@consiliency/agent-board-schema 1.22.0 → 1.23.0

package/tests/agent_board_enroll_federated_identity.test.sql

@@ -47,7 +47,7 @@ begin
 
   insert into _p values (
     'https://fed-ok-'||s||'.test', 'message-board', 'portal|'||s, 'fed-agent-'||s,
-    jsonb_build_object('sub', 'portal|'||s, 'act', jsonb_build_object('sub', 'act|'||s), 'name', 'Fed '||s),
+    jsonb_build_object('iss','https://fed-ok-'||s||'.test','aud','message-board','sub', 'portal|'||s, 'act', jsonb_build_object('sub', 'act|'||s), 'name', 'Fed '||s),
     'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
     'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
@@ -162,7 +162,7 @@ select is(
 -- Provider / scope / kind rejection matrix still raises ------------------------------
 select throws_ok(
   (select format($q$select agent_board.enroll_federated_identity('https://nope.test',%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
-     aud, sub, claim::text, 'x-'||slug, pub1, fp1) from _p),
+     aud, sub, (claim || jsonb_build_object('iss','https://nope.test'))::text, 'x-'||slug, pub1, fp1) from _p),
   '42501', null, 'unknown (issuer,audience) is rejected');
 select throws_ok(
   (select format($q$select agent_board.enroll_federated_identity(%L,%L,NULL,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
@@ -198,7 +198,7 @@ begin
     into v_agent, v_kid, v_kver, v_handle
     from agent_board.enroll_federated_identity(
       'https://fed-b1-'||s||'.test','message-board','portal|'||s,
-      jsonb_build_object('sub','portal|'||s), 'b1-'||s, v_pub,'raw_ed25519_base64url', v_fp,
+      jsonb_build_object('iss','https://fed-b1-'||s||'.test','aud','message-board','sub','portal|'||s), 'b1-'||s, v_pub,'raw_ed25519_base64url', v_fp,
       true, null, 'agent', '{board:send}', '{}') e;
   insert into _b1 values (v_agent, v_kid, v_kver, v_handle);
 end $$;

package/tests/agent_board_enroll_pop_binding.test.sql

@@ -15,7 +15,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(18);
+select plan(20);
 
 -- Client<->DB fingerprint round-trip (B2 raw-byte scheme): the DB derivation over the
 -- DECODED 32 key bytes must equal the constant an independent tool (Node crypto,
@@ -41,7 +41,7 @@ begin
   values ('https://fed-pop-'||s||'.test', 'message-board', true, true, '{board:send}', '{}', '{agent,human}');
   insert into _p values (
     'https://fed-pop-'||s||'.test', 'message-board', 'portal|'||s,
-    jsonb_build_object('sub','portal|'||s,'act',jsonb_build_object('sub','act|'||s)),
+    jsonb_build_object('iss','https://fed-pop-'||s||'.test','aud','message-board','sub','portal|'||s,'act',jsonb_build_object('sub','act|'||s)),
     'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk', 'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA');
 end
@@ -58,7 +58,17 @@ select is(
   (select claim->'act'->>'sub' from _p),
   'the act.sub is captured (audit-only) in the enrollment claim snapshot');
 
--- Duplicate fingerprint: re-enrolling key 1 raises (dedup on the UNIQUE index).
+-- Exact replay: rotating presentation claims do not create a second identity.
+select lives_ok(
+  (select format($q$create temp table _exact_replay as select * from agent_board.enroll_federated_identity(%L,%L,%L,(%L::jsonb || '{"iat":200,"exp":9999999999,"jti":"rotated"}'::jsonb),%L,%L,'raw_ed25519_base64url',%L,true,%L,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-ok', pub1, fp1, 'act|present') from _p),
+  'an exact stable-input replay with rotating JWT presentation claims succeeds');
+select is(
+  (select agent_id from _exact_replay),
+  (select a.id from agent_board.agents a where a.handle='pop-ok'),
+  'exact replay returns the original server-assigned identity');
+
+-- A replay mutation (slug and independent actor_sub) fails closed with 23505.
 select throws_ok(
   (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-dup', pub1, fp1) from _p),

