@consiliency/agent-board-schema 1.23.0 → 1.25.0

package/tests/agent_board_claimkey.test.sql

@@ -16,7 +16,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(25);
+select plan(26);
 
 select set_config('request.jwt.claim.role', 'service_role', true);
 select set_config('request.jwt.claim.sub', '', true);
@@ -219,11 +219,33 @@ select is(
      join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and p.prokind = 'f'
-      and pg_get_functiondef(p.oid) ~* '(insert\s+into|update)\s+(agent_board\.)?claims\M'
-      and pg_get_functiondef(p.oid) !~ '_canonical_claim_key'),
+      and agent_board_test.stripped_body(p.oid) ~* '(insert\s+into|update)\s+(agent_board\.)?claims\M'
+      -- message-board#196 Bucket B: read RAW, one comment naming _canonical_claim_key
+      -- dropped a bypass writer out of this set and the count went to 0 green.
+      -- anchored to the CALL shape: a bare-substring `!~` is satisfied by any
+      -- identifier containing the name, e.g. an argument `p_canonical_claim_key`.
+      -- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
+      -- IDENTITY: `\m_canonical_claim_key\s*\(` also matches
+      -- `zz_other._canonical_claim_key(...)` (measured true). Every live call
+      -- site in agent_board is `agent_board.`-qualified, so requiring the
+      -- qualification costs nothing today and is fail-CLOSED if someone later writes
+      -- an unqualified call (it reads as NOT calling). Overload count is pinned
+      -- separately, so schema + name is the identity.
+      and agent_board_test.stripped_body(p.oid) !~* '\magent_board\._canonical_claim_key\s*\('),
   0,
   'every catalog-enumerated claims writer routes its resource_key through _canonical_claim_key');
 
+
+-- The schema-qualified call anchor above treats `agent_board._canonical_claim_key` as an
+-- IDENTITY. That is only true while the name resolves to exactly one function:
+-- a second overload would be a different implementation the same anchor accepts.
+-- Catalog-derived, so a new overload fails here and the count names itself.
+select is(
+  (select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_canonical_claim_key'),
+  1,
+  'agent_board._canonical_claim_key has exactly ONE overload, so the schema-qualified call anchor identifies it uniquely');
+
 select * from finish();
 
 rollback;

package/tests/agent_board_consent_emission.test.sql

@@ -222,21 +222,18 @@ select is(
 -- anywhere in the body is fail-open twice over: the name in a comment or a dead branch would
 -- satisfy it, and calling the emitter TWICE would too -- while this suite claims exactly one
 -- event per transition.
--- Strips BOTH comment forms. The first version stripped only `--`, so a /* */ commented-out
--- call still satisfied the completeness assertion.
-create function pg_temp.code(p_oid oid) returns text language sql stable as $$
-  select regexp_replace(
-           regexp_replace(pg_get_functiondef(p_oid), '/\*.*?\*/', '', 'gs'),
-           '--[^\n]*', '', 'g');
-$$;
+-- The stripped reader is agent_board_test.stripped_body(), shared by the whole
+-- suite from tests/fixtures/test-prereqs.sql. The local version this replaces
+-- stripped both comment forms with a regex -- which still could not see a NESTED
+-- block comment (message-board#199) or a string literal.
 
