@consiliency/agent-board-schema 1.22.0 → 1.24.0

package/tests/agent_board_fedsession_provider_absence_gate.test.sql

@@ -0,0 +1,170 @@
+-- Consiliency/message-board#193 pgTAP: enroll_federated_human must reject an
+-- ABSENT (issuer, audience) BEFORE it provisions or locks the human owner.
+--
+-- WHY THE GATE IS WHERE IT IS. PostgreSQL cannot row-lock a row that does not
+-- exist, so with the provider absent there was nothing for the board/provider
+-- ordering to attach to: the function skipped it, locked auth.users, and delegated
+-- -- and the delegate's fresh READ COMMITTED snapshot could then see a provider
+-- committed in the gap and auto-join its default board while this transaction held
+-- the owner. Owner -> board, inverted against fleet onboarding.
+--
+-- WHAT THIS FILE CAN AND CANNOT PROVE. A single pgTAP transaction cannot exhibit
+-- the interleaving; the load-bearing proof is
+-- tests/isolation/specs/fedsession_provider_absent_owner_lock.spec, where a guard
+-- session holds the owner row and the pre-fix function BLOCKS while the fixed one
+-- raises without waiting. What is pinned HERE is (a) that the rejection comes from
+-- the pre-lock gate and not from the delegate's identical-verdict step (4) -- which
+-- is why the two messages differ -- (b) that it is positionally ahead of the owner
+-- provisioning in the shipped definition, and (c) that the deeper provider gates and
+-- the auto-join allow path are unchanged.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(8);
+
+-- G-1: the ABSENT-provider rejection, identified by the pre-lock gate's own message.
+-- The delegate raises the same 42501 with a DIFFERENT message, so an errcode-only
+-- assertion here would pass with the gate removed.
+select throws_ok(
+  $$ select agent_board.enroll_federated_human(
+       'https://lo193-absent.test', 'message-board', 'lo193-orphan',
+       jsonb_build_object('sub','lo193-orphan'), null) $$,
+  '42501',
+  'issuer/audience not in the identity-provider allowlist (rejected before any owner or board lock)',
+  'G-1: an absent (issuer,audience) is rejected by the PRE-LOCK gate');
+
+-- G-2: and it is positionally ahead of owner provisioning in the shipped body.
+--
+-- WHAT THIS ASSERTION HAD TO SURVIVE, because each version read as evidence while
+-- being defeatable. The marker is located on a body with comments and dollar-quoted
+-- blocks stripped and single-quoted literals KEPT (the raise message is a literal,
+-- so stripping literals would remove the very thing being located), and it is
+-- anchored to the RAISE SHAPE rather than to the bare message:
+--   * bare message on raw text  -> a one-line comment quoting the message passes it
+--     with the gate moved below _ensure_agent_auth_user;
+--   * bare message on the stripped body -> `raise debug 'ordering note: %', '<msg>'`
+--     or `declare v_note text := '<msg>'` passes it the same way. Both verified.
+--   * raise-exception-shaped on the stripped body -> all four masks fail, including
+--     a composite that also makes the provider freeze null-tolerant and goes 8/8
+--     GREEN against every other assertion here with the owner provisioned before the
+--     verdict.
+-- RESIDUAL, stated rather than implied: this narrows the vector, it does not close
+-- the shape. A dead-code `raise exception '<msg>'` earlier in the body still passes.
+-- What that residual cannot reach is the LOCK order: a gate moved below the
+-- auth.users FOR UPDATE is caught by
+-- tests/isolation/specs/fedsession_provider_absent_owner_lock.spec (the call goes
+-- `<waiting ...>` instead of raising), verified by mutation. A gate moved below
+-- _ensure_agent_auth_user but ABOVE that lock is caught by NEITHER the spec nor the
+-- pre-remedy G-2 -- which is precisely the hole this anchoring closes.
