@consiliency/agent-board-schema 1.22.0 → 1.24.0

package/tests/agent_board_atomic_fleet_onboarding.test.sql

@@ -0,0 +1,623 @@
+-- Consiliency/message-board#196 -- the POSITIONAL lock-order assertions in this
+-- file read a STRIPPED function body, not raw text.
+--
+-- WHAT WENT WRONG. Every `strpos(...) < strpos(...)` claim below used to read
+-- `pg_get_functiondef()` RAW. Moving `perform
+-- agent_board._lock_board_authority_ceiling(p_board_id)` to the END of
+-- set_board_authority_ceiling, after its upsert, made assertion 50 fail --
+-- correctly. Adding ONE plain `--` comment naming the marker made the same
+-- mutant pass 52/52. No `**/` trick was needed; the file stripped nothing. The
+-- ordering that assertion guards is the #189 ceiling ABBA edge, and measured
+-- against all 20 committed isolation specs, NOTHING else moved: it had no
+-- runtime backstop at all.
+--
+-- WHAT THE FIX IS. Each positional assertion now locates its markers on
+-- `pg_temp._stripped_body(<fn>)` -- prosrc with dollar-quoted blocks, single-quoted
+-- literals, line comments and block comments removed in ONE alternation pass. The
+-- regex is copied BYTE-FOR-BYTE from agent_board_federated_lock_order_class.test.sql,
+-- where its three failure modes were found the hard way: a block comment whose body
+-- ends in `*`; a dollar-quote desync (agent_board.mark_retention_metadata survives a
+-- naive scanner only because its 64 apostrophes are an even count); and an and/or
+-- gate polarity error. Do NOT re-derive it, and do NOT split it into two passes --
+-- both orders are wrong (comments-first eats a literal containing `--`;
+-- literals-first eats a comment containing an apostrophe).
+--
+-- A FOURTH FAILURE MODE IS KNOWN, DEMONSTRATED, AND STILL OPEN -- TRACKED AS
+-- Consiliency/message-board#199. Postgres block comments NEST, and
+-- `(/\*([^*]|\*+[^*/])*\*+/)` stops at the FIRST `*/`, so everything after an inner
+-- terminator survives the strip. One line of the form
+--     /* lock-order note: /* see #189 */ <marker> */
+-- puts the marker back into the stripped body and masks it again. Two reviewers
+-- reproduced this independently; so did this file's own mutation run.
+--
+-- MEASURED BLAST RADIUS, so no reader has to guess which claims still hold. Against
+-- that mask, EIGHT of the NINE positional assertions below go GREEN with the
+-- ordering they name genuinely violated. (The revoke_fleet_subject claim is the
+-- exception, and only incidentally: it locates the lock RELATIVE to its loop header,
+-- so an injected header moves the search window rather than satisfying it. That is a
+-- property of that one assertion's shape, not a defence anything else has.)
+--
+-- WHERE THAT LEAVES A REAL GAP. What still catches the mutant is the RUNTIME
+-- counterparty, which no comment can reach -- and only some claims have one:
+--   * machine-before-enrolled-agent  -> atomic_fleet_binding_revoke.spec and
+--     atomic_fleet_lifecycle_races.spec still fail. Guarded.
+--   * advisory-before-boards, and the ceiling setter's lock-before-upsert ->
+--     onboarding_ceiling_lock_order.spec and ceiling_setter_lock_before_upsert.spec
+--     still fail. Guarded.
+--   * BOARDS-BEFORE-CEILING-READ -> **NOTHING FAILS**. Assertion 49 goes green, and
+--     so does agent_board_federated_lock_order_class.test.sql EC-3 (15/15) -- it
+--     carries the same regex, so the nested mask defeats it too. Both new specs
+--     scope this edge out and print `same`, and atomic_fleet_board_archive.spec
+--     BLOCKS rather than diagnosing, which under a runner with no timeout is a
+--     stuck job, not a failure. This edge currently has NO functioning guard
+--     against a nested block comment. Stated plainly because that is the whole
+--     point of this file: a guard that overclaims is worse than none.