 select is(
   (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.prokind = 'f'
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and pg_temp.code(p.oid) ~* '(insert into|update)[[:space:]]+agent_board\.board_memberships'
-      and pg_temp.code(p.oid) !~ 'perform agent_board\._emit_membership_event'
+      and agent_board_test.stripped_body(p.oid) ~* '(insert into|update)[[:space:]]+agent_board\.board_memberships'
+      and agent_board_test.stripped_body(p.oid) !~* 'perform agent_board\._emit_membership_event'
       and p.proname <> 'grant_board_role'),
   '',
   'COMPLETENESS: every function writing board_memberships emits, or is a stated exemption');
@@ -244,14 +241,21 @@ select is(
 -- ...and none of them emits MORE than once, which would break one-event-per-transition.
 select is(
   (select coalesce(string_agg(p.proname || '=' ||
-            (length(pg_temp.code(p.oid)) - length(replace(pg_temp.code(p.oid),
+            (length(agent_board_test.stripped_body(p.oid)) - length(replace(lower(agent_board_test.stripped_body(p.oid)),
               'perform agent_board._emit_membership_event', '')))
             / length('perform agent_board._emit_membership_event'), ', ' order by p.proname), '')
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.prokind = 'f'
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and pg_temp.code(p.oid) ~ 'perform agent_board\._emit_membership_event'
-      and (length(pg_temp.code(p.oid)) - length(replace(pg_temp.code(p.oid),
+      -- CASE-INSENSITIVE, and that is load-bearing rather than tidiness. SQL folds
+      -- unquoted identifiers, but `prosrc` is stored VERBATIM, so a writer spelling
+      -- the same call `AGENT_BOARD.…` or the same column `FINGERPRINT` is identical
+      -- to PostgreSQL and invisible to a case-sensitive scan. For a MEMBERSHIP
+      -- filter that is the fail-OPEN direction: the offender simply leaves the
+      -- class and the expected-empty assertion stays green. (Same mechanism
+      -- agent_board_wake_recovery.test.sql records for its own WR-7 filter.)
+      and agent_board_test.stripped_body(p.oid) ~* 'perform agent_board\._emit_membership_event'
+      and (length(agent_board_test.stripped_body(p.oid)) - length(replace(lower(agent_board_test.stripped_body(p.oid)),
             'perform agent_board._emit_membership_event', '')))
           / length('perform agent_board._emit_membership_event') <> 1),
   '',
@@ -259,7 +263,7 @@ select is(
 
 -- ...and the one exemption is genuinely state-blind: membership_state never appears in a SET.
 select ok(
-  (select pg_get_functiondef(p.oid) !~* 'set[^;]*membership_state[[:space:]]*='
+  (select agent_board_test.stripped_body(p.oid) !~* 'set[^;]*membership_state[[:space:]]*='
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = 'grant_board_role'),
   'COMPLETENESS: the exemption holds -- grant_board_role never SETs membership_state');

package/tests/agent_board_consent_gating.test.sql

@@ -17,7 +17,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(53);
+select plan(54);
 
