@consiliency/agent-board-schema 1.23.0 → 1.25.0

package/tests/agent_board_federated_lock_order_class.test.sql

@@ -86,9 +86,7 @@ fns as (
   select p.oid,
          p.proname,
          p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')' as sig,
-         regexp_replace(p.prosrc,
-           $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
-           ' ', 'g') as body,
+         agent_board_test.stripped_body(p.oid) as body,
          p.proconfig
     from pg_proc p
     join pg_namespace n on n.oid = p.pronamespace

package/tests/agent_board_fedsession_provider_absence_gate.test.sql

@@ -70,9 +70,12 @@ select is(
                 $g$raise\s+exception\s+'issuer/audience not in the identity-provider allowlist \(rejected before any owner or board lock\)'$g$)), 0) as p_gate,
               strpos(d, '_ensure_agent_auth_user') as p_ensure,
               strpos(d, substring(d from 'from\s+auth\.users[^;]{0,250}?for\s+update')) as p_lock
-         from (select regexp_replace(p.prosrc,
-                       $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
-                       '\2', 'g') as d
+         -- LITERALS KEPT (the `true`): the gate marker G-2 locates IS the raise
+         -- message, so stripping literals would delete it and the positional claim
+         -- would read 'gate-missing' forever. Comments -- including the NESTED
+         -- block comment of message-board#199, which the regex this replaced could
+         -- not see -- are still removed.
+         from (select agent_board_test.stripped_body(p.oid, true) as d
                  from pg_proc p
                  join pg_namespace n on n.oid = p.pronamespace
                 where n.nspname = 'agent_board'
@@ -159,9 +162,9 @@ select is(
      join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and p.prokind = 'f'
-      and regexp_replace(p.prosrc,
-            $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
-            '\2', 'g') ~ 'not in the identity-provider allowlist'),
+      -- LITERALS KEPT: membership in this class is defined by a function raising
+      -- that MESSAGE, so the marker is a literal by construction.
+      and agent_board_test.stripped_body(p.oid, true) ~ 'not in the identity-provider allowlist'),
   '_enroll_federated_human_after_revocation_gate, _enroll_federated_identity_once, '
   || 'enroll_federated_human, enroll_federated_identity',
   'G-8: exactly four routes reject an absent identity provider');

package/tests/agent_board_fleet_machine_reactivation.test.sql

@@ -43,7 +43,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(22);
+select plan(23);
 
