@consiliency/agent-board-schema 1.2.0

package/tests/agent_board_signed_write_gateway.test.sql

@@ -0,0 +1,219 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(13);
+
+select has_function('agent_board', 'reserve_signed_write_replay', 'replay reservation helper exists');
+select has_function('agent_board', 'signed_send_direct_message', 'signed direct-message wrapper exists');
+select has_function('agent_board', 'signed_append_task_event', 'signed task-event wrapper exists');
+select has_function('agent_board', 'signed_post_board_message', 'signed board-message wrapper exists');
+
+select hasnt_table('agent_board', 'private_signing_keys', 'gateway does not introduce private key storage');
+
+do $$
+declare
+  v_agent uuid := gen_random_uuid();
+  v_recipient uuid := gen_random_uuid();
+  v_thread uuid := gen_random_uuid();
+  v_task uuid := gen_random_uuid();
+  v_board uuid := gen_random_uuid();
+  v_key uuid;
+  v_direct record;
+  v_task_event record;
+  v_board_post record;
+begin
+  perform set_config('request.jwt.claim.role', 'service_role', true);
+
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_agent, 'agent', 'signgateway-agent', 'SIGNGATEWAY Agent'),
+    (v_recipient, 'agent', 'signgateway-recipient', 'SIGNGATEWAY Recipient');
+
+  insert into agent_board.threads(id, created_by_agent_id, subject)
+  values (v_thread, v_agent, 'SIGNGATEWAY thread');
+
+  insert into agent_board.tasks(id, thread_id, created_by_agent_id, title)
+  values (v_task, v_thread, v_agent, 'SIGNGATEWAY task');
+
+  insert into agent_board.boards(id, slug, name, created_by_agent_id)
+  values (v_board, 'signgateway', 'SIGNGATEWAY', v_agent);
+
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id)
+  values (v_board, v_agent, 'joined', v_agent);
+
+  insert into agent_board.agent_signing_keys(
+    agent_id,
+    key_id,
+    key_version,
+    public_key,
+    public_key_format,
+    fingerprint,
+    status,
+    proof_state
+  )
+  values (
+    v_agent,
+    'primary',
+    1,
+    repeat('A', 43),
+    'raw_ed25519_base64url',
+    'sha256:' || repeat('A', 43),
+    'active',
+    'proven'
+  )
+  returning id into v_key;
+
+  perform agent_board.reserve_signed_write_replay(v_agent, v_key, 'send_direct_message', 'sha256:' || repeat('d', 64), 'nonce-1', null, now(), now() + interval '10 minutes');
+
+  select *
+    into v_direct
+    from agent_board.signed_send_direct_message(
+      jsonb_build_object(
+        'p_thread_id', v_thread,
+        'p_author_agent_id', v_agent,
+        'p_recipient_agent_id', v_recipient,
+        'p_subject', 'Signed direct',
+        'p_body', 'verified signature direct message',
+        'p_metadata', jsonb_build_object('source', 'test')
+      ),
+      jsonb_build_object(
+        'agent_id', v_agent,
+        'signing_key_id', v_key,
+        'key_id', 'primary',
+        'key_version', 1,
+        'algorithm', 'Ed25519',
+        'key_fingerprint', 'sha256:' || repeat('A', 43),
+        'verification_status', 'verified',
+        'payload_digest', 'sha256:' || repeat('d', 64),
+        'signature_digest', 'sha256:' || repeat('e', 64),
+        'canonicalization_version', 'agent-provenance-jcs.v1',
+        'signed_at', now(),
+        'verified_at', now(),
+        'nonce', 'nonce-1',
+        'enforcement_mode', 'require_for_agent_writes',
+        'redacted', true
+      )
+    );
+
+  select *
+    into v_task_event
+    from agent_board.signed_append_task_event(
+      jsonb_build_object(
+        'p_task_id', v_task,
+        'p_actor_agent_id', v_agent,
+        'p_event_type', 'status_changed',
+        'p_status', 'completed',