+select is(
+  (select case
+            when p_gate = 0 then 'gate-missing'
+            when p_ensure = 0 or p_lock is null then 'owner-provisioning-not-found'
+            when p_gate < p_ensure and p_gate < p_lock then 'gate-before-owner'
+            else 'gate-after-owner'
+          end
+     from (
+       select coalesce(strpos(d, substring(d from
+                $g$raise\s+exception\s+'issuer/audience not in the identity-provider allowlist \(rejected before any owner or board lock\)'$g$)), 0) as p_gate,
+              strpos(d, '_ensure_agent_auth_user') as p_ensure,
+              strpos(d, substring(d from 'from\s+auth\.users[^;]{0,250}?for\s+update')) as p_lock
+         from (select regexp_replace(p.prosrc,
+                       $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
+                       '\2', 'g') as d
+                 from pg_proc p
+                 join pg_namespace n on n.oid = p.pronamespace
+                where n.nspname = 'agent_board'
+                  and p.proname = 'enroll_federated_human') s
+     ) t),
+  'gate-before-owner',
+  'G-2: the absence gate precedes both _ensure_agent_auth_user and the auth.users lock');
+
+-- Fixtures for the allow side and for the deeper gates the new one must not shadow.
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+values ('193a0000-0000-0000-0000-000000000001', 'agent', 'agent',
+        'lo193-owner', 'LO193 Owner', 'active');
+
+select count(*) from agent_board.create_board(
+  '193a0000-0000-0000-0000-000000000001', 'lo193-board', 'LO193 Board',
+  'Consiliency/message-board#193 provider-absence gate', jsonb_build_object(), 'private');
+
+insert into agent_board.identity_providers(
+  issuer, audience, supported, policy_approved,
+  allowed_scopes, allowed_board_scopes, allowed_agent_kinds, default_board_id)
+values
+  ('https://lo193-autojoin.test', 'message-board', true, true,
+   ARRAY[]::text[], ARRAY[]::text[], ARRAY['agent','human'],
+   (select id from agent_board.boards where slug = 'lo193-board')),
+  ('https://lo193-noboard.test', 'message-board', true, true,
+   ARRAY[]::text[], ARRAY[]::text[], ARRAY['agent','human'], null),
+  ('https://lo193-unapproved.test', 'message-board', true, false,
+   ARRAY[]::text[], ARRAY[]::text[], ARRAY['agent','human'], null);
+
+-- G-3/G-4: provider PRESENT with a designated default board -- enrollment succeeds
+-- and the auto-join still lands. The gate narrowed the absent case only.
+select lives_ok(
+  $$ select agent_board.enroll_federated_human(
+       'https://lo193-autojoin.test', 'message-board', 'lo193-joiner',
+       jsonb_build_object('sub','lo193-joiner'), 'LO193 Joiner') $$,
+  'G-3: an allowlisted provider with a default board still enrolls');
+select is(
+  (select count(*)::int
+     from agent_board.board_memberships m
+     join agent_board.agents a on a.id = m.agent_id
+    where m.board_id = (select id from agent_board.boards where slug = 'lo193-board')
+      and a.metadata #>> ARRAY['federation','subject'] = 'lo193-joiner'
+      and m.membership_state = 'joined'),
+  1, 'G-4: the fedsession auto-join still lands a joined membership');
+
+-- G-5: provider PRESENT with a NULL default board -- enrolls, no auto-join. This is
+-- the neighbouring absence 20260901000140 already handled (NULL designation), kept
+-- distinct from the provider-absent case this migration closes.
+select lives_ok(
+  $$ select agent_board.enroll_federated_human(
+       'https://lo193-noboard.test', 'message-board', 'lo193-plain',
+       jsonb_build_object('sub','lo193-plain'), 'LO193 Plain') $$,
+  'G-5: an allowlisted provider with no default board still enrolls');
+
+-- G-6: the deeper provider gates are NOT shadowed -- an allowlisted but
+-- unapproved provider still fails inside the delegate, with the delegate's own
+-- message. Asserted positively so "42501 came from somewhere" is never enough.
+select throws_ok(
+  $$ select agent_board.enroll_federated_human(
+       'https://lo193-unapproved.test', 'message-board', 'lo193-unapproved',
+       jsonb_build_object('sub','lo193-unapproved'), null) $$,
+  '42501', 'identity provider is not policy-approved',
+  'G-6: a present-but-unapproved provider is still rejected by the delegate');
+
+-- G-7: the pre-lock gate is the ONLY new rejection -- a present provider never
+-- reaches it. (Mutating the gate to fire unconditionally fails G-3/G-5/G-7.)