+--   * the three claims already labelled SOLE PIN or HISTORICAL below have no
+--     runtime counterparty at all, so nesting leaves them unguarded as well.
+--
+-- IT IS DELIBERATELY NOT PATCHED HERE. The expression is inherited byte-for-byte
+-- from merged #195 and the two copies must stay identical -- fixing one forks them,
+-- which is exactly what the verbatim-reuse rule exists to prevent. #199 fixes it
+-- once, across both files. Until then: treat this strip as closing the flat
+-- comment and literal masks it is mutation-pinned against, NOT as closing the class.
+--
+-- WHY prosrc AND NOT pg_get_functiondef. functiondef wraps the whole body in
+-- `AS $function$ ... $function$`, which is exactly what the dollar-quote alternative
+-- matches: stripping functiondef output deletes the entire body and every assertion
+-- fails on a clean schema. prosrc is the body alone.
+--
+-- LITERALS ARE STRIPPED HERE, DELIBERATELY. Every marker in this file is an
+-- identifier or a statement shape, so a string literal is never the evidence. This
+-- is the OPPOSITE of agent_board_fedsession_provider_absence_gate.test.sql G-8,
+-- where the marker IS a raise message and literals are deliberately KEPT. Do not
+-- "fix" one of these two files to match the other; the difference is the point.
+--
+-- WHAT THESE ASSERTIONS CAN SEE, AND WHAT THEY CANNOT. They remain POSITIONAL
+-- claims over STATIC SQL, and nothing more:
+--   * they cannot see DYNAMIC SQL. An acquisition built into an `execute` string is
+--     a literal, so the strip removes it and the marker is simply not found -- the
+--     `strpos(...) > 0` guard then fails, which is fail-CLOSED, but the ordering
+--     inside such a string is unreadable either way. That fail-closed property is a
+--     PROPERTY OF THE GUARDS, not of `strpos`: a bare `strpos(A) < strpos(B)` with
+--     no guard returns `0 < N` = TRUE when A is absent, so it PASSES on a body it
+--     no longer matches. The legacy revoke_agent claim shipped that way and was
+--     green under `update only agent_board.agents` with the ordering inverted
+--     (#198). Only the LEFT-hand marker of a `<` comparison is fail-open when
+--     absent -- an absent right-hand marker yields 0 and makes `N < 0` false,
+--     which already fails. Every positional claim below now guards its left-hand
+--     marker with `> 0`; a new one that does not is fail-OPEN, not merely
+--     imprecise;
+--   * they cannot see locks taken by TRIGGERS or inside callees; only text in THIS
+--     function body;
+--   * they cannot see RUNTIME order. These are first-occurrence claims over
+--     statements as written, not a per-branch path analysis. Where a marker matched
+--     an unrelated branch, the assertion was silently inert -- see the
+--     revoke_fleet_subject claim below, which is now anchored to the agent branch's
+--     own loop header because the bare `from agent_board.fleet_machines fm` matched
+--     the MACHINE branch first and passed while the agent branch was inverted.
+-- Where a claim has a runtime counterparty, the counterparty is NAMED in the
+-- assertion description. Where it has none, that is stated too. An honest narrow
+-- claim beats a broad false one.
+--
+-- WHAT IS *STILL* RAW IN THIS FILE. Only the NINE positional claims were converted.
+-- Everything else here still reads raw text and is knowingly left alone, so this
+-- file must not be read as "the masking class is closed in
+-- agent_board_atomic_fleet_onboarding.test.sql". The remainder, enumerated so the
+-- next reader does not have to trust a summary:
+--   * the 23 `pg_get_functiondef(...) like '%...%'` PRESENCE assertions (26 calls;
+--     two assertions read more than one function). A comment mentioning the
+--     pattern satisfies them exactly as it did the positional ones; one was
+--     demonstrated silenced that way (#198). They are presence claims, so a
+--     comment can only make a MISSING construct look present -- the same
+--     fail-open direction, on weaker claims;
+--   * the two catalog CLASS assertions at the end. The serialization one decides
+--     serialized/UNSERIALIZED with `strpos(p.prosrc, '_lock_board_authority_ceiling')`
+--     over RAW prosrc, so a reader that DROPS the lock while keeping a comment
+--     naming it still prints "serialized" -- the dangerous direction. The
+--     surface-set predicates that pick the second class's member functions are raw
+--     for the same reason.