package/tests/agent_board_enrollment_audit_content.test.sql

@@ -18,7 +18,7 @@ do $$
 declare
   s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
   v_agent uuid;
-  v_claim jsonb := jsonb_build_object('sub','portal|'||s,'name','Fed '||s,'groups',jsonb_build_array('eng','fed'));
+  v_claim jsonb := jsonb_build_object('iss','https://mock-portal-'||s||'.test','aud','message-board','sub','portal|'||s,'name','Fed '||s,'groups',jsonb_build_array('eng','fed'));
   -- A valid unique 43-char base64url key + its matching (RPC-recomputed) fingerprint.
   v_pub text := rtrim(translate(encode(extensions.digest(convert_to('k-acfx-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
   v_fp text;
@@ -65,8 +65,8 @@ select is(
 select has_column('agent_board', 'enrollment_federation_audit', 'human_identity_claim', 'audit stores human_identity_claim');
 select has_column('agent_board', 'enrollment_federation_audit', 'enrolled_at', 'audit stores enrolled_at (enrollment-time)');
 
--- No write-path RPC reads enrollment_federation_audit. Only the enroll RPC (which
--- WRITES it) may reference the table; nothing on the send/session path reads it. ----
+-- No send/session write-path RPC reads enrollment_federation_audit. Enrollment
+-- writes it and total human revocation reads stable principal evidence from it. ----
 select is(
   (select count(*)::int from (
      select pg_get_functiondef(p.oid) as def, p.proname
@@ -79,10 +79,14 @@ select is(
         -- The federation enroll RPCs WRITE the audit (enroll_federated_human added by
         -- FEDSESSION, F-6); the invariant is that nothing on the send/session read path
         -- touches it (asserted specifically in the next case).
-        and p.proname not in ('enroll_federated_identity', 'enroll_federated_human')
+        and p.proname not in (
+          'enroll_federated_identity', 'enroll_federated_human',
+          '_enroll_federated_identity_once', '_enroll_federated_human_after_revocation_gate',
+          'revoke_human_subtree'
+        )
    ) d
    where lower(d.def) like '%enrollment_federation_audit%'),
-  0, 'no agent_board RPC other than the federation enroll RPCs references enrollment_federation_audit');
+  0, 'no agent_board RPC other than federation enrollment and total human revocation references enrollment_federation_audit');
 select is(
   (select count(*)::int from (
      select pg_get_functiondef(p.oid) as def
@@ -115,10 +119,10 @@ begin
   values ('https://rls-portal-'||s||'.test','message-board',true,true,'{board:send}','{board:x}','{agent,human}');
   select e.agent_id, e.auth_user_id into v_a_agent, v_a_user
     from agent_board.enroll_federated_identity('https://rls-portal-'||s||'.test','message-board','portal|a-'||s,
-      jsonb_build_object('sub','portal|a-'||s,'name','A'), 'rls-a-'||s, v_pub_a,'raw_ed25519_base64url',v_fp_a,true,null,'human','{board:send}','{board:x}') e;
+      jsonb_build_object('iss','https://rls-portal-'||s||'.test','aud','message-board','sub','portal|a-'||s,'name','A'), 'rls-a-'||s, v_pub_a,'raw_ed25519_base64url',v_fp_a,true,null,'human','{board:send}','{board:x}') e;
   select e.agent_id into v_b_agent
     from agent_board.enroll_federated_identity('https://rls-portal-'||s||'.test','message-board','portal|b-'||s,
-      jsonb_build_object('sub','portal|b-'||s,'name','B'), 'rls-b-'||s, v_pub_b,'raw_ed25519_base64url',v_fp_b,true,null,'human','{board:send}','{board:x}') e;
+      jsonb_build_object('iss','https://rls-portal-'||s||'.test','aud','message-board','sub','portal|b-'||s,'name','B'), 'rls-b-'||s, v_pub_b,'raw_ed25519_base64url',v_fp_b,true,null,'human','{board:send}','{board:x}') e;
   insert into _rls values (v_a_agent, v_a_user, v_b_agent);
 end
 $$;