+select is(
+  (select count(*)::int
+     from agent_board.agents a
+    where a.kind = 'human'
+      and a.metadata #>> ARRAY['federation','subject'] in ('lo193-joiner', 'lo193-plain')),
+  2, 'G-7: both allowlisted enrollments provisioned their human agents');
+
+
+-- G-8: the CLASS of routes that reject an absent provider, enumerated from the
+-- catalog rather than described in prose. All four reject with 42501; none
+-- serializes the absence, and that is the recorded decision (#195) -- the
+-- serialization alternative was built, measured and reverted because no shipped
+-- caller can distinguish 42501 from a retryable code. A new route joining this
+-- class fails here and names itself.
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prokind = 'f'
+      and regexp_replace(p.prosrc,
+            $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
+            '\2', 'g') ~ 'not in the identity-provider allowlist'),
+  '_enroll_federated_human_after_revocation_gate, _enroll_federated_identity_once, '
+  || 'enroll_federated_human, enroll_federated_identity',
+  'G-8: exactly four routes reject an absent identity provider');
+
+select * from finish();
+rollback;

package/tests/agent_board_inbox_reads.test.sql

@@ -20,25 +20,22 @@ select has_view('agent_board', 'v_callback_delivery_health', 'v_callback_deliver
 select has_column('agent_board', 'v_agent_dashboard', 'inbox_unread_count', 'v_agent_dashboard exposes inbox_unread_count');
 select has_column('agent_board', 'v_agent_dashboard', 'inbox_pending_action_count', 'v_agent_dashboard exposes inbox_pending_action_count');
 
-select ok(
-  (
-    select count(*) = 9
-      from pg_class c
-     where c.relnamespace = 'agent_board'::regnamespace
-       and c.relname in (
-         'v_agent_inbox',
-         'v_agent_inbox_counts',
-         'v_board_directory',
-         'v_board_memberships',
-         'v_board_feed',
-         'v_callback_endpoint_status',
-         'v_callback_subscriptions',
-         'v_callback_delivery_health',
-         'v_agent_dashboard'
-       )
-       and c.reloptions @> array['security_invoker=true']
-  ),
-  'all inbox read views use security_invoker=true'
+-- Derived from the catalog, not from a list written here (message-board#191 board
+-- review). This is the flag that ACTUALLY carries cross-agent isolation for
+-- everything built on these views: an inner `security_invoker` view re-anchors
+-- base-table RLS to the real querying user through any outer definer view, so the
+-- outer view's own flag is inert while this one is load-bearing. A view added to
+-- the schema and omitted from the old nine-name list was an unpinned read surface.
+-- There are no exemptions -- all 26 agent_board views are invoker -- so a new one
+-- that is not fails here and NAMES ITSELF.
+select is(
+  (select coalesce(string_agg(c.relname, ', ' order by c.relname), '')
+     from pg_class c
+    where c.relnamespace = 'agent_board'::regnamespace
+      and c.relkind in ('v', 'm')
+      and not coalesce(c.reloptions, '{}'::text[]) @> array['security_invoker=true']),
+  '',
+  'every agent_board view is security_invoker -- catalog-derived, no exemption list; a definer read surface names itself here'
 );
 
 select ok(

package/tests/agent_board_outbox_wake_ordering.test.sql

@@ -0,0 +1,452 @@
+-- OUTBOXWAKE / #187 — monotonic wake ordering for the notification outbox.
+--
+-- WHAT THIS FILE PINS, and why each assertion is shaped the way it is:
+--
+--   * WO-1 SHAPE — `callback_outbox_events.seq` exists, is bigint, is NOT NULL, and is
+--     GENERATED **ALWAYS** (`pg_attribute.attidentity = 'a'`). `by default` would be
+--     'd' and would make the ordering evidence caller-suppliable; that is the whole
+--     property, so it is read from the catalog and not inferred from the DDL text.
+--   * WO-2 EVIDENCE — an INSERT that names `seq` is REJECTED by the server (428C9).
+--     A shape assertion alone would not prove the server enforces it.
+--   * WO-3 CLASS — catalog-derived, per repo rule #1. The writer set comes from
+--     `pg_get_functiondef`, not from a list written here, so a NEW writer fails and
+--     NAMES ITSELF. The companion assertion closes the only escape hatch that
+--     `generated always` leaves open: `overriding system value`. Neither has an
+--     exemption list; each named writer is ALSO positively checked (WO-6/WO-7) to
+--     actually produce monotonic seq, so this is not an argument from absence.