 create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
 begin
@@ -298,14 +298,44 @@ select is(
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
       and has_function_privilege('authenticated', p.oid, 'EXECUTE')
       -- reaches an active membership, directly or through the shared sink
-      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+      and agent_board_test.stripped_body(p.oid)
             -- Includes update_board_membership: a one-hop WRAPPER calling it with 'joined'
             -- reaches an active membership without ever naming the sink, and would otherwise
             -- evade this class assertion entirely.
-            ~ '(_upsert_board_membership_state|_redeem_invite_for_agent|update_board_membership|insert into agent_board\.board_memberships)'
-      -- gated: consults the predicate, or refuses a non-subject actor structurally
-      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
-            !~ '(_membership_consent_present|actor mismatch|requires an act by that agent)'
+      -- CASE-INSENSITIVE, and that is load-bearing rather than tidiness. SQL folds
+      -- unquoted identifiers, but `prosrc` is stored VERBATIM, so a writer spelling
+      -- the same call `AGENT_BOARD.…` or the same column `FINGERPRINT` is identical
+      -- to PostgreSQL and invisible to a case-sensitive scan. For a MEMBERSHIP
+      -- filter that is the fail-OPEN direction: the offender simply leaves the
+      -- class and the expected-empty assertion stays green. (Same mechanism
+      -- agent_board_wake_recovery.test.sql records for its own WR-7 filter.)
+            ~* '(_upsert_board_membership_state|_redeem_invite_for_agent|update_board_membership|insert into agent_board\.board_memberships)'
+      -- gated: consults the predicate, or refuses a non-subject actor structurally.
+      --
+      -- SPLIT IN TWO, by what kind of thing each marker IS. The single `!~` over a
+      -- three-way alternation could not be read correctly in either mode: the
+      -- helper name is CODE and the other two are raise MESSAGES, so
+      -- literal-stripping deleted the messages (every route then looked ungated)
+      -- and literal-keeping left the messages maskable by any string.
+      --
+      -- The message half is therefore ANCHORED TO THE STATEMENT SHAPE
+      -- (message-board#196 remedy 2) rather than to the bare message: the text has
+      -- to follow a `raise exception` to count. Measured before the split: a
+      -- `raise debug 'gate: %', '_membership_consent_present';` planted in an
+      -- ungated update_board_membership took this class assertion GREEN with the
+      -- gate genuinely removed. It does not any more.
+      -- anchored to the CALL shape, for the same reason the message half below is
+      -- anchored to the raise shape: a bare substring is satisfied by a NAME.
+      -- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
+      -- IDENTITY: `\m_membership_consent_present\s*\(` also matches
+      -- `zz_other._membership_consent_present(...)` (measured true). Every live call
+      -- site in agent_board is `agent_board.`-qualified, so requiring the
+      -- qualification costs nothing today and is fail-CLOSED if someone later writes
+      -- an unqualified call (it reads as NOT calling). Overload count is pinned
+      -- separately, so schema + name is the identity.
+      and agent_board_test.stripped_body(p.oid) !~* '\magent_board\._membership_consent_present\s*\('
+      and agent_board_test.stripped_body(p.oid, true)
+            !~ 'raise[[:space:]]+exception[^;]{0,250}(actor mismatch|requires an act by that agent)'
       -- stated exemptions, each with a reason recorded in the migration header
       and p.proname not in (
         'create_board',        -- the actor IS the subject: it seeds the creator's own seat
@@ -329,7 +359,9 @@ select is(
      from pg_proc p
      join pg_namespace n on n.oid = p.pronamespace
      cross join lateral regexp_matches(
-       regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g'),
+       -- LITERALS KEPT: the marker is the ARGUMENT ''joined''/''subscribed'' passed
+       -- to the sink -- a string literal in the code being matched.
+       agent_board_test.stripped_body(p.oid, true),
        '(?:_upsert_board_membership_state|update_board_membership)\s*\([^;]*?''(joined|subscribed)''',
        'g') m
     where n.nspname = 'agent_board'
@@ -343,7 +375,8 @@ select is(
      from pg_proc p
      join pg_namespace n on n.oid = p.pronamespace
      cross join lateral regexp_matches(
-       regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g'),
+       -- LITERALS KEPT: same shape as above -- the state being written is a literal.
+       agent_board_test.stripped_body(p.oid, true),
        '(?:_upsert_board_membership_state|update_board_membership)\s*\([^;]*?''(invited|requested|left)''',
        'g') m
     where n.nspname = 'agent_board'
@@ -389,7 +422,7 @@ select is(
 -- silently reopening the race -- the classic wrong "fix" for lock-wait reports. `nowait`
 -- is excluded too (it at least fails loudly).
 select matches(
-  (select regexp_replace(regexp_replace(pg_get_functiondef(p.oid), '/\*.*?\*/', '', 'gs'), '--[^\n]*', '', 'g')
+  (select agent_board_test.stripped_body(p.oid)
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = 'resolve_board_request'),
   'from agent_board\.board_memberships[[:space:]]+bm[[:space:]]+where bm\.board_id = p_board_id[[:space:]]+and bm\.agent_id = p_agent_id[[:space:]]+order by bm\.id[[:space:]]+for update;',
@@ -399,14 +432,14 @@ select matches(
 -- a lock taken after the check protects nothing.
 select ok(
   (select position('for update' in body) < position('_membership_consent_present' in body)
-     from (select regexp_replace(regexp_replace(pg_get_functiondef(p.oid), '/\*.*?\*/', '', 'gs'), '--[^\n]*', '', 'g') as body
+     from (select agent_board_test.stripped_body(p.oid) as body
              from pg_proc p join pg_namespace n on n.oid = p.pronamespace
             where n.nspname = 'agent_board' and p.proname = 'resolve_board_request') s),
   'LOCK: ...and reads consent AFTER taking it, not before');
 
 -- The sink acts on the row the CALLER named, rather than reselecting (#109).
 select matches(
-  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+  (select agent_board_test.stripped_body(p.oid)
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = '_upsert_board_membership_state'),
   'if p_membership_id is not null then',
@@ -485,5 +518,16 @@ select is(
 select is((select version from agent_board.schema_version), 8,
   'schema_version stays 8 -- additive');
 
+
+-- The schema-qualified call anchor above treats `agent_board._membership_consent_present` as an
+-- IDENTITY. That is only true while the name resolves to exactly one function:
+-- a second overload would be a different implementation the same anchor accepts.
+-- Catalog-derived, so a new overload fails here and the count names itself.
+select is(
+  (select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_membership_consent_present'),
+  1,
+  'agent_board._membership_consent_present has exactly ONE overload, so the schema-qualified call anchor identifies it uniquely');
+
 select finish();
 rollback;

package/tests/agent_board_delegation_policies.test.sql

@@ -94,7 +94,9 @@ select is(
   false, 'over-ceiling grant is rejected (owner cannot grant admin when ceiling is member)');
 