package/tests/agent_board_federated_lock_order_class.test.sql

@@ -0,0 +1,390 @@
+-- Consiliency/message-board#194 pgTAP: the board/owner lock-order CLASS, derived
+-- from pg_constraint FK edges + the pg_proc call graph, and the class-40
+-- propagation contract of the invite-redemption subtransaction.
+--
+-- WHAT IS CATALOG-DERIVED HERE, AND WHAT IS NOT. Being exact about this matters
+-- more than the green: an earlier header of this file claimed the assertion was
+-- "catalog-derived and not textual", and that was false. Only the TABLE SET is
+-- catalog-derived -- the direct FK children of agent_board.boards and auth.users,
+-- read from pg_constraint, which is the part #194 needed because
+-- enroll_federated_identity never NAMES boards (its lock arrives as FOR KEY SHARE
+-- through board_memberships_board_id_fkey, inside a callee). ACQUISITION DETECTION
+-- AND THE CALL GRAPH ARE REGEXES OVER prosrc. plpgsql bodies carry no
+-- catalog-level table dependencies, so nothing stronger is available without a
+-- parser, and the claim this file makes is scoped accordingly.
+--
+-- WHAT THE ANALYZER COVERS:
+--   * dollar-quoted blocks (tag-matched with a backreference), single-quoted
+--     literals with doubled quotes, line comments and block comments are all removed
+--     in ONE alternation pass, left to right, which is the correct tokenization --
+--     two passes are wrong in BOTH orders (comments-first eats a literal containing
+--     '--'; literals-first eats a comment containing an apostrophe). Getting this
+--     exactly right is load-bearing, not hygiene: an earlier version of this file
+--     could not match a block comment whose body ended in '*', and one
+--     `/* ... for update **/` line -- the kind of lock-order note every migration in
+--     this repo carries -- made an INVERTED enroll_federated_human pass EC-3 with
+--     15/15 green. Membership did not change, so EC-2's exact-set backstop could not
+--     fire either. The same version desynced on an apostrophe inside a dollar-quoted
+--     string (agent_board.mark_retention_metadata has a $retention$ block with 64 of
+--     them, and it re-synced only because that count is even -- working by luck).
+--     Both shapes are now mutation-pinned by name;
+--   * table and function names matched BOTH qualified and BARE, with each
+--     function's own search_path (pg_proc.proconfig) deciding whether bare names
+--     resolve into agent_board -- a route written `insert into board_memberships`
+--     is visible, and so is `perform _redeem_invite_for_agent(...)`;
+--   * three acquisition shapes: INSERT into a direct FK child, an UPDATE that
+--     re-points the FK column, and an explicit row lock in any statement shape
+--     (including `from boards b join ... for update of b`, which an earlier
+--     `where`-anchored pattern could not see);
+--   * a function pinning search_path WITHOUT agent_board (e.g.
+--     _ensure_agent_auth_user's search_path='') is not credited with bare matches;
+--     no proconfig at all is treated as bare-resolving, over-approximating
+--     membership rather than under-approximating it.
+--
+-- WHAT IT DOES NOT COVER, stated so a green run is read for what it is:
+--   * DYNAMIC SQL -- an EXECUTE of a computed string is unreadable here. EC-6 fails
+--     the suite for any route that acquires EITHER a board or an owner lock visibly
+--     and uses dynamic SQL, so the common shape (one side statically, the other
+--     hidden in an EXECUTE) is fail-closed. Gating EC-6 on BOTH sides, as an earlier
+--     version did, made it vacuous exactly where it was needed: a route whose board
+--     acquisition lived inside the EXECUTE never became a class member, so EC-6 never
+--     looked at it. A route that hides BOTH sides in dynamic SQL is still invisible;
+--     that is the residual, and it has no visible acquisition to enumerate from;
+--   * RUNTIME vs POSITIONAL order -- EC-3 is a first-acquisition claim over
+--     statements as written, not a per-branch path analysis;
+--   * locks taken by TRIGGERS on these tables, and overload resolution: call edges
+--     are name-resolved, so every overload sharing a proname is one callee. That
+--     over-approximates edges, which is safe for EC-2 (a real member cannot vanish)