+-- All of it is inside exact-set or presence assertions that #196 Bucket A
+-- deliberately excluded; it belongs to the follow-up that closes Buckets B and C,
+-- together with the nesting hole in the strip described above.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+select plan(52);
+
+-- ---------------------------------------------------------------------------
+-- The stripped-body reader every positional assertion below uses. A shared SQL
+-- include is not workable in this harness -- the runner pipes
+-- `begin; \i <file>; rollback;` into psql, so there is no reliable relative
+-- include path -- so it is defined ONCE here instead of being copy-pasted into
+-- nine call sites, which would guarantee drift. The regex is byte-identical to
+-- agent_board_federated_lock_order_class.test.sql; see the header.
+-- ---------------------------------------------------------------------------
+create function pg_temp._stripped_body(p_fn regprocedure) returns text
+language sql stable as $strip$
+  select regexp_replace(p.prosrc,
+           $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
+           ' ', 'g')
+    from pg_proc p
+   where p.oid = p_fn;
+$strip$;
+
+select has_table('agent_board', 'fleet_onboarding_invite_bounds', 'immutable fleet invite bounds table exists');
+select has_pk('agent_board', 'fleet_onboarding_invite_bounds', 'fleet invite bounds are keyed by invite id');
+select has_function(
+  'agent_board', 'create_fleet_onboarding_invite',
+  array['uuid','uuid','text','text','text','text','text','text','text','integer','timestamp with time zone','uuid','jsonb'],
+  'bounded fleet invite mint exists'
+);
+select has_function(
+  'agent_board', 'onboard_federated_fleet_agent',
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
+  'atomic fleet onboarding RPC exists'
+);
+select has_function('agent_board', '_redeem_fleet_invite_for_agent', array['text','uuid'], 'fleet-only redemption helper exists');
+select has_function('agent_board', '_redeem_invite_for_agent', array['text','uuid'], 'generic guarded redemption helper remains');
+select has_function(
+  'agent_board', 'revoke_fleet_machine_agent_binding',
+  array['uuid','uuid','text','jsonb'],
+  'exact binding revocation writer exists'
+);
+select function_privs_are(
+  'agent_board', 'onboard_federated_fleet_agent',
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
+  'service_role', array['EXECUTE'],
+  'only service_role can execute atomic onboarding'
+);
+select function_privs_are(
+  'agent_board', '_redeem_fleet_invite_for_agent', array['text','uuid'],
+  'service_role', array['EXECUTE'],
+  'fleet redemption helper is service-role-only'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%fleet_onboarding.v1%',
+  'atomic onboarding returns the frozen contract version'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%for update%',
+  'atomic onboarding catalog-pins row locking'
+);
+select ok(
+  pg_get_functiondef('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text)'::regprocedure)
+    like '%pg_advisory_xact_lock%',
+  'exact-key create-or-reuse is serialized by fingerprint'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%pg_advisory_xact_lock(hashtextextended(p_agent_public_key_fingerprint, 0))%',
+  'composed onboarding serializes identity disposition by fingerprint'
+);
+select ok(
+  pg_get_functiondef('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text)'::regprocedure)
+    like '%fleet invite requires atomic fleet onboarding%',
+  'legacy enrollment rejects bounded invites before writes'
+);
+select ok(
+  pg_get_functiondef('agent_board._redeem_invite_for_agent(text,uuid)'::regprocedure)
+    like '%reserved for atomic fleet onboarding%',
+  'generic ROOMLINK redemption rejects bounded invites'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%phase_worker%worker%reviewer%reviewer%',
+  'only bounded worker and reviewer role pairs are admitted'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%signing_key_id is distinct from v_enroll.signing_key_id%',