 -- #13 owner-settable ceiling: set_board_authority_ceiling is owner-gated. ---------
-select has_function('agent_board', 'set_board_authority_ceiling', array['uuid','text'],
+-- #247 added the delegable p_actor_agent_id (null default => the pre-#247 path for every
+-- role), so the identity signature is (uuid, text, uuid).
+select has_function('agent_board', 'set_board_authority_ceiling', array['uuid','text','uuid'],
   'set_board_authority_ceiling exists');
 
 set local role authenticated;

package/tests/agent_board_enroll_resumption.test.sql

@@ -0,0 +1,412 @@
+-- Consiliency/message-board#176 pgTAP: OWNER-SCOPED ENROLL RESUMPTION.
+--
+-- The live failure: /enroll committed an identity, post-enroll provisioning failed, the
+-- client reported total failure, and every retry was then refused forever with
+-- `23505 this signing key is already enrolled`. 20260901000100's replay wrapper resumes
+-- only rows carrying its own `metadata.federation.replay` STAMP -- which the trapped
+-- enrollments, created before it shipped, do not have. 20260906000100 decides resumption
+-- from evidence written at the ORIGINAL enrollment instead, so an unstamped row resumes
+-- too.
+--
+-- Both directions are pinned here, and the SECURITY direction is the one that matters:
+--   * same verified (issuer, subject) -> the existing identity is RETURNED (R-1, R-2);
+--   * a DIFFERENT principal -> still raises, and the message names no handle (R-3, R-4).
+-- Every allow-side assertion is `lives_ok(...)` followed by a separate state check, never
+-- a bare `is((select ... from rpc(...)), ...)`, which aborts instead of failing (#113).
+--
+-- Failing calls are executed through pg_temp.try(), a BEGIN/EXCEPTION subtransaction that
+-- records (sqlstate, message) into `_err` and records an explicit '00000 / (no error
+-- raised)' row when the call SUCCEEDS -- so "the raise disappeared" fails an assertion
+-- rather than silently matching nothing.
+--
+-- EC-1/EC-2 are the class assertions: the route class is enumerated from pg_proc, not
+-- from a list written here, so a new fingerprint-accepting route or a new signing-key
+-- creator fails and NAMES ITSELF.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(35);
+
+-- ---------------------------------------------------------------------------
+-- Fixtures
+-- ---------------------------------------------------------------------------
+create temp table _v (name text primary key, val text) on commit drop;
+create temp table _e (
+  label text, agent_id uuid, auth_user_id uuid, provider_id text, signing_key_id uuid,
+  granted text[], key_id text, key_version int, handle text, invite_redeemed boolean
+) on commit drop;
+create temp table _err (label text primary key, state text, msg text) on commit drop;
+
+-- The four resumption RESULTS, declared UP FRONT with the RETURNS TABLE shape rather
+-- than created by `create temp table ... as <the call>`. If the call under test raises,
+-- `lives_ok` records the failure and the CTAS form would leave the table MISSING -- so
+-- every following assertion would abort the transaction instead of failing, and pgTAP
+-- would emit fewer assertions than the plan with no `not ok` to read (#113). Declared
+-- empty, those assertions return NULL and fail honestly.
+create temp table _r1 (
+  agent_id uuid, auth_user_id uuid, provider_id text, signing_key_id uuid,
+  granted_scopes text[], key_id text, key_version int, agent_handle text,
+  invite_redeemed boolean
+) on commit drop;
+create temp table _r2 (like _r1) on commit drop;
+create temp table _r6 (like _r1) on commit drop;
+create temp table _r13 (like _r1) on commit drop;
+
+
+create function pg_temp.v(p_name text) returns text language sql stable as
+$$ select val from _v where name = p_name $$;
+
+-- The exact /enroll call, as SQL text. `p_actor_sub` is null and the kind is 'agent'
+-- throughout, so the only inputs that vary across cases are the ones under test.
+create function pg_temp.enroll_sql(
+  p_iss text, p_sub text, p_slug text, p_pub text, p_fp text, p_scopes text default '{board:send}'
+) returns text language sql stable as
+$$
+  select format(
+    $q$select * from agent_board.enroll_federated_identity(%L,'message-board',%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent',%L,'{}')$q$,
+    p_iss, p_sub,