+--     but fail-open for EC-3 (a spurious early edge could lower board_pos). The
+--     same direction applies to `for update of <other table>` in a statement that
+--     also names boards: counted as an acquisition when it is not one.
+--   * the ABSENCE class (#193 -- a route that skips its board lock because the row
+--     it would lock does not exist yet) is positionally invisible by construction
+--     and is pinned by tests/isolation/specs/fedsession_provider_absent_owner_lock.spec.
+--
+-- Every shape in the covered list has a mutant that makes a NAMED assertion fail;
+-- three of them (bare INSERT, join-form lock, FK re-point) were invisible to the
+-- first version of this file and are the reason it was rewritten.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(15);
+
+-- ---------------------------------------------------------------------------
+-- The catalog derivation, materialized once.
+-- ---------------------------------------------------------------------------
+create temp table _lockclass on commit drop as
+with recursive
+-- prosrc (the BODY), with string literals and both comment forms removed in ONE
+-- pass. Two passes are wrong in both orders: comments-first eats a literal
+-- containing '--', literals-first eats a comment containing an apostrophe. The
+-- alternation below consumes whichever token opens first, which is the correct
+-- tokenization.
+fns as (
+  select p.oid,
+         p.proname,
+         p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')' as sig,
+         regexp_replace(p.prosrc,
+           $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
+           ' ', 'g') as body,
+         p.proconfig
+    from pg_proc p
+    join pg_namespace n on n.oid = p.pronamespace
+   where n.nspname = 'agent_board'
+     and p.prokind = 'f'
+     and p.prolang <> (select oid from pg_language where lanname = 'internal')
+),
+-- Resolve BARE names the way Postgres would: a function that pins search_path
+-- WITHOUT agent_board (e.g. _ensure_agent_auth_user's search_path='') cannot reach
+-- these tables unqualified, so bare matches are not attributed to it. A function
+-- with no search_path setting at all is treated as if bare names DO resolve, which
+-- over-approximates membership rather than under-approximating it.
+sp as (
+  select f.oid,
+         case
+           when not exists (select 1 from unnest(coalesce(f.proconfig, '{}')) c
+                             where c like 'search\_path=%') then true
+           else exists (select 1 from unnest(f.proconfig) c
+                         where c like 'search\_path=%'
+                           and ',' || replace(replace(split_part(c, '=', 2), ' ', ''), '"', '') || ','
+                               like '%,agent\_board,%')
+         end as bare_ok
+    from fns f
+),
+-- DIRECT FK children only: inserting into a grandchild locks the child row, not
+-- the grandparent, so transitive FK depth would manufacture false positives.
+-- NOTE: regclass::text drops the schema for anything on search_path, and this file
+-- puts agent_board on it -- so the parent/child identity is resolved by OID and
+-- pg_namespace here, never by a rendered name.
+kids as (
+  select c.confrelid as parent_oid, cl.relname as tbl
+    from pg_constraint c
+    join pg_class cl on cl.oid = c.conrelid
+    join pg_namespace ns on ns.oid = cl.relnamespace
+   where c.contype = 'f'
+     and c.confrelid in ('agent_board.boards'::regclass, 'auth.users'::regclass)
+     and ns.nspname = 'agent_board'
+),
+alt as (
+  select (select string_agg(distinct tbl, '|') from kids
+           where parent_oid = 'agent_board.boards'::regclass) as board_kids,
+         (select string_agg(distinct tbl, '|') from kids
+           where parent_oid = 'auth.users'::regclass) as owner_kids
+),
+pat as (
+  select f.oid, s.bare_ok,
+         case when s.bare_ok then '(?:agent_board\.)?' else 'agent_board\.' end as q
+    from fns f join sp s on s.oid = f.oid
+),
+own as (
+  select f.oid, f.proname, f.sig, f.body, p.bare_ok, p.q,
+         substring(f.body from
+           -- (i) INSERT into a direct FK child takes FOR KEY SHARE on the parent row
+           '(?:insert\s+into\s+(?:only\s+)?' || p.q || '\m(?:' || a.board_kids || ')\M)'
+           -- (ii) UPDATE that re-points the FK column re-checks it and locks the new parent
