  values (
+    v_endpoint,
+    v_board_member,
+    'board',
+    'board.post.delivered',
+    v_board,
+    v_membership
+  )
+  returning id into v_subscription;
+
+  insert into agent_board.callback_outbox_events(
+    endpoint_id,
+    subscription_id,
+    recipient_agent_id,
+    inbox_item_id,
+    board_id,
+    event_category,
+    delivery_mode,
+    source_kind,
+    source_message_id,
+    idempotency_key,
+    subject,
+    preview,
+    priority,
+    fetch_descriptor
+  )
+  values (
+    v_endpoint,
+    v_subscription,
+    v_board_member,
+    v_inbox_item,
+    v_board,
+    'board.post.delivered',
+    'board',
+    'message',
+    v_message,
+    'test-inboxschema-idempotency-key',
+    'Board update',
+    'Compact preview',
+    'high',
+    jsonb_build_object('surface', 'board', 'targetId', v_board::text, 'view', 'agent_board.v_board_feed', 'filters', jsonb_build_object(), 'reason', 'board delivery')
+  )
+  returning id into v_outbox;
+
+  insert into agent_board.callback_delivery_attempts(
+    outbox_event_id,
+    endpoint_id,
+    attempt_number,
+    attempt_outcome,
+    next_retry_at
+  )
+  values (
+    v_outbox,
+    v_endpoint,
+    1,
+    'retryable_failure',
+    now() + interval '5 minutes'
+  );
+
+  begin
+    insert into agent_board.delivery_recipients(delivery_mode, recipient_agent_id, source_kind, source_message_id)
+    values ('multicast', v_recipient, 'message', v_message);
+    raise exception 'duplicate recipient suppression failed';
+  exception
+    when unique_violation then null;
+  end;
+
+  begin
+    insert into agent_board.delivery_recipients(
+      delivery_mode,
+      recipient_agent_id,
+      source_kind,
+      source_message_id,
+      board_id
+    )
+    values ('board', v_recipient, 'message', v_message, v_board);
+    raise exception 'board recipient without membership should fail';
+  exception
+    when check_violation or foreign_key_violation then null;
+  end;
+
+  begin
+    insert into agent_board.callback_delivery_attempts(
+      outbox_event_id,
+      endpoint_id,
+      attempt_number,
+      attempt_outcome
+    )
+    values (
+      v_outbox,
+      v_endpoint,
+      2,
+      'retryable_failure'
+    );
+    raise exception 'retryable delivery attempt without next_retry_at should fail';
+  exception
+    when check_violation then null;
+  end;
+end
+$$;
+
+select ok(true, 'schema-level behavior supports direct delivery, opt-in board fan-out, duplicate suppression, and durable outbox retry metadata');
+
+select finish();
+
+rollback;

package/tests/agent_board_nonfleet_identity.test.sql

@@ -0,0 +1,26 @@
+-- pgTAP tests for non-fleet identity tables
+begin;
+select plan(18);
+
+select has_table('agent_board', 'nonfleet_sessions', 'nonfleet_sessions table exists');
+select has_column('agent_board', 'nonfleet_sessions', 'id', 'nonfleet_sessions has id');
+select has_column('agent_board', 'nonfleet_sessions', 'session_id', 'nonfleet_sessions has session_id');
+select has_column('agent_board', 'nonfleet_sessions', 'identity_class', 'nonfleet_sessions has identity_class');
+select has_column('agent_board', 'nonfleet_sessions', 'supervisor_allowed', 'nonfleet_sessions has supervisor_allowed');
+select has_column('agent_board', 'nonfleet_sessions', 'elevated_admin_allowed', 'nonfleet_sessions has elevated_admin_allowed');
+select has_column('agent_board', 'nonfleet_sessions', 'parent_credential_id', 'nonfleet_sessions has parent_credential_id');
+select has_column('agent_board', 'nonfleet_sessions', 'expires_at', 'nonfleet_sessions has expires_at');
+select has_column('agent_board', 'nonfleet_sessions', 'revoked_at', 'nonfleet_sessions has revoked_at');
+select col_default_is('agent_board', 'nonfleet_sessions', 'supervisor_allowed', 'false', 'supervisor_allowed defaults to false');
+select col_default_is('agent_board', 'nonfleet_sessions', 'elevated_admin_allowed', 'false', 'elevated_admin_allowed defaults to false');
+select has_index('agent_board', 'nonfleet_sessions', 'idx_nonfleet_sessions_session_id', 'session_id unique index exists');
+
+select has_table('agent_board', 'nonfleet_invitations', 'nonfleet_invitations table exists');
+select has_column('agent_board', 'nonfleet_invitations', 'trust_domain', 'nonfleet_invitations has trust_domain');
+select has_column('agent_board', 'nonfleet_invitations', 'lifecycle_state', 'nonfleet_invitations has lifecycle_state');
+select has_column('agent_board', 'nonfleet_invitations', 'invited_by_agent_id', 'nonfleet_invitations has invited_by_agent_id');
+select has_column('agent_board', 'nonfleet_invitations', 'revoked_by_agent_id', 'nonfleet_invitations has revoked_by_agent_id');
+select has_column('agent_board', 'nonfleet_invitations', 'accepted_at', 'nonfleet_invitations has accepted_at');
+
+select * from finish();
+rollback;