+    jsonb_build_object('iss', p_iss, 'aud', 'message-board', 'sub', p_sub)::text,
+    p_slug, p_pub, p_fp, p_scopes)
+$$;
+
+-- Run a call that is EXPECTED to raise, capturing sqlstate + message. A call that does
+-- NOT raise records '00000', so a vanished raise fails loudly instead of matching an
+-- absent row.
+create function pg_temp.try(p_label text, p_sql text) returns void language plpgsql as
+$$
+begin
+  begin
+    execute p_sql;
+    insert into _err values (p_label, '00000', '(no error raised)');
+  exception when others then
+    insert into _err values (p_label, sqlstate, sqlerrm);
+  end;
+end
+$$;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_iss1 text := 'https://res-a-' || replace(substr(gen_random_uuid()::text, 1, 8), '-', '') || '.test';
+  v_iss2 text;
+  v_pub text;
+  i int;
+begin
+  v_iss1 := 'https://res-a-' || s || '.test';
+  v_iss2 := 'https://res-b-' || s || '.test';
+
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values
+    (v_iss1, 'message-board', true, true, '{board:send,board:read}', '{board:x}', '{agent,human}'),
+    (v_iss2, 'message-board', true, true, '{board:send,board:read}', '{board:x}', '{agent,human}');
+
+  insert into _v values
+    ('s', s), ('iss1', v_iss1), ('iss2', v_iss2),
+    ('suba', 'portal|a-' || s), ('subb', 'portal|b-' || s);
+
+  -- Eight real Ed25519-shaped keys: 32 random bytes re-encoded through the SAME
+  -- canonical base64url form the enroll contract requires, and their in-DB fingerprints.
+  for i in 1..8 loop
+    v_pub := rtrim(translate(encode(gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+    insert into _v values ('pub' || i, v_pub), ('fp' || i, agent_board._raw_key_fingerprint(v_pub));
+  end loop;
+end
+$$;
+
+-- Eight enrollments. E1/E3..E8 are then stripped of their replay stamp, which is exactly
+-- the state every identity enrolled before 20260901000100 is in -- the #176 victim's
+-- state. E2 keeps its stamp.
+do $$
+declare
+  i int;
+  v_slug text;
+begin
+  for i in 1..8 loop
+    v_slug := 'res-' || i || '-' || pg_temp.v('s');
+    -- E2 is the STAMPED fixture and the only one that needs two scopes: the frozen
+    -- contract compares them as JSONB, which preserves ORDER, and R-14 pins that.
+    execute format('insert into _e select %L, * from (%s) t', 'E' || i,
+      pg_temp.enroll_sql(pg_temp.v('iss1'), pg_temp.v('suba'), v_slug,
+                         pg_temp.v('pub' || i), pg_temp.v('fp' || i),
+                         case when i = 2 then '{board:send,board:read}' else '{board:send}' end));
+  end loop;
+
+  update agent_board.agents a
+     set metadata = a.metadata #- '{federation,replay}'
+   where a.id in (select agent_id from _e where label <> 'E2');
+
+  -- E3: owned, unstamped, but the agent is revoked -> must NOT be revived by resumption.
+  update agent_board.agents a set status = 'revoked' where a.id = (select agent_id from _e where label = 'E3');
+
+  -- E4: evidence (i) broken -- owner_user_id repointed at an unrelated auth user.
+  update agent_board.agents a
+     set owner_user_id = agent_board._ensure_agent_auth_user('res-unrelated-owner-' || pg_temp.v('s'))
+   where a.id = (select agent_id from _e where label = 'E4');
+
+  -- E5: evidence (ii) broken -- the creation-time federation subject is gone.
+  update agent_board.agents a
+     set metadata = a.metadata #- '{federation,subject}'
+   where a.id = (select agent_id from _e where label = 'E5');
+
+  -- E6: evidence (iii) broken -- the original enrollment's audit row is gone.
+  delete from agent_board.enrollment_federation_audit e
+   where e.agent_id = (select agent_id from _e where label = 'E6');
+
+  -- E7: audit row present but recording no granted scopes -> ownership holds, the
+  -- identity is not resumable. This is what makes branch (b) reachable rather than
+  -- implied by the ownership conjunction.
+  update agent_board.enrollment_federation_audit e
+     set granted_scopes = null
+   where e.agent_id = (select agent_id from _e where label = 'E7');
+
+  -- E8: the ONE exemption in the ownership conjunction, modelled on the atomic-fleet
+  -- backfill fixture -- an agent that predates the owner model and carries NO
+  -- owner_user_id. Evidence (i) is unavailable there rather than contradicted.
+  update agent_board.agents a set owner_user_id = null