+           || '|(?:update\s+(?:only\s+)?' || p.q || '\m(?:' || a.board_kids || ')\M[^;]{0,250}?\mset\M[^;]{0,250}?\mboard_id\M\s*=)'
+           -- (iii) an explicit row lock in ANY statement shape. Deliberately not
+           -- anchored on `where`: `from boards b join ... for update of b` is a real
+           -- acquisition and the anchored form could not see it.
+           || '|(?:' || p.q || '\mboards\M[^;]{0,250}?for\s+(?:update|no\s+key\s+update|share|key\s+share))'
+         ) as board_hit,
+         substring(f.body from
+           '(?:insert\s+into\s+(?:only\s+)?' || p.q || '\m(?:' || a.owner_kids || ')\M)'
+           || '|(?:update\s+(?:only\s+)?' || p.q || '\m(?:' || a.owner_kids || ')\M[^;]{0,250}?\mset\M[^;]{0,250}?\m(?:owner_user_id|auth_user_id)\M\s*=)'
+           || '|(?:auth\.users\M[^;]{0,250}?for\s+update)'
+         ) as owner_hit
+    from fns f join pat p on p.oid = f.oid cross join alt a
+),
+edges as (
+  select c.oid as caller, e.oid as callee
+    from own c
+    join fns e on e.oid <> c.oid
+   where c.body ~ (c.q || '\m' || e.proname || '\M\s*\(')
+),
+acq_board(oid) as (
+  select oid from own where board_hit is not null
+  union
+  select e.caller from edges e join acq_board a on a.oid = e.callee
+),
+acq_owner(oid) as (
+  select oid from own where owner_hit is not null
+  union
+  select e.caller from edges e join acq_owner a on a.oid = e.callee
+)
+select o.sig,
+       (o.oid in (select oid from acq_board)) as reaches_board,
+       (o.oid in (select oid from acq_owner)) as reaches_owner,
+       (o.board_hit is not null) as own_board_lock,
+       (o.owner_hit is not null) as own_owner_lock,
+       (o.body ~* '\mexecute\M') as uses_dynamic_sql,
+       least(
+         case when o.board_hit is null then 2147483647 else strpos(o.body, o.board_hit) end,
+         coalesce((select min(strpos(o.body, substring(o.body from o.q || '\m' || f2.proname || '\M\s*\(')))
+                     from fns f2
+                    where f2.oid <> o.oid
+                      and f2.oid in (select oid from acq_board)
+                      and o.body ~ (o.q || '\m' || f2.proname || '\M\s*\(')), 2147483647)
+       ) as board_pos,
+       least(
+         case when o.owner_hit is null then 2147483647 else strpos(o.body, o.owner_hit) end,
+         coalesce((select min(strpos(o.body, substring(o.body from o.q || '\m' || f2.proname || '\M\s*\(')))
+                     from fns f2
+                    where f2.oid <> o.oid
+                      and f2.oid in (select oid from acq_owner)
+                      and o.body ~ (o.q || '\m' || f2.proname || '\M\s*\(')), 2147483647)
+       ) as owner_pos
+  from own o;
+
+-- EC-1: the FK edges the derivation rests on. If either disappears (renamed table,
+-- dropped constraint) the class silently empties and every other assertion here
+-- passes vacuously, so assert the two load-bearing edges POSITIVELY.
+select is(
+  (select string_agg(c.conname, ', ' order by c.conname)
+     from pg_constraint c
+    where c.contype = 'f'
+      and ((c.confrelid = 'agent_board.boards'::regclass
+            and c.conrelid = 'agent_board.board_memberships'::regclass)
+        or (c.confrelid = 'auth.users'::regclass
+            and c.conrelid = 'agent_board.agents'::regclass))),
+  'agents_auth_user_id_fkey, agents_owner_user_id_fkey, board_memberships_board_id_fkey',
+  'EC-1: the invisible FK edges (memberships->boards, agents->auth.users) both exist');
+
+-- EC-2: the CLASS itself -- every agent_board function that acquires both a boards
+-- row lock and an auth.users row lock. Asserted as an exact set: a new member fails
+-- here and NAMES itself instead of joining an unexamined class.
+select is(
+  (select string_agg(split_part(sig, '(', 1), ', ' order by split_part(sig, '(', 1))
+     from _lockclass where reaches_board and reaches_owner),
+  '_enroll_federated_human_after_revocation_gate, _enroll_federated_identity_once, '
+  || 'enroll_federated_human, enroll_federated_identity, onboard_federated_fleet_agent',
+  'EC-2: the board+owner lock class is exactly the five federated write routes');
+
+-- EC-3: THE ORDERING INVARIANT. Never acquire auth.users before boards. The failure
+-- prints the offending signatures (pre-fix this named enroll_federated_identity and
+-- _enroll_federated_identity_once).
+select is(