+  'binding replay pins the exact proven signing key'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%v_inv.board_id is distinct from p_board_id%',
+  'requested board is checked against the locked invite before writes'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%not v_completed_replay%v_inv.expires_at <= now()%v_inv.uses_count >= v_inv.max_uses%',
+  'only a complete active replay may bypass expiry and exhaustion'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%v_inv.revoked_at is not null%a.status = ''active''%_grant_within_ceiling%',
+  'revocation and current creator authority gate every fleet replay'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%a.id = any(array[v_inv.created_by_agent_id, v_existing_agent_id])%order by a.id for update%bm.agent_id = v_inv.created_by_agent_id%order by bm.id for update%_grant_within_ceiling%',
+  'creator and enrolled principals lock in UUID order before creator authority'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%board_invite_redemptions red%order by red.id for update%bm.agent_id = v_enroll.agent_id%order by bm.id for update%select exists%',
+  'complete-replay proof locks redemption and membership first'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%perform 1 from agent_board.fleet_harness_registrations%perform 1 from agent_board.fleet_repo_scopes%perform 1 from agent_board.fleet_machine_agents%',
+  'every matching harness, repo, and binding history row is locked before reuse'
+);
+select ok(
+  pg_get_functiondef('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure)
+    like '%lifecycle_state = ''revoked''%',
+  'binding revocation is a permanent tombstone'
+);
+select ok(
+  strpos(
+    pg_temp._stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure),
+    'from agent_board.fleet_machines m'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure),
+    'from agent_board.fleet_machine_agents b where b.id = p_binding_id for update'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure),
+    'from agent_board.fleet_machines m'
+  ) < strpos(
+    pg_temp._stripped_body('agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)'::regprocedure),
+    'from agent_board.fleet_machine_agents b where b.id = p_binding_id for update'
+  ),
+  'exact binding revocation locks the machine before the binding [SOLE PIN: no isolation spec discriminates this ordering -- measured against all 20]'
+);
+select ok(
+  strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'where fm.id = p_machine_id for update'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'from agent_board.agents a where a.id = v_enroll.agent_id for update'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'where fm.id = p_machine_id for update'
+  ) < strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'from agent_board.agents a where a.id = v_enroll.agent_id for update'
+  ),
+  'atomic onboarding locks the machine before its enrolled agent [CONFIRMATORY: atomic_fleet_binding_revoke.spec and atomic_fleet_lifecycle_races.spec both discriminate the inversion]'
+);
+-- ANCHORED TO THE AGENT BRANCH, not to a bare table name (#196). The previous
+-- marker 'from agent_board.fleet_machines fm' has THREE matches in this body and
+-- the FIRST is in the p_subject_kind='machine' branch -- an occurrence this claim
+-- is not about. Moving the agent branch's machine-lock loop BELOW the agent lock
+-- (the exact inversion this assertion names) left the file fully green: it was
+-- inert for its own claim, independently of any comment mask.
+--
+-- The anchor is the agent branch's loop header `order by fma.machine_id`, which
+-- occurs exactly once. The lock it drives is then located RELATIVE to that header
+-- (substr from the header onward), because `where fm.id = v_lock_machine_id`
+-- occurs twice and a bare strpos would find the machine branch's copy again --
+-- which would also let an EMPTIED loop body pass. Positions are computed off
+-- single-line markers rather than a multi-line block so a whitespace-only reindent
+-- does not fail the claim.