+--   * WO-4 ORDERING — the uuid tiebreak is GONE from claim_callback_outbox_events and
+--     `seq` replaced it, checked against the catalog body.
+--   * WO-5 RESTATEMENT — the claim function was DROPPED and recreated (its return type
+--     changed), which discards the ACL and the COMMENT and re-grants EXECUTE to PUBLIC
+--     by default. These assertions fail if the migration forgot to restate them.
+--   * WO-6/WO-7 BEHAVIOUR — the acceptance criteria: a real fan-out through the real
+--     writer, in ONE transaction, yields N distinct ordered seq while `created_at` is
+--     byte-identical across all N; a bounded claim takes the LOWEST seq; and the queue is
+--     partitioned by STATUS so nothing is handed out twice or dropped.
+--
+-- WHAT THIS FILE DELIBERATELY DOES NOT ASSERT: that `seq > my cursor` recovers everything
+-- unhandled. `seq` is monotonic in ASSIGNMENT order, not COMMIT order, so a late-committing
+-- transaction lands below an already-persisted cursor. See the WO-7 block for the two
+-- assertions that were removed for encoding that false property.
+--
+-- Allow-side calls are wrapped in lives_ok(...) with a SEPARATE state check
+-- (message-board#113): a bare `is((select ... from rpc(...)), ...)` aborts the
+-- transaction on a raise, pgTAP emits NO `not ok`, and every later assertion in the
+-- file silently does not run.
+
+begin;
+
+select plan(37);
+
+-- ---------------------------------------------------------------------------
+-- WO-1 SHAPE
+-- ---------------------------------------------------------------------------
+select has_column('agent_board', 'callback_outbox_events', 'seq',
+  'WO-1 callback_outbox_events has a seq column');
+select col_type_is('agent_board', 'callback_outbox_events', 'seq', 'bigint',
+  'WO-1 seq is bigint');
+select col_not_null('agent_board', 'callback_outbox_events', 'seq',
+  'WO-1 seq is not null');
+
+select is(
+  (select a.attidentity
+     from pg_attribute a
+    where a.attrelid = 'agent_board.callback_outbox_events'::regclass
+      and a.attname = 'seq'),
+  'a',
+  'WO-1 seq is GENERATED ALWAYS as identity (attidentity=a), not BY DEFAULT (d) -- the value is evidence of write order and must not be caller-suppliable');
+
+select ok(
+  (select bool_or(i.indisunique)
+     from pg_index i
+     join pg_class c on c.oid = i.indexrelid
+    where i.indrelid = 'agent_board.callback_outbox_events'::regclass
+      and pg_get_indexdef(i.indexrelid) ~ '\(seq\)$'),
+  'WO-1 a UNIQUE index enforces seq uniqueness');
+
+select ok(
+  (select count(*) = 1
+     from pg_index i
+    where i.indrelid = 'agent_board.callback_outbox_events'::regclass
+      and pg_get_indexdef(i.indexrelid) ~ '\(recipient_agent_id, seq\)$'),
+  'WO-1 (recipient_agent_id, seq) index exists -- the consumer access path is "rows for me newer than my cursor"');
+
+select isnt(
+  (select col_description('agent_board.callback_outbox_events'::regclass, a.attnum)
+     from pg_attribute a
+    where a.attrelid = 'agent_board.callback_outbox_events'::regclass
+      and a.attname = 'seq'),
+  null,
+  'WO-1 seq carries a COMMENT stating what it is evidence of');
+
+-- ---------------------------------------------------------------------------
+-- WO-3 CLASS (catalog-derived; stated before the fixture so it cannot depend on it)
+-- ---------------------------------------------------------------------------
+-- The writer set is READ FROM THE CATALOG. A new function that inserts into the
+-- outbox changes this string, fails the assertion, and prints its own name in the
+-- diff -- which is the only way a completeness claim survives contact with a future
+-- change (repo rule #1).
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prokind = 'f'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~ 'insert into agent_board\.callback_outbox_events'),
+  '_queue_board_post_callbacks, _queue_inbox_callbacks',
+  'WO-3 CLASS: the catalog names exactly the two known outbox writers -- a new writer fails here and NAMES ITSELF');
+
+-- `generated always` is enforced by the server, and OVERRIDING SYSTEM VALUE is its
+-- ONLY bypass. Asserting the empty set over the whole schema (not over a hand list of
+-- writers) means a future writer cannot quietly assert an ordering it did not earn.