+        'p_payload', jsonb_build_object('source', 'test')
+      ),
+      jsonb_build_object(
+        'agent_id', v_agent,
+        'signing_key_id', v_key,
+        'key_id', 'primary',
+        'key_version', 1,
+        'verification_status', 'verified',
+        'payload_digest', 'sha256:' || repeat('f', 64),
+        'canonicalization_version', 'agent-provenance-jcs.v1',
+        'enforcement_mode', 'require_for_agent_writes',
+        'redacted', true
+      )
+    );
+
+  select *
+    into v_board_post
+    from agent_board.signed_post_board_message(
+      jsonb_build_object(
+        'p_thread_id', v_thread,
+        'p_author_agent_id', v_agent,
+        'p_board_id', v_board,
+        'p_subject', 'Signed board',
+        'p_body', 'verified signature board message',
+        'p_metadata', jsonb_build_object('source', 'test')
+      ),
+      jsonb_build_object(
+        'agent_id', v_agent,
+        'signing_key_id', v_key,
+        'key_id', 'primary',
+        'key_version', 1,
+        'verification_status', 'warn',
+        'payload_digest', 'sha256:' || repeat('b', 64),
+        'canonicalization_version', 'agent-provenance-jcs.v1',
+        'enforcement_mode', 'warn',
+        'redacted', true
+      )
+    );
+end
+$$;
+
+select ok(
+  exists (select 1 from agent_board.signature_evidence where operation = 'send_direct_message' and verification_status = 'verified' and source_message_id is not null),
+  'valid signed direct message records linked signature evidence'
+);
+
+select ok(
+  exists (select 1 from agent_board.signature_evidence where operation = 'append_task_event' and verification_status = 'verified' and source_task_event_id is not null),
+  'valid signed task event records linked signature evidence'
+);
+
+select ok(
+  exists (select 1 from agent_board.signature_evidence where operation = 'post_board_message' and verification_status = 'warn' and metadata ->> 'metadata-safe' = 'true'),
+  'warn-mode unsigned compatibility can record metadata-safe evidence'
+);
+
+select throws_like(
+  $$select * from agent_board.reserve_signed_write_replay(
+    (select id from agent_board.agents where handle = 'signgateway-agent'),
+    (
+      select sk.id
+        from agent_board.agent_signing_keys sk
+        join agent_board.agents a on a.id = sk.agent_id
+       where sk.key_id = 'primary'
+         and a.handle = 'signgateway-agent'
+    ),
+    'send_direct_message',
+    'sha256:' || repeat('d', 64),
+    'nonce-1',
+    null,
+    now(),
+    now() + interval '10 minutes'
+  )$$,
+  '%nonce_replay%',
+  'replayed nonce is rejected'
+);
+
+select throws_like(
+  $$select * from agent_board.signed_send_direct_message(
+    jsonb_build_object('p_thread_id', gen_random_uuid(), 'p_recipient_agent_id', gen_random_uuid(), 'p_subject', 'x', 'p_body', 'y'),
+    jsonb_build_object('verification_status', 'failed', 'failure_class', 'actor_mismatch')
+  )$$,
+  '%actor_mismatch%',
+  'actor mismatch fails before canonical write'
+);
+
+select ok(
+  exists (
+    select 1 from agent_board.signature_evidence
+     where failure_class is null
+       and metadata ->> 'redacted' = 'true'
+  ),
+  'signature evidence records redaction posture'
+);
+
+select ok(
+  not exists (
+    select 1
+      from agent_board.signature_evidence
+     where metadata::text ~* 'private key|service-role|secret|raw signature'
+  ),
+  'metadata-safe evidence does not store raw private, service-role, secret, or raw signature text'
+);
+
+select ok(
+  exists (select 1 from agent_board.schema_version where version >= 5),
+  'schema_version preserves SQL-ahead SIGNSTORE compatibility version'
+);
+
+select finish();
+
+rollback;