+   where a.id = (select agent_id from _e where label = 'E8');
+end
+$$;
+
+-- ---------------------------------------------------------------------------
+-- EC-1/EC-2 -- the class, enumerated from the catalog
+-- ---------------------------------------------------------------------------
+
+-- Every route a client can re-present an enrolled key to, taken from pg_proc.proargnames.
+-- A fourth such route added later fails this and names itself in the diff.
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proargnames && array['p_agent_public_key_fingerprint']),
+  '_enroll_federated_identity_once, enroll_federated_identity, onboard_federated_fleet_agent',
+  'EC-1: exactly three agent_board routes accept an enrolled key fingerprint (pg_proc-derived)');
+
+-- ...and only two functions in the whole schema can CREATE a signing key, so
+-- onboard_federated_fleet_agent necessarily reaches an already-enrolled key through
+-- enroll_federated_identity rather than deciding the duplicate case itself.
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prokind = 'f'
+      and agent_board_test.strip_sql(p.prosrc) ~* 'insert into agent_board\.agent_signing_keys'),
+  '_enroll_federated_identity_once, mint_delegated_child',
+  'EC-2: only the enroll creator and delegated-child mint insert signing keys (strip_sql-derived)');
+
+-- ---------------------------------------------------------------------------
+-- R-1 -- THE #176 FIX: an unstamped enrollment resumes for its owner
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r1 ' || pg_temp.enroll_sql(
+     pg_temp.v('iss1'), pg_temp.v('suba'), 'res-1-' || pg_temp.v('s'),
+     pg_temp.v('pub1'), pg_temp.v('fp1'), '{board:send}')),
+  'R-1: re-presenting an already-enrolled key as the same verified (issuer, subject) SUCCEEDS (unstamped row)');
+select is(
+  (select agent_id from _r1),
+  (select agent_id from _e where label = 'E1'),
+  'R-1: the resumption returns the EXISTING agent identity');
+select is(
+  (select signing_key_id from _r1),
+  (select signing_key_id from _e where label = 'E1'),
+  'R-1: the resumption returns the EXISTING signing key, not a new one');
+select is(
+  (select agent_handle from _r1),
+  (select handle from _e where label = 'E1'),
+  'R-1: the resumption returns the server-assigned handle the client lost');
+select is(
+  (select provider_id from _r1),
+  (select provider_id from _e where label = 'E1'),
+  'R-1: provider_id survives the unstamped path (it is read from the creation-time federation object)');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k where k.fingerprint = pg_temp.v('fp1')),
+  1, 'R-1: the resumption enrolled no second key for that fingerprint');
+select is(
+  (select count(*)::int from agent_board.agents a where a.id in (select agent_id from _e) or a.handle like 'res-1-%'),
+  8, 'R-1: the resumption created no ninth agent');
+
+-- ---------------------------------------------------------------------------
+-- R-2 -- an unstamped resumption cannot ESCALATE
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r2 ' || pg_temp.enroll_sql(
+     pg_temp.v('iss1'), pg_temp.v('suba'), 'res-1-different-slug',
+     pg_temp.v('pub1'), pg_temp.v('fp1'), '{board:send,board:read}')),
+  'R-2: an unstamped resumption tolerates a different slug and a wider scope request');
+select is(
+  (select granted_scopes from _r2),
+  '{board:send}'::text[],
+  'R-2: it returns the ORIGINAL granted scopes -- the wider request grants nothing');
+select is(
+  (select agent_id from _r2),
+  (select agent_id from _e where label = 'E1'),
+  'R-2: and it still returns the original identity, not a second one');
+
+-- ---------------------------------------------------------------------------
+-- R-3 / R-4 -- THE SECURITY DIRECTION: a different principal is still refused
+-- ---------------------------------------------------------------------------
+select pg_temp.try('squat-subject', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('subb'), 'res-squat-' || pg_temp.v('s'),
+  pg_temp.v('pub1'), pg_temp.v('fp1'), '{board:send}')));
+-- sqlstate ALONE does not pin this: with the ownership refusal bypassed the request
+-- falls through to the state gate, which raises the SAME 23505 for its own reason. The
+-- assertion therefore requires the OWNERSHIP refusal specifically.
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'squat-subject'),