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prokind = 'f'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~* 'insert into agent_board\.callback_outbox_events'
+      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~* 'overriding\s+(system|user)\s+value'),
+  '',
+  'WO-3 CLASS: no outbox writer uses OVERRIDING SYSTEM VALUE -- the identity bypass stays closed');
+
+-- ---------------------------------------------------------------------------
+-- WO-4 ORDERING
+-- ---------------------------------------------------------------------------
+select ok(
+  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~ 'order by coe\.available_at asc, coe\.seq asc'
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  'WO-4 claim_callback_outbox_events orders candidates by (available_at, seq)');
+
+select ok(
+  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            !~ 'coe\.id asc'
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  'WO-4 the random-uuid tiebreak (coe.id asc) is GONE from the claim ordering');
+
+-- This is the PIN for "the batch is returned in seq order", and it is a source check
+-- on purpose. The behavioural assertion below (WO-7, "RETURNED in seq order") does NOT
+-- pin it: deleting `order by u.seq asc` from the function leaves the plan feeding the
+-- ordered candidate CTE straight through, so the observed order stays ascending and the
+-- mutation produces NO failure. A property no mutation can break is not covered, so the
+-- pin has to be stated where the mutation actually lands.
+select ok(
+  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+            ~ 'order by u\.seq asc'
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  'WO-4 the claimed batch is RETURNED ordered by seq, not merely selected in seq order');
+
+select ok(
+  (select 'outbox_seq' = any(p.proargnames)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  'WO-4 the claim RPC returns outbox_seq, so a worker can persist a cursor');
+
+-- ---------------------------------------------------------------------------
+-- WO-5 ACL + COMMENT restated after DROP FUNCTION
+-- ---------------------------------------------------------------------------
+select ok(
+  has_function_privilege('service_role', 'agent_board.claim_callback_outbox_events(integer)', 'EXECUTE'),
+  'WO-5 service_role EXECUTE was re-granted after the drop/recreate');
+
+select ok(
+  not has_function_privilege('authenticated', 'agent_board.claim_callback_outbox_events(integer)', 'EXECUTE'),
+  'WO-5 authenticated has NO EXECUTE -- recreating a definer function re-grants PUBLIC by default');
+
+select ok(
+  not has_function_privilege('anon', 'agent_board.claim_callback_outbox_events(integer)', 'EXECUTE'),
+  'WO-5 anon has NO EXECUTE on the claim RPC');
+
+select is(
+  (select count(*)::integer
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname = 'claim_callback_outbox_events'
+      and array_to_string(coalesce(p.proacl, '{}'::aclitem[]), ',') ~ '(^|,)=X/'),
+  0,
+  'WO-5 PUBLIC holds no EXECUTE entry in the claim RPC ACL');
+
+select isnt(
+  (select obj_description(p.oid, 'pg_proc')
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
+  null,
+  'WO-5 the COMMENT discarded by DROP FUNCTION was restated');
+
+-- The five assertions above name ONE function, which is exactly the shape that has failed
+-- here before: they verify the function this migration happens to touch, and say nothing
+-- about the next one. These two are the class, derived from pg_catalog with NO exemption
+-- list: every SECURITY DEFINER function whose body reaches callback_outbox_events must be
+-- closed to PUBLIC/anon/authenticated and open to service_role. A function added to this
+-- migration (or any later one) that forgets its revoke or its grant fails here and PRINTS
+-- ITS OWN NAME. Verified exemption-free at the time of writing: all eight members of the
+-- class satisfy both directions, so neither assertion passes by finding nothing.