+  (select coalesce(string_agg(split_part(sig, '(', 1), ', ' order by sig), '')
+     from _lockclass
+    where reaches_board and reaches_owner and board_pos >= owner_pos),
+  '',
+  'EC-3: every board+owner route acquires the board BEFORE the owner');
+
+-- EC-4: positive exemption. revoke_human_subtree DOES take the auth.users owner
+-- lock and is deliberately outside the class; assert its claim positively (it
+-- reaches no boards acquisition at all), never by absence from a match.
+select is(
+  (select own_owner_lock::text || '/' || reaches_board::text
+     from _lockclass where sig like 'revoke\_human\_subtree(%'),
+  'true/false',
+  'EC-4: revoke_human_subtree locks the owner and provably acquires no board');
+
+-- EC-5: the two routes this migration moved take their board lock in their own
+-- body (not merely through a callee), so a future refactor of the callee cannot
+-- silently drop the ordering.
+select is(
+  (select string_agg(split_part(sig, '(', 1), ', ' order by sig)
+     from _lockclass
+    where own_board_lock
+      and split_part(sig, '(', 1) in ('enroll_federated_identity', '_enroll_federated_identity_once')),
+  '_enroll_federated_identity_once, enroll_federated_identity',
+  'EC-5: both enroll routes name their own agent_board.boards row lock');
+
+-- EC-6: no class member uses dynamic SQL. EC-3's positional claim reads statements
+-- as written; an EXECUTE of a computed string is invisible to it. Rather than
+-- leave that as a caveat in prose, fail the suite the day a member acquires one.
+select is(
+  (select coalesce(string_agg(split_part(sig, '(', 1), ', ' order by sig), '')
+     from _lockclass
+    where (reaches_board or reaches_owner) and uses_dynamic_sql),
+  '',
+  'EC-6: no board+owner route uses dynamic SQL, which EC-3 could not read');
+
+-- ---------------------------------------------------------------------------
+-- Class-40 propagation. The redemption subtransaction must keep swallowing
+-- deterministic failures (soft-honor) and must STOP swallowing serialization
+-- failures, which reported enrollment SUCCESS with no membership (#194).
+-- ---------------------------------------------------------------------------
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+values ('194a0000-0000-0000-0000-000000000001', 'agent', 'agent',
+        'lo194-owner', 'LO194 Owner', 'active');
+
+select count(*) from agent_board.create_board(
+  '194a0000-0000-0000-0000-000000000001', 'lo194-board', 'LO194 Board',
+  'Consiliency/message-board#194 redemption-failure class', jsonb_build_object(), 'private');
+
+insert into agent_board.identity_providers(
+  issuer, audience, supported, policy_approved,
+  allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+values ('https://lockorder194.test', 'message-board', true, true,
+        ARRAY[]::text[], ARRAY[]::text[], ARRAY['agent','human']);
+
+insert into agent_board.board_invite_tokens(
+  code, board_id, preset_role, preset_membership_state, max_uses, expires_at, created_by_agent_id)
+select 'lo194-code-' || g, b.id, 'member', 'joined', 10,
+       now() + interval '1 hour', '194a0000-0000-0000-0000-000000000001'
+  from agent_board.boards b, generate_series(1, 3) g
+ where b.slug = 'lo194-board';
+
+-- Capture tables are created EMPTY and filled inside lives_ok: if the call raises,
+-- the assertion reports a named `not ok` and every later assertion still RUNS.
+-- (`create temp table _e as select * from <rpc>` inside lives_ok leaves the table
+-- missing on failure, which aborts the file with no further TAP output -- observed
+-- while mutation-testing this very file.)
+create temp table _e1 (agent_id uuid, auth_user_id uuid, provider_id text, signing_key_id uuid,
+  granted_scopes text[], key_id text, key_version int, agent_handle text, invite_redeemed boolean)
+  on commit drop;
+create temp table _e2 (like _e1) on commit drop;
+create temp table _e3 (like _e1) on commit drop;
+
+-- R-1/R-2/R-3: uncontended redemption still works -- the allow side, so a later
+-- "it raised" is not confused with "it never redeemed".
+select lives_ok(
+  $$ insert into _e1
+     select * from agent_board.enroll_federated_identity(
+       'https://lockorder194.test', 'message-board', 'sub-lo194',
+       jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