package/tests/agent_board_rls_reassert_board_scoping.test.sql

@@ -0,0 +1,39 @@
+begin;
+select plan(6);
+
+-- After the corrective migration, the five reasserted SELECT policies must be
+-- BOARD-SCOPED (qualified outer-table references), never the leaking tautology
+-- (bm.board_id = bm.board_id / dr.source_task_id = dr.id).
+
+select ok(
+  pg_get_expr(polqual, polrelid) like '%bm.board_id = delivery_recipients.board_id%',
+  'delivery_recipients policy is board-scoped (qualified)')
+from pg_policy where polname = 'agent_board_authenticated_select_delivery_recipients';
+
+select ok(
+  pg_get_expr(polqual, polrelid) not like '%bm.board_id = bm.board_id%',
+  'delivery_recipients policy is NOT the leaking tautology')
+from pg_policy where polname = 'agent_board_authenticated_select_delivery_recipients';
+
+select ok(
+  pg_get_expr(polqual, polrelid) like '%bm.board_id = inbox_items.board_id%',
+  'inbox_items policy is board-scoped (qualified)')
+from pg_policy where polname = 'agent_board_authenticated_select_inbox_items';
+
+select ok(
+  pg_get_expr(polqual, polrelid) not like '%bm.board_id = bm.board_id%',
+  'inbox_items policy is NOT the leaking tautology')
+from pg_policy where polname = 'agent_board_authenticated_select_inbox_items';
+
+select ok(
+  pg_get_expr(polqual, polrelid) like '%dr.source_task_id = tasks.id%',
+  'tasks policy correlates delivery_recipients by tasks.id (qualified)')
+from pg_policy where polname = 'agent_board_authenticated_select_tasks';
+
+select ok(
+  pg_get_expr(polqual, polrelid) not like '%dr.source_task_id = dr.id%',
+  'tasks policy is NOT the leaking tautology')
+from pg_policy where polname = 'agent_board_authenticated_select_tasks';
+
+select * from finish();
+rollback;

package/tests/agent_board_schema_version.test.sql

@@ -0,0 +1,24 @@
+SELECT plan(4);
+
+SELECT has_table('agent_board', 'schema_version', 'schema_version table exists');
+
+SELECT is(
+  (SELECT count(*)::int FROM agent_board.schema_version),
+  1,
+  'schema_version has exactly one row'
+);
+
+SELECT is(
+  (SELECT version FROM agent_board.schema_version),
+  7,
+  'schema_version.version is 7'
+);
+
+SELECT throws_ok(
+  $$INSERT INTO agent_board.schema_version (version) VALUES (8)$$,
+  '23505',
+  NULL,
+  'schema_version rejects a second row'
+);
+
+SELECT finish();

package/tests/agent_board_schema_version_rpc.test.sql

@@ -0,0 +1,40 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public;
+
+begin;
+
+select plan(5);
+
+select has_function(
+  'agent_board',
+  'get_schema_version',
+  array[]::text[],
+  'get_schema_version exists'
+);
+
+select ok(
+  has_function_privilege('authenticated', 'agent_board.get_schema_version()', 'EXECUTE'),
+  'authenticated agents can execute get_schema_version'
+);
+
+select ok(
+  not has_function_privilege('anon', 'agent_board.get_schema_version()', 'EXECUTE'),
+  'anonymous callers cannot execute get_schema_version'
+);
+
+select ok(
+  not has_table_privilege('authenticated', 'agent_board.schema_version', 'SELECT'),
+  'authenticated agents retain no direct schema_version table access'
+);
+
+set local role authenticated;
+
+select is(
+  (select version from agent_board.get_schema_version()),
+  7,
+  'authenticated agents receive the metadata-only schema version'
+);
+
+select * from finish();
+
+rollback;