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and p.prosecdef
+      and pg_get_functiondef(p.oid) ~ 'callback_outbox_events'
+      and (has_function_privilege('public', p.oid, 'EXECUTE')
+        or has_function_privilege('anon', p.oid, 'EXECUTE')
+        or has_function_privilege('authenticated', p.oid, 'EXECUTE'))),
+  '',
+  'WO-5 CLASS: no SECURITY DEFINER function reaching callback_outbox_events is executable by PUBLIC, anon, or authenticated -- DROP FUNCTION discards the ACL and CREATE re-grants PUBLIC');
+
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and p.prosecdef
+      and pg_get_functiondef(p.oid) ~ 'callback_outbox_events'
+      and not has_function_privilege('service_role', p.oid, 'EXECUTE')),
+  '',
+  'WO-5 CLASS: every SECURITY DEFINER function reaching callback_outbox_events is executable by service_role -- a dropped-and-recreated function that lost its grant names itself here');
+
+-- ---------------------------------------------------------------------------
+-- Fixture: a real board fan-out. Five subscribers, one verified endpoint each.
+-- ---------------------------------------------------------------------------
+-- claim_callback_outbox_events polls the GLOBAL ready queue. Neutralize any rows a
+-- previous fixture left ready so this file controls the claim; the surrounding
+-- transaction rolls it back.
+update agent_board.callback_outbox_events
+   set outbox_status = 'delivered',
+       delivered_at = coalesce(delivered_at, now()),
+       updated_at = now()
+ where outbox_status in ('pending', 'retryable')
+   and available_at <= now();
+
+insert into agent_board.agents(id, agent_type, handle, display_name, status)
+values ('18700000-0000-4000-8000-000000000000', 'agent', 'wake187-sender', 'Wake187 Sender', 'active');
+insert into agent_board.agents(id, agent_type, handle, display_name, status)
+select ('18700000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'agent', 'wake187-sub-' || n, 'Wake187 Subscriber ' || n, 'active'
+  from generate_series(1, 5) n;
+
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+values ('18701000-0000-4000-8000-000000000001', 'wake187-board', 'Wake187 Board',
+        '18700000-0000-4000-8000-000000000000', 'open', 'active');
+
+insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+values ('18702000-0000-4000-8000-000000000001', 'coordination',
+        '18700000-0000-4000-8000-000000000000', 'Wake187 thread',
+        '18701000-0000-4000-8000-000000000001');
+
+insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, message_type, body)
+values ('18703000-0000-4000-8000-000000000001', '18702000-0000-4000-8000-000000000001',
+        '18700000-0000-4000-8000-000000000000', 1, 'comment', 'wake187 board post');
+
+insert into agent_board.board_memberships(id, board_id, agent_id, role, membership_state, created_by_agent_id)
+select ('18704000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       '18701000-0000-4000-8000-000000000001',
+       ('18700000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'member', 'joined', '18700000-0000-4000-8000-000000000000'
+  from generate_series(1, 5) n;
+
+insert into agent_board.callback_endpoints(id, owner_agent_id, endpoint_url, endpoint_status, verification_requested_at, verified_at)
+select ('18705000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       ('18700000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'https://example.test/wake187/' || n,
+       'verified', now(), now()
+  from generate_series(1, 5) n;
+
+insert into agent_board.callback_subscriptions(
+  id, endpoint_id, agent_id, subscription_scope, event_category,
+  board_id, board_membership_id, subscription_status)
+select ('18706000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       ('18705000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       ('18700000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'board', 'board.post.delivered',
+       '18701000-0000-4000-8000-000000000001',
+       ('18704000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       'active'
+  from generate_series(1, 5) n;
+
+-- ---------------------------------------------------------------------------
+-- WO-6 FAN-OUT: one transaction, one statement, five rows.
+-- ---------------------------------------------------------------------------
+-- The capture tables are created EMPTY first and the call INSERTs into them. If a
+-- call raises, lives_ok reports a named `not ok` AND every later assertion still runs
+-- against an empty table -- whereas `create temp table ... as select` would leave the
+-- table missing, abort the transaction, and silently truncate the plan (#113).