+select ok(
+  (with b as (
+     select pg_temp._stripped_body(
+       'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb)'::regprocedure) as t),
+   p as (
+     select t,
+            strpos(t, 'order by fma.machine_id') as loop_pos,
+            strpos(t, 'from agent_board.agents a where a.id = p_subject_id for update') as agent_pos
+       from b)
+   select loop_pos > 0
+      and agent_pos > 0
+      and loop_pos < agent_pos
+      -- the loop actually takes the fleet_machines row lock, after its own header
+      and strpos(substr(t, loop_pos), 'where fm.id = v_lock_machine_id') > 0
+      and strpos(substr(t, loop_pos), 'for update') > 0
+      -- ...and that lock is still ahead of the agent lock
+      and loop_pos + strpos(substr(t, loop_pos), 'where fm.id = v_lock_machine_id') - 1 < agent_pos
+     from p),
+  'agent fleet revocation takes its machine locks before the agent lock [SOLE PIN: no isolation spec discriminates this ordering -- measured against all 20]'
+);
+select ok(
+  strpos(
+    pg_temp._stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
+    'from agent_board.agents a where a.id = p_agent_id for update'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
+    'from agent_board.agent_signing_keys'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
+    'from agent_board.agents a where a.id = p_agent_id for update'
+  ) < strpos(
+    pg_temp._stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
+    'from agent_board.agent_signing_keys'
+  ),
+  'subtree primitive locks the agent before signing keys [SOLE PIN: no isolation spec discriminates this ordering -- measured against all 20]'
+);
+select ok(
+  pg_get_functiondef('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure)
+    like '%from agent_board.agent_signing_keys%order by id%for update%',
+  'subtree primitive locks signing keys in UUID order'
+);
+select ok(
+  pg_get_functiondef('agent_board.revoke_agent_subtree(uuid,uuid,text)'::regprocedure)
+    like '%select agent_id from subtree order by agent_id%',
+  'agent subtree enumerates principals in UUID order'
+);
+select ok(
+  pg_get_functiondef('agent_board.revoke_human_subtree(uuid,uuid,text)'::regprocedure)
+    like '%where owner_user_id = p_owner_user_id%order by id%',
+  'human subtree enumerates principals in UUID order'
+);
+-- PRESENCE GUARDS ARE NOT DECORATION (#198 review). This claim shipped as a bare
+-- `strpos(A) < strpos(B)`, and a marker that is not found returns 0, so `0 < N` is
+-- TRUE: rewriting the first statement as `update only agent_board.agents` -- a
+-- semantics-preserving refactor, no comment and no literal involved -- made the
+-- assertion pass on a body it no longer matched. With the ordering ALSO inverted
+-- the file still ran 52/52 fully green. Both `> 0` guards below are what make the
+-- not-found case fail instead of pass; the other eight positional claims in this
+-- file already carried them.
+select ok(
+  strpos(
+    pg_temp._stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure),
+    'update agent_board.agents'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure),
+    'update agent_board.agent_credentials'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure),
+    'update agent_board.agents'
+  ) < strpos(
+    pg_temp._stripped_body('agent_board.revoke_agent(uuid,text)'::regprocedure),
+    'update agent_board.agent_credentials'
+  ),
+  'legacy authenticated revoke_agent preserves agent-before-credential ordering [HISTORICAL: legacy platform-admin path, no live fleet counterparty and no isolation spec]'
+);
+select is(
+  (select count(*)::int from information_schema.role_table_grants
+    where table_schema='agent_board' and table_name='fleet_onboarding_invite_bounds'
+      and grantee in ('anon','authenticated') and privilege_type in ('INSERT','UPDATE','DELETE')),
+  0,
+  'no public or authenticated direct writer can mutate invite bounds'
+);
+select has_table('agent_board', 'fleet_human_revocations',
+  'durable total-human revocation registry exists');
+select has_pk('agent_board', 'fleet_human_revocations',
+  'durable total-human revocation registry is keyed by stable federation principal');
+select has_trigger('agent_board', 'agents', 'agents_protect_federation_contract',
+  'agents protect their reserved federation contract at every write path');
+select ok(
+  pg_get_functiondef('agent_board.create_fleet_onboarding_invite(uuid,uuid,text,text,text,text,text,text,text,integer,timestamp with time zone,uuid,jsonb)'::regprocedure)