 -- (1)(2) Shape.
 select has_function(
@@ -378,6 +378,30 @@ select is(
 -- CLASS (rule #1): catalog-derived — every machine-subject revocation READER honors
 -- reactivated_at; the WRITER exemption is asserted positively.
 ------------------------------------------------------------------------------------------
+-- (21a) NON-VACUITY, asserted BEFORE the class below. That class is
+-- `string_agg(offender) is null` -- so it passes just as happily when the
+-- enumeration reaches NOTHING as when every reader conforms. Found while
+-- re-deriving the strip modes for the message-board#196 review: flipping the
+-- membership predicate to a literal-stripped read empties the class (the marker
+-- `fre.subject_kind = ''machine''` has a literal operand and cannot survive it)
+-- and the file stayed 22/22 GREEN. A green that survives its own class being
+-- deleted is not evidence, so the membership set is pinned as an exact set here
+-- and a new reader NAMES ITSELF in this diff.
+select is(
+  (select
+     coalesce((select string_agg(p.proname, ', ' order by p.proname)
+                 from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+                where n.nspname = 'agent_board' and p.prokind = 'f'
+                  -- DATA literal -> case-SENSITIVE; see the rule at the offender class below
+                  and agent_board_test.stripped_body(p.oid, true) ~ 'fre\.subject_kind = ''machine'''), '(none)')
+     || ' | ' ||
+     coalesce((select string_agg(c.relname, ', ' order by c.relname)
+                 from pg_class c join pg_namespace n on n.oid = c.relnamespace
+                where n.nspname = 'agent_board' and c.relkind = 'v'
+                  and agent_board_test.stripped_viewdef(c.oid, true) ~ 'fre\.subject_kind = ''machine'''), '(none)')),
+  'evaluate_fleet_sender_policy, reactivate_fleet_machine | v_fleet_machine_status',
+  'the machine-subject revocation reader class is REACHED and is exactly these three -- the class assertion below cannot pass by finding nothing');
+
 -- (21) Enumerate readers (functions + views) whose definition tests a machine-subject
 -- revocation event (`fre.subject_kind = 'machine'`) but does NOT reference reactivated_at.
 -- Expected: none. A new non-conforming reader appears here BY NAME (rule #1: offenders name
@@ -391,16 +415,43 @@ select is(
           join pg_namespace n on n.oid = p.pronamespace
          where n.nspname = 'agent_board'
            and p.prokind = 'f'
-           and pg_get_functiondef(p.oid) ~ 'fre\.subject_kind = ''machine'''
-           and pg_get_functiondef(p.oid) not ilike '%reactivated_at%'
+           -- TWO MODES ON PURPOSE, and mixing them was a live fail-open
+           -- (message-board#196 review, red-team seat).
+           --
+           -- MEMBERSHIP (literals KEPT): the marker `fre.subject_kind = ''machine''`
+           -- has a string literal as its operand, so it cannot be located in a
+           -- literal-stripped body. This direction is fail-CLOSED anyway -- a
+           -- literal that fakes the marker ADDS an offender and reddens the
+           -- expected-empty set.
+           --
+           -- THE GUARD CHECK (literals STRIPPED): `reactivated_at` is a COLUMN
+           -- NAME, i.e. code. Read with literals kept, a reader that dropped the
+           -- guard while any literal still mentioned `reactivated_at` fell out of
+           -- the offender set and the class went 22/22 GREEN with the guard gone
+           -- (measured on evaluate_fleet_sender_policy). That is the exemption
+           -- category becoming the hole, CLAUDE.md rule 1's named trap.
+           -- CASE: this marker is compared as DATA, so it stays case-SENSITIVE.
+           -- The rule the suite now follows, and the line the round-1 `gi` sweep
+           -- got wrong here: a marker SPELLED AS CODE (a relation, function or
+           -- column name) is matched case-INSENSITIVELY, because PostgreSQL folds
+           -- unquoted identifiers and a case-sensitive scan is fail-open for a
+           -- class filter. A marker COMPARED AS DATA -- a string literal operand,
+           -- or a raise message -- stays case-SENSITIVE, because nothing folds it:
+           -- `'machine' = 'MACHINE'` is FALSE at runtime, so a `~*` here cannot
+           -- tell a working predicate from a broken one. Measured: rewriting the
+           -- live predicate to `= 'MACHINE'` -- which matches no rows -- left this
+           -- file 23/23 GREEN under `~*`.
+           and agent_board_test.stripped_body(p.oid, true) ~ 'fre\.subject_kind = ''machine'''
+           and agent_board_test.stripped_body(p.oid) not ilike '%reactivated_at%'
         union all
         select c.relname
           from pg_class c
           join pg_namespace n on n.oid = c.relnamespace
          where n.nspname = 'agent_board'
            and c.relkind = 'v'
-           and pg_get_viewdef(c.oid) ~ 'fre\.subject_kind = ''machine'''
-           and pg_get_viewdef(c.oid) not ilike '%reactivated_at%'
+           -- same split for the view half: marker keeps literals, guard does not
+           and agent_board_test.stripped_viewdef(c.oid, true) ~ 'fre\.subject_kind = ''machine'''
+           and agent_board_test.stripped_viewdef(c.oid) not ilike '%reactivated_at%'
       ) offenders
   ),
   null,