+create temp table wake187_fanout(inserted_count integer);
+select lives_ok($$
+  insert into wake187_fanout
+  select agent_board._queue_board_post_callbacks(
+    '18701000-0000-4000-8000-000000000001'::uuid,
+    '18703000-0000-4000-8000-000000000001'::uuid,
+    'Wake187 subject', 'Wake187 preview', 'high', '{}'::jsonb) as inserted_count
+$$, 'WO-6 the board fan-out writer runs [call succeeds]');
+
+select is(
+  (select inserted_count from wake187_fanout),
+  5,
+  'WO-6 _queue_board_post_callbacks wrote one outbox row per subscriber');
+
+create temp table wake187_rows as
+select id, seq, created_at, recipient_agent_id
+  from agent_board.callback_outbox_events
+ where board_id = '18701000-0000-4000-8000-000000000001';
+
+select is(
+  (select count(distinct created_at)::integer from wake187_rows),
+  1,
+  'WO-6 all five rows share ONE created_at -- now() is transaction_timestamp(), so the fan-out CANNOT be ordered by time');
+
+select is(
+  (select count(distinct seq)::integer from wake187_rows),
+  5,
+  'WO-6 the same five rows have five DISTINCT seq values');
+
+select is(
+  (select (max(seq) - min(seq) + 1)::integer from wake187_rows),
+  5,
+  'WO-6 the five seq values are contiguous -- a total order with no gap or reuse');
+
+-- ---------------------------------------------------------------------------
+-- WO-7 CLAIM DETERMINISM + CURSOR RECOVERY (acceptance criteria 2 and 3)
+-- ---------------------------------------------------------------------------
+create temp table wake187_batch1(outbox_event_id uuid, outbox_seq bigint);
+select lives_ok($$
+  insert into wake187_batch1
+  select outbox_event_id, outbox_seq from agent_board.claim_callback_outbox_events(2)
+$$, 'WO-7 a bounded claim runs [call succeeds]');
+
+select is(
+  (select count(*)::integer from wake187_batch1),
+  2,
+  'WO-7 the bounded claim returned exactly the requested batch size');
+
+-- The defect: with a random-uuid tiebreak over identical timestamps, WHICH two rows a
+-- batch of two takes was arbitrary. It must now be the two lowest seq.
+select is(
+  (select array_agg(outbox_seq order by outbox_seq) from wake187_batch1),
+  (select array_agg(seq order by seq) from (select seq from wake187_rows order by seq limit 2) lo),
+  'WO-7 the claim took the two LOWEST seq rows -- deterministic across identical created_at');
+
+-- Corroboration only, NOT the pin: removing the ORDER BY from the returned batch does
+-- not make this fail (see the WO-4 source assertion above for why).
+select is(
+  (select array_agg(outbox_seq) from wake187_batch1),
+  (select array_agg(outbox_seq order by outbox_seq) from wake187_batch1),
+  'WO-7 the batch is observed in seq order [corroborates WO-4; the ORDER BY itself is pinned there]');
+
+-- WHAT WAS HERE BEFORE, AND WHY IT IS GONE. Two assertions used to partition this queue
+-- with `seq > cursor` / `seq <= cursor` and call the result lossless recovery. Inside one
+-- transaction that is true, and it generalises to a property that IS FALSE: `seq` is
+-- monotonic in ASSIGNMENT order, not in COMMIT order, so a transaction that inserts early
+-- and commits late lands BELOW a cursor a consumer has already persisted and is skipped.
+-- The isolation spec proves exactly that (`late_committer_holds_a_lower_seq_than_the_
+-- persisted_cursor`), and `agent-board-runtime/src/notifications.ts` really does gate on
+-- it: `shouldReplayMissedEvent` returns `Number(stored) < hint.sequence`. An assertion
+-- that encodes a false property is worse than no assertion, so both are replaced by the
+-- property that actually holds and that the claim path actually relies on: the queue is
+-- partitioned by STATUS, not by seq.
+select is(
+  (select array_agg(coe.seq order by coe.seq)
+     from agent_board.callback_outbox_events coe
+    where coe.board_id = '18701000-0000-4000-8000-000000000001'
+      and coe.outbox_status = 'pending'),
+  (select array_agg(r.seq order by r.seq)
+     from wake187_rows r
+    where r.seq not in (select outbox_seq from wake187_batch1)),
+  'WO-7 the rows still pending are EXACTLY the ones the claim did not take -- the claim path is lossless because it partitions on STATUS, never on seq');
+
+select is(
+  (select array_agg(coe.seq order by coe.seq)
+     from agent_board.callback_outbox_events coe
+    where coe.board_id = '18701000-0000-4000-8000-000000000001'
+      and coe.outbox_status = 'delivering'),
+  (select array_agg(outbox_seq order by outbox_seq) from wake187_batch1),
+  'WO-7 the rows now delivering are EXACTLY the claimed batch -- no row is handed out twice and none is silently dropped');
+
+create temp table wake187_batch2(outbox_event_id uuid, outbox_seq bigint);
+select lives_ok($$
+  insert into wake187_batch2
+  select outbox_event_id, outbox_seq from agent_board.claim_callback_outbox_events(10)
+$$, 'WO-7 the follow-up claim runs [call succeeds]');
+
+select is(
+  (select array_agg(outbox_seq order by outbox_seq) from wake187_batch2),
+  (select array_agg(seq order by seq) from (select seq from wake187_rows order by seq offset 2) hi),
+  'WO-7 the follow-up claim takes the remaining rows in seq order, resuming exactly where the cursor stopped');
+
+-- ---------------------------------------------------------------------------
+-- WO-2 EVIDENCE: the identity is not caller-suppliable (checked against the SERVER,
+-- not the DDL text). Stated last so its failed INSERT cannot disturb the fixture.