+  'R-3: a key owned by a DIFFERENT subject at the same issuer is refused AS a different principal (23505)');
+select ok(
+  (select position(h in msg) = 0 from _err, (select handle h from _e where label = 'E1') x where label = 'squat-subject'),
+  'R-3: the refusal names NO handle -- a squatter learns nothing about who holds the key');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k where k.fingerprint = pg_temp.v('fp1')),
+  1, 'R-3: the refused squat left exactly one key on that fingerprint');
+
+select pg_temp.try('squat-issuer', (select pg_temp.enroll_sql(
+  pg_temp.v('iss2'), pg_temp.v('suba'), 'res-squat2-' || pg_temp.v('s'),
+  pg_temp.v('pub1'), pg_temp.v('fp1'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'squat-issuer'),
+  'R-4: the same subject at a DIFFERENT approved issuer is refused as a different principal');
+select ok(
+  (select position(h in msg) = 0 from _err, (select handle h from _e where label = 'E1') x where label = 'squat-issuer'),
+  'R-4: that refusal names no handle either');
+
+-- ---------------------------------------------------------------------------
+-- R-5 / R-6 -- a STAMPED enrollment keeps its frozen contract; only the message improves
+-- ---------------------------------------------------------------------------
+select pg_temp.try('frozen', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-2-renamed',
+  pg_temp.v('pub2'), pg_temp.v('fp2'), '{board:send,board:read}')));
+select is((select state from _err where label = 'frozen'), '23505',
+  'R-5: a stamped enrollment re-presented by its owner with a DIFFERENT slug still raises (frozen contract intact)');
+select ok(
+  (select position(h in msg) > 0 from _err, (select handle h from _e where label = 'E2') x where label = 'frozen'),
+  'R-5: but the message now NAMES the existing handle');
+select ok(
+  (select msg like '%need not be repeated%' from _err where label = 'frozen'),
+  'R-5: and says enrollment need not be repeated -- the actionable half of the ask');
+
+select lives_ok(
+  (select 'insert into _r6 ' || pg_temp.enroll_sql(
+     pg_temp.v('iss1'), pg_temp.v('suba'), 'res-2-' || pg_temp.v('s'),
+     pg_temp.v('pub2'), pg_temp.v('fp2'), '{board:send,board:read}')),
+  'R-6: an EXACT stamped replay still succeeds (the released path is unregressed)');
+select is(
+  (select agent_id from _r6),
+  (select agent_id from _e where label = 'E2'),
+  'R-6: and still returns the original identity');
+
+-- ---------------------------------------------------------------------------
+-- R-7 -- resumption never revives an identity that is not usable
+-- ---------------------------------------------------------------------------
+select pg_temp.try('revoked', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-3-' || pg_temp.v('s'),
+  pg_temp.v('pub3'), pg_temp.v('fp3'), '{board:send}')));
+select is((select state from _err where label = 'revoked'), '23505',
+  'R-7: an owned but REVOKED identity is not resumable');
+select ok(
+  (select position(h in msg) > 0 from _err, (select handle h from _e where label = 'E3') x where label = 'revoked'),
+  'R-7: its owner is told which handle is stuck');
+
+-- ---------------------------------------------------------------------------
+-- R-8/R-9/R-10 -- each of the three ownership evidences is load-bearing
+-- ---------------------------------------------------------------------------
+select pg_temp.try('no-owner-match', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-4-' || pg_temp.v('s'),
+  pg_temp.v('pub4'), pg_temp.v('fp4'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'no-owner-match'),
+  'R-8: evidence (i) -- owner_user_id not equal to the derived owner reads as NOT owned');
+
+select pg_temp.try('no-creation-stamp', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-5-' || pg_temp.v('s'),
+  pg_temp.v('pub5'), pg_temp.v('fp5'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'no-creation-stamp'),
+  'R-9: evidence (ii) -- a missing creation-time federation subject reads as NOT owned (null is not a pass)');
+
+select pg_temp.try('no-audit-row', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-6-' || pg_temp.v('s'),
+  pg_temp.v('pub6'), pg_temp.v('fp6'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'no-audit-row'),