package/tests/agent_board_mint_harden.test.sql

@@ -22,7 +22,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(31);
+select plan(32);
 
 create temp table _mh (
   owner_id uuid,
@@ -119,9 +119,33 @@ select is(
       where n.nspname = 'agent_board' and p.prokind = 'f')
    select coalesce(string_agg(proname, ', ' order by proname), '')
      from fns
-    where pg_get_functiondef(oid) ~* 'insert[[:space:]]+into[[:space:]]+(agent_board\.)?agent_signing_keys'
-      and pg_get_functiondef(oid) ~ 'fingerprint'
-      and pg_get_functiondef(oid) !~ '_raw_key_fingerprint'),
+    where agent_board_test.stripped_body(oid) ~* 'insert[[:space:]]+into[[:space:]]+(agent_board\.)?agent_signing_keys'
+      -- CASE-INSENSITIVE, and that is load-bearing rather than tidiness. SQL folds
+      -- unquoted identifiers, but `prosrc` is stored VERBATIM, so a writer spelling
+      -- the same call `AGENT_BOARD.…` or the same column `FINGERPRINT` is identical
+      -- to PostgreSQL and invisible to a case-sensitive scan. For a MEMBERSHIP
+      -- filter that is the fail-OPEN direction: the offender simply leaves the
+      -- class and the expected-empty assertion stays green. (Same mechanism
+      -- agent_board_wake_recovery.test.sql records for its own WR-7 filter.)
+      and agent_board_test.stripped_body(oid) ~* 'fingerprint'
+      -- message-board#196 Bucket B, demonstrated: read RAW, ONE comment mentioning
+      -- _raw_key_fingerprint dropped the forging writer out of this set and the
+      -- file went fully green with the bypass live.
+      -- ANCHORED TO THE CALL SHAPE, not to a bare identifier substring
+      -- (message-board#196 review). `!~ '_raw_key_fingerprint'` is satisfied by ANY identifier
+      -- containing it, so a forging writer with an argument named
+      -- `p_raw_key_fingerprint` -- not even a suspicious name -- fell out of this
+      -- offender set and the file stayed green. `\m` will not match inside
+      -- `p_...` (both are word characters, so there is no boundary), and the
+      -- trailing `\(` requires an actual call rather than a mention.
+      -- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
+      -- IDENTITY: `\m_raw_key_fingerprint\s*\(` also matches
+      -- `zz_other._raw_key_fingerprint(...)` (measured true). Every live call
+      -- site in agent_board is `agent_board.`-qualified, so requiring the
+      -- qualification costs nothing today and is fail-CLOSED if someone later writes
+      -- an unqualified call (it reads as NOT calling). Overload count is pinned
+      -- separately, so schema + name is the identity.
+      and agent_board_test.stripped_body(oid) !~* '\magent_board\._raw_key_fingerprint\s*\('),
   '',
   'no agent_signing_keys.fingerprint writer bypasses _raw_key_fingerprint (catalog-derived; a new writer names itself)');
 
@@ -299,5 +323,16 @@ select ok(has_function_privilege('service_role',
   'agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean)', 'EXECUTE'),
   'service_role retains EXECUTE on mint_delegated_child');
 
+
+-- The schema-qualified call anchor above treats `agent_board._raw_key_fingerprint` as an
+-- IDENTITY. That is only true while the name resolves to exactly one function:
+-- a second overload would be a different implementation the same anchor accepts.
+-- Catalog-derived, so a new overload fails here and the count names itself.
+select is(
+  (select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_raw_key_fingerprint'),
+  1,
+  'agent_board._raw_key_fingerprint has exactly ONE overload, so the schema-qualified call anchor identifies it uniquely');
+
 select finish();
 rollback;