package/tests/agent_board_signature_rls_reads.test.sql

@@ -0,0 +1,133 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(12);
+
+select has_view('agent_board', 'v_signature_evidence_status', 'signature evidence status view exists');
+select has_column('agent_board', 'v_thread_feed', 'verification_status', 'thread feed exposes verification_status');
+select has_column('agent_board', 'v_thread_feed', 'key_fingerprint', 'thread feed exposes key_fingerprint');
+select has_column('agent_board', 'v_thread_feed', 'key_version', 'thread feed exposes key_version');
+select has_column('agent_board', 'v_thread_feed', 'algorithm', 'thread feed exposes algorithm');
+select has_column('agent_board', 'v_thread_feed', 'verified_at', 'thread feed exposes verified_at');
+select has_column('agent_board', 'v_thread_feed', 'failure_class', 'thread feed exposes failure_class');
+select has_column('agent_board', 'v_task_tree', 'verification_status', 'task tree exposes verification_status');
+select has_column('agent_board', 'v_agent_dashboard', 'latest_signature_verification_status', 'dashboard exposes latest signature status');
+
+select ok(
+  (
+    select count(*) = 4
+      from pg_class c
+     where c.relnamespace = 'agent_board'::regnamespace
+       and c.relname in (
+         'agent_signing_keys',
+         'agent_signing_key_challenges',
+         'signature_evidence',
+         'signature_replay_state'
+       )
+       and c.relrowsecurity
+  ),
+  'SIGNSTORE tables have RLS enabled'
+);
+
+do $$
+declare
+  v_author uuid := gen_random_uuid();
+  v_recipient uuid := gen_random_uuid();
+  v_thread uuid := gen_random_uuid();
+  v_message uuid := gen_random_uuid();
+  v_key uuid;
+  v_seen bigint;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_author, 'agent', 'signread-author', 'SIGNREAD Author'),
+    (v_recipient, 'agent', 'signread-recipient', 'SIGNREAD Recipient');
+
+  insert into agent_board.threads(id, created_by_agent_id, subject)
+  values (v_thread, v_author, 'SIGNREAD thread');
+
+  insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, body)
+  values (v_message, v_thread, v_author, 1, 'visible signed body');
+
+  insert into agent_board.delivery_recipients(delivery_mode, recipient_agent_id, source_kind, source_message_id)
+  values ('direct', v_recipient, 'message', v_message);
+
+  insert into agent_board.agent_signing_keys(
+    agent_id,
+    key_id,
+    key_version,
+    public_key,
+    public_key_format,
+    fingerprint,
+    status,
+    proof_state
+  )
+  values (
+    v_author,
+    'primary',
+    1,
+    repeat('A', 43),
+    'raw_ed25519_base64url',
+    'sha256:' || repeat('Q', 43),
+    'active',
+    'proven'
+  )
+  returning id into v_key;
+
+  insert into agent_board.signature_evidence(
+    agent_id,
+    signing_key_id,
+    key_id,
+    key_version,
+    source_kind,
+    source_message_id,
+    operation,
+    payload_digest,
+    verification_status,
+    verified_at
+  )
+  values (
+    v_author,
+    v_key,
+    'primary',
+    1,
+    'message',
+    v_message,
+    'agent_board.post_message',
+    'sha256:' || repeat('a', 64),
+    'verified',
+    now()
+  );
+
+  select count(*) into v_seen
+    from agent_board.v_thread_feed
+   where message_id = v_message
+     and verification_status = 'verified'
+     and key_fingerprint = 'sha256:' || repeat('Q', 43)
+     and key_version = 1
+     and algorithm = 'Ed25519';
+
+  if v_seen <> 1 then
+    raise exception 'verification-aware thread feed did not expose signature status';
+  end if;
+end
+$$;
+
+select pass('verification-aware read models expose metadata-safe signature status');
+
+select ok(
+  not exists (
+    select 1
+      from information_schema.columns
+     where table_schema = 'agent_board'
+       and table_name in ('v_thread_feed', 'v_task_tree', 'v_agent_dashboard', 'v_signature_evidence_status')
+       and column_name ~* 'raw|private|secret|signature$'
+  ),
+  'default read models omit raw signatures and private material'
+);
+
+select finish();
+
+rollback;