+  'R-10: evidence (iii) -- a missing enrollment audit row reads as NOT owned');
+
+-- ---------------------------------------------------------------------------
+-- R-11 -- branch (b) is reachable on its own, not merely implied by ownership
+-- ---------------------------------------------------------------------------
+select pg_temp.try('no-granted-scopes', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-7-' || pg_temp.v('s'),
+  pg_temp.v('pub7'), pg_temp.v('fp7'), '{board:send}')));
+select is((select state from _err where label = 'no-granted-scopes'), '23505',
+  'R-11: an audit row recording NO granted scopes is owned but not resumable');
+select ok(
+  (select position(h in msg) > 0 from _err, (select handle h from _e where label = 'E7') x where label = 'no-granted-scopes'),
+  'R-11: and because ownership IS proven there, the owner is told the handle');
+
+-- ---------------------------------------------------------------------------
+-- R-12 -- the internal creator stays a hard refusal, but an actionable one
+-- ---------------------------------------------------------------------------
+select pg_temp.try('once-direct', (select format(
+  $q$select * from agent_board._enroll_federated_identity_once(%L,'message-board',%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+  pg_temp.v('iss1'), pg_temp.v('suba'),
+  jsonb_build_object('iss', pg_temp.v('iss1'), 'aud', 'message-board', 'sub', pg_temp.v('suba'))::text,
+  'res-once-' || pg_temp.v('s'), pg_temp.v('pub1'), pg_temp.v('fp1'))));
+select is((select state from _err where label = 'once-direct'), '23505',
+  'R-12: _enroll_federated_identity_once still refuses an already-enrolled key outright (no twin resumption)');
+select ok(
+  (select position(h in msg) > 0 and msg like '%need not be repeated%'
+     from _err, (select handle h from _e where label = 'E1') x where label = 'once-direct'),
+  'R-12: and its refusal now names the holder and says enrollment need not be repeated');
+
+-- ---------------------------------------------------------------------------
+-- R-13 -- the null-owner exemption, asserted POSITIVELY and in BOTH directions
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r13 ' || pg_temp.enroll_sql(
+     pg_temp.v('iss1'), pg_temp.v('suba'), 'res-8-' || pg_temp.v('s'),
+     pg_temp.v('pub8'), pg_temp.v('fp8'), '{board:send}')),
+  'R-13: a row with NO owner_user_id (pre-owner-model, the atomic-fleet backfill shape) still resumes for its owner');
+select is(
+  (select agent_id from _r13),
+  (select agent_id from _e where label = 'E8'),
+  'R-13: and it resumes to that same pre-owner-model identity');
+select pg_temp.try('null-owner-squat', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('subb'), 'res-8-squat-' || pg_temp.v('s'),
+  pg_temp.v('pub8'), pg_temp.v('fp8'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'null-owner-squat'),
+  'R-13: the exemption does NOT open a squat -- the same null-owner row refuses a different subject as one');
+
+-- ---------------------------------------------------------------------------
+-- R-14 -- the frozen scope comparison is ORDER-SENSITIVE, and that is asserted
+-- rather than assumed
+-- ---------------------------------------------------------------------------
+-- `v_replay -> 'requestedScopes' is distinct from to_jsonb(v_requested_scopes)` is a
+-- JSONB comparison and a jsonb array preserves order, so the SAME scopes in a different
+-- order are a DIFFERENT request. That is pre-existing released behaviour of the frozen
+-- contract (20260901000100), not something #176 introduced, and this migration
+-- deliberately does not loosen it. It is pinned here because the offline MockEnroll
+-- sorted its scope arrays and so disagreed with production silently; the client now
+-- asserts the same property, and neither side can drift without one of them going red.
+select pg_temp.try('frozen-scope-order', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-2-' || pg_temp.v('s'),
+  pg_temp.v('pub2'), pg_temp.v('fp2'), '{board:read,board:send}')));
+select ok(
+  (select state = '23505' and position(h in msg) > 0
+     from _err, (select handle h from _e where label = 'E2') x
+    where label = 'frozen-scope-order'),
+  'R-14: the SAME frozen scopes REORDERED are a different frozen contract and raise, naming the handle');
+
+select * from finish();
+rollback;