package/tests/agent_board_outbox_wake_ordering.test.sql

@@ -93,8 +93,13 @@ select is(
     where n.nspname = 'agent_board'
       and p.prokind = 'f'
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
-            ~ 'insert into agent_board\.callback_outbox_events'),
+      -- CODE marker -> case-INSENSITIVE. PostgreSQL folds unquoted identifiers, so
+      -- `INSERT INTO AGENT_BOARD.CALLBACK_OUTBOX_EVENTS` is the same statement and a
+      -- case-sensitive scan drops that writer OUT of this exact set -- the fail-open
+      -- direction for a class filter. Missed by the round-3 sweep because that audit
+      -- was LINE-anchored and this predicate's operator sits on the next line.
+      and agent_board_test.stripped_body(p.oid)
+            ~* 'insert into agent_board\.callback_outbox_events'),
   '_queue_board_post_callbacks, _queue_inbox_callbacks',
   'WO-3 CLASS: the catalog names exactly the two known outbox writers -- a new writer fails here and NAMES ITSELF');
 
@@ -108,9 +113,9 @@ select is(
     where n.nspname = 'agent_board'
       and p.prokind = 'f'
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+      and agent_board_test.stripped_body(p.oid)
             ~* 'insert into agent_board\.callback_outbox_events'
-      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
+      and agent_board_test.stripped_body(p.oid)
             ~* 'overriding\s+(system|user)\s+value'),
   '',
   'WO-3 CLASS: no outbox writer uses OVERRIDING SYSTEM VALUE -- the identity bypass stays closed');
@@ -119,16 +124,16 @@ select is(
 -- WO-4 ORDERING
 -- ---------------------------------------------------------------------------
 select ok(
-  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
-            ~ 'order by coe\.available_at asc, coe\.seq asc'
+  (select agent_board_test.stripped_body(p.oid)
+            ~* 'order by coe\.available_at asc, coe\.seq asc'
      from pg_proc p
      join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
   'WO-4 claim_callback_outbox_events orders candidates by (available_at, seq)');
 
 select ok(
-  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
-            !~ 'coe\.id asc'
+  (select agent_board_test.stripped_body(p.oid)
+            !~* 'coe\.id asc'
      from pg_proc p
      join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
@@ -141,8 +146,8 @@ select ok(
 -- mutation produces NO failure. A property no mutation can break is not covered, so the
 -- pin has to be stated where the mutation actually lands.
 select ok(
-  (select regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g')
-            ~ 'order by u\.seq asc'
+  (select agent_board_test.stripped_body(p.oid)
+            ~* 'order by u\.seq asc'
      from pg_proc p
      join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = 'claim_callback_outbox_events'),
@@ -201,7 +206,12 @@ select is(
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
       and p.prosecdef
-      and pg_get_functiondef(p.oid) ~ 'callback_outbox_events'
+      -- CODE marker in a CLASS FILTER -> stripped + case-INSENSITIVE, matching WO-3
+      -- above. Raw text lets a comment pull a function IN (fail-closed, a false
+      -- alarm); case-sensitivity lets a function spelling the table
+      -- `AGENT_BOARD.CALLBACK_OUTBOX_EVENTS` drop OUT, so its executability is
+      -- never checked at all -- fail-OPEN, on a privilege gate.
+      and agent_board_test.stripped_body(p.oid) ~* 'callback_outbox_events'
       and (has_function_privilege('public', p.oid, 'EXECUTE')
         or has_function_privilege('anon', p.oid, 'EXECUTE')
         or has_function_privilege('authenticated', p.oid, 'EXECUTE'))),
@@ -213,7 +223,12 @@ select is(
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
       and p.prosecdef
-      and pg_get_functiondef(p.oid) ~ 'callback_outbox_events'
+      -- CODE marker in a CLASS FILTER -> stripped + case-INSENSITIVE, matching WO-3
+      -- above. Raw text lets a comment pull a function IN (fail-closed, a false
+      -- alarm); case-sensitivity lets a function spelling the table
+      -- `AGENT_BOARD.CALLBACK_OUTBOX_EVENTS` drop OUT, so its executability is
+      -- never checked at all -- fail-OPEN, on a privilege gate.
+      and agent_board_test.stripped_body(p.oid) ~* 'callback_outbox_events'
       and not has_function_privilege('service_role', p.oid, 'EXECUTE')),
   '',
   'WO-5 CLASS: every SECURITY DEFINER function reaching callback_outbox_events is executable by service_role -- a dropped-and-recreated function that lost its grant names itself here');