+    like '%from agent_board.boards b%where b.id = p_board_id%for update%v_board.status <> ''active''%',
+  'bounded invite mint locks and requires an active board'
+);
+select ok(
+  pg_get_functiondef('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)
+    like '%from agent_board.boards b%where b.id = v_inv.board_id%for update%v_board.status <> ''active''%',
+  'atomic onboarding locks and requires the invite board to remain active'
+);
+select ok(
+  pg_get_functiondef('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text)'::regprocedure)
+    like '%from auth.users u where u.id = v_owner_user_id for update%fleet_human_revocations%r.issuer = p_issuer and r.subject = p_subject%',
+  'identity enrollment locks the human owner and rejects durable total revocation'
+);
+select ok(
+  pg_get_functiondef('agent_board.revoke_human_subtree(uuid,uuid,text)'::regprocedure)
+    like '%from auth.users u where u.id = p_owner_user_id for update%where a.owner_user_id = p_owner_user_id%jsonb_typeof(a.metadata -> ''federation'') = ''object''%not exists (%from agent_board.enrollment_federation_audit e%where e.agent_id = a.id%stable federation evidence not found for every linked agent%insert into agent_board.fleet_human_revocations%issuer, subject, owner_user_id%on conflict (issuer, subject) do nothing%where owner_user_id = p_owner_user_id%order by id%'
+    and pg_get_functiondef('agent_board.revoke_human_subtree(uuid,uuid,text)'::regprocedure)
+      not like '%metadata #>> ''{federation,replay,issuer}''%',
+  'total human revocation requires per-agent audit evidence before marking and enumeration'
+);
+
+-- ---------------------------------------------------------------------------
+-- Consiliency/message-board#186 — ceiling-ABSENCE serialization, and the two
+-- privilege/class holes the assertions above do not close.
+-- ---------------------------------------------------------------------------
+
+-- function_privs_are(..., 'service_role', array['EXECUTE'], ...) constrains only
+-- what service_role HAS. Granting authenticated EXECUTE passes it unchanged. The
+-- deny side has to be asserted directly.
+select ok(
+  not has_function_privilege(
+    'authenticated',
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
+    'EXECUTE'
+  ),
+  'authenticated CANNOT execute atomic onboarding'
+);
+select ok(
+  not has_function_privilege(
+    'anon',
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
+    'EXECUTE'
+  ),
+  'anon CANNOT execute atomic onboarding'
+);
+select ok(
+  not has_function_privilege(
+    'authenticated', 'agent_board._redeem_fleet_invite_for_agent(text,uuid)'::regprocedure, 'EXECUTE'
+  ),
+  'authenticated CANNOT execute the fleet redemption helper'
+);
+
+-- The lock exists and derives its key in ONE place: two hand-written keys that
+-- must be byte-identical to interlock are a silent-failure class.
+select has_function(
+  'agent_board', '_lock_board_authority_ceiling', array['uuid'],
+  'board-keyed ceiling advisory lock helper exists'
+);
+select ok(
+  pg_get_functiondef('agent_board._lock_board_authority_ceiling(uuid)'::regprocedure)
+    like '%pg_advisory_xact_lock(%hashtextextended(''agent_board.board_authority_ceilings:'' || p_board_id::text, 0)%',
+  'the ceiling lock key is derived once, from the board id, in a transaction advisory lock'
+);
+
+-- Ordering, not mere presence: the lock has to be held BEFORE the authorization
+-- decision reads the (possibly absent) ceiling, and BEFORE the writer upserts it.
+select ok(
+  strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) < strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'agent_board._grant_within_ceiling('
+  ),
+  'atomic onboarding holds the board ceiling lock before evaluating creator authority [REDUNDANT: implied by the advisory-before-boards and boards-before-ceiling-read claims below; an advisory moved between those two points violates the real ordering and still passes THIS one]'
+);
+-- ABBA. set_board_authority_ceiling's order is advisory -> boards, because its
+-- UPSERT reaches the boards row through board_authority_ceilings' FK (FOR KEY SHARE
+-- on INSERT). Onboarding must agree: advisory BEFORE its boards row lock. The first
+-- cut of 20260901000110 had them inverted and deadlocked deterministically -- a
+-- deadlock the migration INTRODUCED, absent at base. This is the ordering assertion
+-- that catches the inversion; it is deliberately separate from the "before the
+-- ceiling read" assertion below, because that one passes in BOTH orders.