package/tests/agent_board_signing_proof_rpcs.test.sql

@@ -0,0 +1,143 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(7);
+
+select has_function('agent_board', 'issue_signing_key_challenge', array['uuid', 'text', 'interval'], 'issue_signing_key_challenge exists');
+select has_function('agent_board', 'record_signing_key_proof_result', array['uuid', 'uuid', 'text', 'boolean', 'text', 'jsonb'], 'record_signing_key_proof_result exists');
+
+do $$
+declare
+  v_agent uuid := gen_random_uuid();
+  v_challenge record;
+  v_result record;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values (v_agent, 'agent', 'signproof-agent', 'SIGNPROOF Agent');
+
+  insert into agent_board.agent_signing_keys(
+    agent_id,
+    key_id,
+    key_version,
+    public_key,
+    public_key_format,
+    fingerprint
+  )
+  values (
+    v_agent,
+    'primary',
+    1,
+    repeat('A', 43),
+    'raw_ed25519_base64url',
+    'sha256:' || repeat('Z', 43)
+  );
+
+  set local role service_role;
+  select * into v_challenge
+    from agent_board.issue_signing_key_challenge(v_agent, 'primary', interval '5 minutes');
+
+  if v_challenge.challenge !~ '^agent-signing-key-proof\.v1:' then
+    raise exception 'challenge bytes did not use proof prefix';
+  end if;
+
+  select * into v_result
+    from agent_board.record_signing_key_proof_result(
+      v_challenge.challenge_id,
+      v_agent,
+      'primary',
+      true,
+      null,
+      '{"proofRuntime":"vitest"}'::jsonb
+    );
+
+  if v_result.proof_state <> 'proven' or v_result.verified_at is null then
+    raise exception 'verified proof did not activate proof state';
+  end if;
+
+  begin
+    perform *
+      from agent_board.record_signing_key_proof_result(
+        v_challenge.challenge_id,
+        v_agent,
+        'primary',
+        true,
+        null,
+        '{}'::jsonb
+      );
+    raise exception 'challenge replay unexpectedly succeeded';
+  exception
+    when unique_violation then null;
+  end;
+end
+$$;
+
+reset role;
+
+select pass('challenge issuance records bounded challenge bytes');
+select pass('verified proof activates the signing key');
+select pass('challenge replay is rejected');
+
+do $$
+declare
+  v_agent uuid := gen_random_uuid();
+  v_challenge record;
+  v_result record;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values (v_agent, 'agent', 'signproof-fail-agent', 'SIGNPROOF Fail Agent');
+
+  insert into agent_board.agent_signing_keys(
+    agent_id,
+    key_id,
+    key_version,
+    public_key,
+    public_key_format,
+    fingerprint
+  )
+  values (
+    v_agent,
+    'primary',
+    1,
+    repeat('B', 43),
+    'raw_ed25519_base64url',
+    'sha256:' || repeat('Y', 43)
+  );
+
+  set local role service_role;
+  select * into v_challenge
+    from agent_board.issue_signing_key_challenge(v_agent, 'primary', interval '5 minutes');
+
+  select * into v_result
+    from agent_board.record_signing_key_proof_result(
+      v_challenge.challenge_id,
+      v_agent,
+      'primary',
+      false,
+      'signature_invalid',
+      '{}'::jsonb
+    );
+
+  if v_result.proof_state <> 'failed' or v_result.failure_class <> 'signature_invalid' then
+    raise exception 'failed proof did not preserve signature_invalid failure class';
+  end if;
+end
+$$;
+
+select pass('failed proof preserves metadata-safe failure class');
+
+select ok(
+  not exists (
+    select 1
+      from information_schema.routine_privileges
+     where specific_schema = 'agent_board'
+       and routine_name in ('issue_signing_key_challenge', 'record_signing_key_proof_result')
+       and grantee = 'anon'
+  ),
+  'proof RPCs are not executable by anon'
+);
+
+select finish();
+
+rollback;