package/tests/agent_board_rejectsem.test.sql

@@ -260,7 +260,7 @@ select is(pg_temp.state('b2000000-0000-4000-8000-000000000001','b1000000-0000-40
 select is(
   (select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = 'resolve_board_request'
-      and regexp_replace(pg_get_functiondef(p.oid), '--[^\n]*', '', 'g') ~ 'v_effective_state'),
+      and agent_board_test.stripped_body(p.oid) ~* 'v_effective_state'),
   1,
   'the rewrite happens in resolve_board_request, not in the shared sink');
 

package/tests/agent_board_rolereset.test.sql

@@ -28,7 +28,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(23);
+select plan(24);
 
 create temp table _rr_fixture (
   open_board uuid,
@@ -133,7 +133,17 @@ select is(
 
 -- 3. Redemption bypasses the mutator entirely, so the clamp cannot reach its preset. -
 select ok(
-  (select pg_get_functiondef(p.oid) not like '%_upsert_board_membership_state%'
+  -- anchored to the CALL shape rather than a bare `like '%…%'`: the claim is
+  -- that redemption never CALLS the mutator, and a variable or argument merely
+  -- named after it is not a call.
+      -- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
+      -- IDENTITY: `\m_upsert_board_membership_state\s*\(` also matches
+      -- `zz_other._upsert_board_membership_state(...)` (measured true). Every live call
+      -- site in agent_board is `agent_board.`-qualified, so requiring the
+      -- qualification costs nothing today and is fail-CLOSED if someone later writes
+      -- an unqualified call (it reads as NOT calling). Overload count is pinned
+      -- separately, so schema + name is the identity.
+  (select agent_board_test.stripped_body(p.oid) !~* '\magent_board\._upsert_board_membership_state\s*\('
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = '_redeem_invite_for_agent'
     limit 1),
@@ -346,6 +356,17 @@ select is(
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);
 
+
+-- The schema-qualified call anchor above treats `agent_board._upsert_board_membership_state` as an
+-- IDENTITY. That is only true while the name resolves to exactly one function:
+-- a second overload would be a different implementation the same anchor accepts.
+-- Catalog-derived, so a new overload fails here and the count names itself.
+select is(
+  (select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_upsert_board_membership_state'),
+  1,
+  'agent_board._upsert_board_membership_state has exactly ONE overload, so the schema-qualified call anchor identifies it uniquely');
+
 select finish();
 
 rollback;

package/tests/agent_board_rowid.test.sql

@@ -26,17 +26,18 @@ with defs as (
   select
     p.proname::text as proname,
     pg_get_function_identity_arguments(p.oid) as args,
-    regexp_replace(
-      regexp_replace(
-        pg_get_functiondef(p.oid),
-        E'--[^\\n]*(\\n|$)',
-        E'\\n',
-        'g'
-      ),
-      E'/\\*([^*]|\\*+[^*/])*\\*+/',
-      ' ',
-      'g'
-    ) as def
+    -- LITERALS STRIPPED, and re-derived rather than assumed. The first version of
+    -- this line kept literals "because some ORDER BY operands are literals"; that
+    -- was measured and is false for THIS view -- the derived checks over it match
+    -- `created_at desc` / `id desc`, which are code, and the whole file is 98/98
+    -- with literals stripped. Keeping them left a real, if narrow, hole: the site
+    -- set is built by splitting `def` on `;`, so a literal containing a semicolon
+    -- re-splits a statement and can drop it out of the set.
+    --
+    -- The two R-LINK-7 assertions below DO need literals (their patterns match the
+    -- operands `''removed''` / `''joined''`), and they read with `true`
+    -- individually. Verified by flipping them: they go red, assertions 12 and 13.
+    agent_board_test.stripped_body(p.oid) as def
   from pg_proc p
   join pg_namespace n on n.oid = p.pronamespace
   where n.nspname = 'agent_board'
@@ -582,7 +583,12 @@ select is(
 