+select ok(
+  strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) < strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'from agent_board.boards b
+   where b.id = v_inv.board_id
+   for update'
+  ),
+  'atomic onboarding takes the ceiling advisory lock BEFORE the boards row lock (no ABBA against the ceiling setter) [BACKSTOP: tests/isolation/specs/onboarding_ceiling_lock_order.spec]'
+);
+select ok(
+  not has_function_privilege(
+    'authenticated', 'agent_board._lock_board_authority_ceiling(uuid)'::regprocedure, 'EXECUTE'
+  ),
+  'authenticated CANNOT execute the unauthorized ceiling lock helper (direct grant is an onboarding DoS)'
+);
+
+-- The mechanism that is actually load-bearing today (see 20260901000110's header):
+-- onboarding holds the BOARDS row FOR UPDATE, and board_authority_ceilings' FK makes
+-- an INSERT of a first ceiling row take FOR KEY SHARE on that same row, which
+-- conflicts. That only holds while the boards lock precedes the ceiling read -- an
+-- ordering nothing else states, because the boards lock is taken for board liveness,
+-- not for the ceiling. Pin the ordering so a refactor that moves it is not silent.
+select ok(
+  strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'from agent_board.boards b
+   where b.id = v_inv.board_id
+   for update'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'from agent_board.boards b
+   where b.id = v_inv.board_id
+   for update'
+  ) < strpos(
+    pg_temp._stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure),
+    'agent_board._grant_within_ceiling('
+  ),
+  'atomic onboarding holds the boards row FOR UPDATE before it reads the ceiling [CONFIRMATORY FOR FLAT MASKS ONLY: agent_board_federated_lock_order_class.test.sql EC-3 fails by name on the comment/literal mutants, but it carries the SAME strip, so a NESTED block comment takes this assertion and EC-3 green together -- see #199 in the header; atomic_fleet_authority_races.spec pins the OUTCOME only when this lock and the advisory are BOTH gone, and atomic_fleet_board_archive.spec BLOCKS rather than failing by name]'
+);
+select ok(
+  strpos(
+    pg_temp._stripped_body('agent_board.set_board_authority_ceiling(uuid,text)'::regprocedure),
+    'perform agent_board._lock_board_authority_ceiling(p_board_id)'
+  ) > 0
+  and strpos(
+    pg_temp._stripped_body('agent_board.set_board_authority_ceiling(uuid,text)'::regprocedure),
+    'perform agent_board._lock_board_authority_ceiling(p_board_id)'
+  ) < strpos(
+    pg_temp._stripped_body('agent_board.set_board_authority_ceiling(uuid,text)'::regprocedure),
+    'insert into agent_board.board_authority_ceilings'
+  ),
+  'the ceiling setter holds the same lock before its owner gate and upsert [BACKSTOP: tests/isolation/specs/ceiling_setter_lock_before_upsert.spec]'
+);
+
+-- CLASS (catalog-derived, EC-4 form). Every agent_board function that reads the
+-- ceiling for authorization, enumerated from pg_proc — never from a list written
+-- here — each carrying its serialization state POSITIVELY. A new reader changes
+-- the array and NAMES ITSELF in the diff; a reader that is serialized without
+-- being declared here also fails. The three UNSERIALIZED entries are the
+-- knowingly-unfixed remainder of the class recorded in 20260901000110's header:
+-- they carry the same absence race and are out of #186's scope.