package/tests/agent_board_signing_store.test.sql

@@ -0,0 +1,183 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(16);
+
+select has_table('agent_board', 'agent_signing_keys', 'agent_signing_keys exists');
+select has_table('agent_board', 'agent_signing_key_challenges', 'agent_signing_key_challenges exists');
+select has_table('agent_board', 'signature_evidence', 'signature_evidence exists');
+select has_table('agent_board', 'signature_replay_state', 'signature_replay_state exists');
+
+select has_column('agent_board', 'agent_signing_keys', 'key_id', 'key_id is stored');
+select has_column('agent_board', 'agent_signing_keys', 'key_version', 'key_version is stored');
+select has_column('agent_board', 'agent_signing_keys', 'fingerprint', 'fingerprint is stored');
+select col_has_check('agent_board', 'agent_signing_keys', 'algorithm', 'algorithm is constrained');
+select col_has_check('agent_board', 'agent_signing_keys', 'public_key_format', 'public key format is constrained');
+select col_has_check('agent_board', 'agent_signing_keys', 'status', 'status is constrained');
+select col_has_check('agent_board', 'agent_signing_keys', 'proof_state', 'proof state is constrained');
+select has_index('agent_board', 'agent_signing_keys', 'agent_signing_keys_key_id_unique', 'key_id is unique per agent');
+select has_index('agent_board', 'agent_signing_keys', 'agent_signing_keys_key_version_unique', 'key_version is unique per agent');
+
+do $$
+declare
+  v_agent uuid := gen_random_uuid();
+  v_message uuid := gen_random_uuid();
+  v_thread uuid := gen_random_uuid();
+  v_key uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values (v_agent, 'agent', 'signstore-agent', 'SIGNSTORE Agent');
+
+  insert into agent_board.threads(id, created_by_agent_id, subject)
+  values (v_thread, v_agent, 'SIGNSTORE thread');
+
+  insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, body)
+  values (v_message, v_thread, v_agent, 1, 'signed message');
+
+  insert into agent_board.agent_signing_keys(
+    agent_id,
+    key_id,
+    key_version,
+    public_key,
+    public_key_format,
+    fingerprint,
+    status,
+    proof_state
+  )
+  values (
+    v_agent,
+    'primary',
+    1,
+    repeat('A', 43),
+    'raw_ed25519_base64url',
+    'sha256:' || repeat('A', 43),
+    'active',
+    'proven'
+  )
+  returning id into v_key;
+
+  begin
+    insert into agent_board.agent_signing_keys(
+      agent_id,
+      key_id,
+      key_version,
+      public_key,
+      public_key_format,
+      fingerprint
+    )
+    values (
+      v_agent,
+      'secondary',
+      1,
+      repeat('B', 43),
+      'raw_ed25519_base64url',
+      'sha256:' || repeat('B', 43)
+    );
+    raise exception 'duplicate key_version unexpectedly succeeded';
+  exception
+    when unique_violation then null;
+  end;
+
+  begin
+    insert into agent_board.agent_signing_keys(
+      agent_id,
+      key_id,
+      key_version,
+      public_key,
+      public_key_format,
+      fingerprint,
+      status,
+      proof_state
+    )
+    values (
+      v_agent,
+      'unproven-active',
+      2,
+      repeat('C', 43),
+      'raw_ed25519_base64url',
+      'sha256:' || repeat('C', 43),
+      'active',
+      'unproven'
+    );
+    raise exception 'active key without proof unexpectedly succeeded';
+  exception
+    when check_violation then null;
+  end;
+
+  insert into agent_board.signature_evidence(
+    agent_id,
+    signing_key_id,
+    key_id,
+    key_version,
+    source_kind,
+    source_message_id,
+    operation,
+    payload_digest,
+    signature_digest,
+    verification_status,
+    verified_at,
+    nonce
+  )
+  values (
+    v_agent,
+    v_key,
+    'primary',
+    1,
+    'message',
+    v_message,
+    'agent_board.post_message',
+    'sha256:' || repeat('d', 64),
+    'sha256:' || repeat('e', 64),
+    'verified',
+    now(),
+    'nonce-1'
+  );
+
+  insert into agent_board.signature_replay_state(
+    agent_id,
+    signing_key_id,
+    operation,
+    payload_digest,
+    nonce,
+    envelope_timestamp,
+    expires_at
+  )
+  values (
+    v_agent,
+    v_key,
+    'agent_board.post_message',
+    'sha256:' || repeat('d', 64),
+    'nonce-1',
+    now(),
+    now() + interval '10 minutes'
+  );
+end
+$$;
+
+select pass('signing key uniqueness, proof-state, signature evidence, and replay metadata checks passed');
+
+select ok(
+  exists (
+    select 1
+      from agent_board.schema_version
+     where version >= 5
+  ),
+  'schema_version advanced to SQL-ahead SIGNSTORE version'
+);
+
+select ok(
+  not exists (
+    select 1
+      from information_schema.columns
+     where table_schema = 'agent_board'
+       and table_name in ('agent_signing_keys', 'signature_evidence')
+       and column_name ~* 'private|secret|token'
+  ),
+  'SIGNSTORE tables do not expose private key, secret, or token columns'
+);
+
+select finish();
+
+rollback;

package/tests/agent_board_smoke.test.sql

@@ -0,0 +1,12 @@
+SELECT plan(8);
+
+SELECT has_schema('agent_board', 'agent_board schema exists');
+SELECT has_table('agent_board', 'agents', 'agents table exists');
+SELECT has_table('agent_board', 'tasks', 'tasks table exists');
+SELECT has_table('agent_board', 'claims', 'claims table exists');
+SELECT has_view('agent_board', 'v_thread_feed', 'thread feed view exists');
+SELECT has_view('agent_board', 'v_task_tree', 'task tree view exists');
+SELECT has_view('agent_board', 'v_active_claims', 'active claims view exists');
+SELECT has_function('agent_board', 'acquire_claim', ARRAY['uuid', 'text', 'text', 'timestamp with time zone', 'uuid', 'uuid', 'jsonb'], 'acquire_claim rpc exists');
+
+SELECT finish();