+-- ---------------------------------------------------------------------------
+select throws_ok($$
+  insert into agent_board.callback_outbox_events(
+    seq, endpoint_id, subscription_id, recipient_agent_id, board_id,
+    event_category, delivery_mode, source_kind, source_message_id,
+    idempotency_key, priority)
+  values (
+    999999, '18705000-0000-4000-8000-000000000001'::uuid,
+    '18706000-0000-4000-8000-000000000001'::uuid,
+    '18700000-0000-4000-8000-000000000001'::uuid,
+    '18701000-0000-4000-8000-000000000001'::uuid,
+    'board.post.delivered', 'board', 'message',
+    '18703000-0000-4000-8000-000000000001'::uuid,
+    'wake187:forged-seq', 'high')
+$$, '428C9',
+   null,
+   'WO-2 an INSERT that supplies seq is REJECTED by the server -- GENERATED ALWAYS, so write order cannot be forged');
+
+-- The second writer, positively: it is subject to the same identity and its row lands
+-- ABOVE the fan-out. An enumeration (WO-3) that named a writer doing neither would be
+-- an exemption asserted by absence, which is how a hole hid here before.
+insert into agent_board.delivery_recipients(id, delivery_mode, recipient_agent_id, source_kind, source_message_id)
+values ('18707000-0000-4000-8000-000000000001', 'direct',
+        '18700000-0000-4000-8000-000000000001', 'message',
+        '18703000-0000-4000-8000-000000000001');
+
+insert into agent_board.inbox_items(
+  id, delivery_recipient_id, recipient_agent_id, delivery_mode, source_kind,
+  source_message_id, subject, preview, priority, action_state,
+  visible_in_inbox, visible_in_board_feed, fetch_descriptor)
+values ('18708000-0000-4000-8000-000000000001', '18707000-0000-4000-8000-000000000001',
+        '18700000-0000-4000-8000-000000000001', 'direct', 'message',
+        '18703000-0000-4000-8000-000000000001', 'Wake187 inbox', 'Wake187 inbox preview',
+        'high', 'new', true, false, '{}'::jsonb);
+
+insert into agent_board.callback_subscriptions(
+  id, endpoint_id, agent_id, subscription_scope, event_category, subscription_status)
+values ('18709000-0000-4000-8000-000000000001', '18705000-0000-4000-8000-000000000001',
+        '18700000-0000-4000-8000-000000000001', 'own_inbox', 'inbox.item.delivered', 'active');
+
+create temp table wake187_inbox(inserted_count integer);
+select lives_ok($$
+  insert into wake187_inbox
+  select agent_board._queue_inbox_callbacks(
+    '18708000-0000-4000-8000-000000000001'::uuid, 'inbox.item.delivered') as inserted_count
+$$, 'WO-6 the inbox fan-out writer runs [call succeeds]');
+
+select is(
+  (select inserted_count from wake187_inbox),
+  1,
+  'WO-6 _queue_inbox_callbacks wrote its outbox row');
+
+select ok(
+  (select coe.seq > (select max(seq) from wake187_rows)
+     from agent_board.callback_outbox_events coe
+    where coe.idempotency_key = 'inbox.item.delivered:18708000-0000-4000-8000-000000000001:18709000-0000-4000-8000-000000000001'),
+  'WO-6 the second writer shares the SAME sequence -- its row sorts strictly after the earlier fan-out, so the order is schema-wide, not per-writer');
+
+select * from finish();
+
+rollback;