+select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below are string literals in the expected array, never invoked
+  (select array_agg(entry order by entry) from (
+     select 'agent_board.' || regexp_replace(p.oid::regprocedure::text, '^([^(]*\.)?', '') || ' => ' ||
+            case when strpos(p.prosrc, '_lock_board_authority_ceiling') > 0
+                 then 'serialized' else 'UNSERIALIZED' end as entry
+       from pg_proc p
+       join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and strpos(p.prosrc, '_grant_within_ceiling') > 0
+   ) readers),
+  array[
+    'agent_board._redeem_unbounded_invite_for_agent(text,uuid) => UNSERIALIZED',
+    'agent_board.create_invite_link(uuid,text,text,integer,timestamp with time zone,uuid,jsonb) => UNSERIALIZED',
+    'agent_board.grant_board_role(uuid,uuid,text,uuid) => UNSERIALIZED',
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) => serialized'
+  ]::text[],
+  'every ceiling-authorization reader in pg_proc is declared with its serialization state'
+);
+
+-- CLASS (catalog-derived). Every function that touches this migration set's own
+-- surface — the bounded-invite table, the human revocation registry, the fleet
+-- revocation ledger, or the ceiling lock — with its exact non-owner EXECUTE
+-- grantees.
+--
+-- The first cut filtered on `p.prosecdef`, which excluded _lock_board_authority_ceiling
+-- BY CONSTRUCTION: it is `language sql` and not a definer, so it is the one function
+-- this migration CREATES and the class could not see it. Granting that helper to
+-- PUBLIC passed the whole file. SECURITY DEFINER is therefore recorded as a VALUE
+-- per entry, never used as the filter — a definer/invoker flip now fails too.
+--
+-- A new function on this surface fails and names itself; so does any grant drift,
+-- including a grant to PUBLIC (which a fresh `create function` confers by default
+-- and which prints as PUBLIC here) or to authenticated.
+select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below are string literals in the expected array, never invoked
+  (select array_agg(entry order by entry) from (
+     select 'agent_board.' || regexp_replace(p.oid::regprocedure::text, '^([^(]*\.)?', '')
+            || case when p.prosecdef then ' [definer] => ' else ' [invoker] => ' end
+            || coalesce((
+              select string_agg(distinct coalesce(pg_get_userbyid(nullif(a.grantee, 0)), 'PUBLIC'), ','
+                       order by coalesce(pg_get_userbyid(nullif(a.grantee, 0)), 'PUBLIC'))
+                from aclexplode(p.proacl) a
+               where a.privilege_type = 'EXECUTE'
+                 and a.grantee <> p.proowner
+            ), '(none)') as entry
+       from pg_proc p
+       join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and (strpos(p.prosrc, 'fleet_onboarding_invite_bounds') > 0
+          or strpos(p.prosrc, 'fleet_human_revocations') > 0
+          or strpos(p.prosrc, 'fleet_revocation_events') > 0
+          or strpos(p.prosrc, '_lock_board_authority_ceiling') > 0
+          or strpos(p.prosrc, 'board_authority_ceilings:') > 0)
+   ) definers),
+  array[
+    'agent_board._lock_board_authority_ceiling(uuid) [invoker] => service_role',
+    'agent_board._redeem_fleet_invite_for_agent(text,uuid) [definer] => service_role',
+    'agent_board._redeem_invite_for_agent(text,uuid) [definer] => service_role',
+    'agent_board._revoke_agent_principal(uuid,uuid,text) [definer] => service_role',
+    'agent_board.create_fleet_onboarding_invite(uuid,uuid,text,text,text,text,text,text,text,integer,timestamp with time zone,uuid,jsonb) [definer] => authenticated,service_role',
+    'agent_board.enroll_federated_human(text,text,text,jsonb,text) [definer] => service_role',
+    'agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text) [definer] => service_role',
+    'agent_board.evaluate_fleet_sender_policy(uuid,uuid,uuid,uuid,text,uuid,boolean) [definer] => authenticated,service_role',
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) [definer] => service_role',
+    'agent_board.reactivate_fleet_machine(uuid,uuid,text) [definer] => service_role',
+    'agent_board.reclaim_fleet_machine(uuid,uuid,uuid,text,uuid) [definer] => service_role',
+    'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb) [definer] => authenticated,service_role',
+    'agent_board.revoke_human_subtree(uuid,uuid,text) [definer] => service_role',
+    'agent_board.set_board_authority_ceiling(uuid,text) [definer] => authenticated,service_role'
+  ]::text[],
+  'every function on this migration set''s surface is declared with its definer flag and exact EXECUTE grantees'
+);
+
+select * from finish();
+rollback;