+       'lo194-a', public.test_pubkey('lo194-k1'), 'raw_ed25519_base64url',
+       public.test_key_fingerprint('lo194-k1'), true, null, 'agent',
+       ARRAY[]::text[], ARRAY[]::text[], 'lo194-code-1') $$,
+  'R-1: fresh federated enrollment with a usable invite succeeds');
+select is((select invite_redeemed from _e1), true,
+  'R-2: the fresh enrollment reports the invite redeemed');
+select is(
+  (select count(*)::int from agent_board.board_memberships m
+     join agent_board.boards b on b.id = m.board_id
+    where b.slug = 'lo194-board'
+      and m.agent_id = (select agent_id from _e1)
+      and m.membership_state = 'joined'),
+  1, 'R-3: the fresh enrollment landed a joined membership row on the board');
+
+-- R-4/R-5: a DETERMINISTIC redemption failure (unusable code) is still soft-honored
+-- -- the released contract, and the exemption the class-40 filter must not widen.
+select lives_ok(
+  $$ insert into _e2
+     select * from agent_board.enroll_federated_identity(
+       'https://lockorder194.test', 'message-board', 'sub-lo194',
+       jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
+       'lo194-b', public.test_pubkey('lo194-k2'), 'raw_ed25519_base64url',
+       public.test_key_fingerprint('lo194-k2'), true, null, 'agent',
+       ARRAY[]::text[], ARRAY[]::text[], 'lo194-no-such-code') $$,
+  'R-4: an unusable invite code still enrolls (soft-honor preserved)');
+select is((select invite_redeemed from _e2), false,
+  'R-5: the unusable code reports invite_redeemed=false rather than raising');
+
+-- Fault injection: make the redemption raise a serialization failure exactly where a
+-- deadlock victim would surface it (the ledger insert inside
+-- _redeem_unbounded_invite_for_agent), with no concurrency required.
+create function pg_temp._lo194_raise_40001() returns trigger
+language plpgsql as $$
+begin
+  raise exception 'simulated serialization failure during redemption' using errcode = '40001';
+end;
+$$;
+create trigger _lo194_serialization_failure
+  before insert on agent_board.board_invite_redemptions
+  for each row execute function pg_temp._lo194_raise_40001();
+
+-- R-6: the CREATE path (_enroll_federated_identity_once step 13). Pre-fix this
+-- returned a row with invite_redeemed=false and no error.
+select throws_ok(
+  $$ select * from agent_board.enroll_federated_identity(
+       'https://lockorder194.test', 'message-board', 'sub-lo194',
+       jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
+       'lo194-c', public.test_pubkey('lo194-k3'), 'raw_ed25519_base64url',
+       public.test_key_fingerprint('lo194-k3'), true, null, 'agent',
+       ARRAY[]::text[], ARRAY[]::text[], 'lo194-code-2') $$,
+  '40001', null,
+  'R-6: class 40 during the CREATE-path redemption propagates to the caller');
+
+-- R-7: the REPLAY path (enroll_federated_identity own catch). Same key as R-1, so the
+-- frozen replay contract matches and a second, unredeemed code is offered.
+select throws_ok(
+  $$ select * from agent_board.enroll_federated_identity(
+       'https://lockorder194.test', 'message-board', 'sub-lo194',
+       jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
+       'lo194-a', public.test_pubkey('lo194-k1'), 'raw_ed25519_base64url',
+       public.test_key_fingerprint('lo194-k1'), true, null, 'agent',
+       ARRAY[]::text[], ARRAY[]::text[], 'lo194-code-3') $$,
+  '40001', null,
+  'R-7: class 40 during the REPLAY-path redemption propagates to the caller');
+
+drop trigger _lo194_serialization_failure on agent_board.board_invite_redemptions;
+
+-- R-8/R-9: with the injection removed, the replay path still soft-honors a
+-- deterministic failure -- the filter narrowed the catch, it did not remove it.
+select lives_ok(
+  $$ insert into _e3
+     select * from agent_board.enroll_federated_identity(
+       'https://lockorder194.test', 'message-board', 'sub-lo194',
+       jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
+       'lo194-a', public.test_pubkey('lo194-k1'), 'raw_ed25519_base64url',
+       public.test_key_fingerprint('lo194-k1'), true, null, 'agent',
+       ARRAY[]::text[], ARRAY[]::text[], 'lo194-no-such-code') $$,
+  'R-8: replay with an unusable code still succeeds');
+select is((select invite_redeemed from _e3), false,
+  'R-9: replay with an unusable code reports invite_redeemed=false');
+
+select * from finish();
+rollback;

package/tests/agent_board_fedsession.test.sql

@@ -17,7 +17,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(37);
+select plan(41);
 
 -- ---------------------------------------------------------------------------
 -- Phase 0 (superuser): function metadata + privileges
@@ -216,7 +216,7 @@ begin
   v_fp := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
   select e.agent_id into v_agent
     from agent_board.enroll_federated_identity(
-      f.iss, 'message-board', f.sub_a, jsonb_build_object('sub', f.sub_a),
+      f.iss, 'message-board', f.sub_a, jsonb_build_object('iss',f.iss,'aud','message-board','sub', f.sub_a),
       'idlink-'||f.s, v_pub, 'raw_ed25519_base64url', v_fp,
       true, null, 'agent', '{board:send}', '{}') e;
   insert into _idlink select a.owner_user_id from agent_board.agents a where a.id = v_agent;
@@ -311,6 +311,50 @@ select throws_ok(
      iss, sub_a, jsonb_build_object('sub', sub_a)::text) from _f where sub_a like 'portal-user-%'),
   '42501', null, 'a suspended (non-active) fed-human cannot re-provision a session (42501)');
 
+-- Durable total-human revocation also closes the production /portal-session RPC seam,
+-- including after auth.users deletion would otherwise recreate the deterministic owner.
+create temp table _portal_revoked(
+  issuer text, subject text, agent_id uuid, auth_user_id uuid
+) on commit drop;
+do $$
+declare
+  s4 text := replace(substr(gen_random_uuid()::text,1,8),'-','');
+  v_issuer text := 'https://fed-revoked-' || s4 || '.test';
+  v_subject text := 'portal-revoked-' || s4;
+  v_agent uuid;
+  v_auth uuid;
+begin
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values (v_issuer, 'message-board', true, true, '{}', '{}', '{human}');
+  select agent_id, auth_user_id into v_agent, v_auth
+    from agent_board.enroll_federated_human(
+      v_issuer, 'message-board', v_subject, jsonb_build_object('sub', v_subject), null);
+  insert into _portal_revoked values (v_issuer, v_subject, v_agent, v_auth);
+  perform * from agent_board.revoke_human_subtree(
+    v_auth, (select agent_id from _r where label='B'), 'portal-session durable revoke');
+  delete from auth.users where id = v_auth;
+end $$;
+-- 36
+select ok(
+  pg_get_functiondef('agent_board.enroll_federated_human(text,text,text,jsonb,text)'::regprocedure)
+    like '%from agent_board.boards b%for update%from agent_board.identity_providers ip%for update%_ensure_agent_auth_user(v_handle)%from auth.users u where u.id = v_uid for update%fleet_human_revocations r%r.issuer = p_issuer%r.subject = p_subject%_enroll_federated_human_after_revocation_gate%',
+  '/portal-session locks default board then provider then owner and checks the durable marker before delegation');
+-- 37
+select throws_ok(
+  (select format($q$select * from agent_board.enroll_federated_human(%L,'message-board',%L,%L::jsonb,null)$q$,
+     issuer, subject, jsonb_build_object('sub', subject)::text) from _portal_revoked),
+  '42501', null, '/portal-session cannot recreate a durably revoked human after auth-user deletion');
+-- 38
+select is(
+  (select count(*)::int from agent_board.agents
+    where id=(select agent_id from _portal_revoked) and status='active'),
+  0, 'blocked /portal-session leaves the original principal revoked');
+-- 39
+select is(
+  (select count(*)::int from auth.users where id=(select auth_user_id from _portal_revoked)),
+  0, 'blocked /portal-session rolls back deterministic auth-user recreation');
+
 select finish();
 
 rollback;