 -- 12. EC-MBROWID-3 requires set-based removed standing, not one selected row.
 select ok(
-  (select regexp_replace(pg_get_functiondef(p.oid), '\s+', ' ', 'g') ~*
+  -- DATA literals in the marker (`''removed''`, `''joined''`, `''subscribed''` are
+  -- compared against column data, case-SENSITIVELY, at runtime), so this match is
+  -- case-sensitive too: `~*` cannot distinguish a live predicate from one rewritten
+  -- to `= ''REMOVED''`, which matches nothing. Same class as
+  -- agent_board_fleet_machine_reactivation.test.sql's `= ''machine''`.
+  (select regexp_replace(agent_board_test.stripped_body(p.oid, true), '\s+', ' ', 'g') ~
       'exists\s*\(\s*select\s+1\s+from\s+agent_board\.board_memberships.*membership_state\s*=\s*''removed''.*\)\s+and\s+not\s+exists\s*\(\s*select\s+1\s+from\s+agent_board\.board_memberships.*membership_state\s+in\s*\(\s*''joined''\s*,\s*''subscribed''\s*\)'
      from pg_proc p
      join pg_namespace n on n.oid = p.pronamespace
@@ -593,7 +599,12 @@ select ok(
 
 -- 13. Bootstrap must carry the same R-LINK-7 shape.
 select ok(
-  (select regexp_replace(pg_get_functiondef(p.oid), '\s+', ' ', 'g') ~*
+  -- DATA literals in the marker (`''removed''`, `''joined''`, `''subscribed''` are
+  -- compared against column data, case-SENSITIVELY, at runtime), so this match is
+  -- case-sensitive too: `~*` cannot distinguish a live predicate from one rewritten
+  -- to `= ''REMOVED''`, which matches nothing. Same class as
+  -- agent_board_fleet_machine_reactivation.test.sql's `= ''machine''`.
+  (select regexp_replace(agent_board_test.stripped_body(p.oid, true), '\s+', ' ', 'g') ~
       'not\s+exists\s*\(\s*select\s+1\s+from\s+agent_board\.board_memberships.*membership_state\s+in\s*\(\s*''joined''\s*,\s*''subscribed''\s*\).*\)\s+and\s+not\s+exists\s*\(\s*select\s+1\s+from\s+agent_board\.board_memberships.*membership_state\s*=\s*''removed'''
      from pg_proc p
      join pg_namespace n on n.oid = p.pronamespace

package/tests/agent_board_scoped_send_regrant.test.sql

@@ -128,13 +128,17 @@ select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);
 
 -- 6. Portal-offline static: no send RPC body references a Portal issuer / JWKS. -----
+-- LITERALS KEPT on both of these: a Portal issuer or JWKS URL would appear as a
+-- string LITERAL in the body, so the literal-stripping mode would delete exactly
+-- what the claim is looking for and both would pass forever. Comments are still
+-- stripped, so a `-- no portal here` note can no longer satisfy them.
 select ok(
-  position('portal' in lower(pg_get_functiondef(
-    'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure))) = 0,
+  position('portal' in lower(agent_board_test.stripped_body(
+    'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure, true))) = 0,
   'post_board_message references no Portal issuer/URL');
 select ok(
-  position('jwks' in lower(pg_get_functiondef(
-    'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure))) = 0,
+  position('jwks' in lower(agent_board_test.stripped_body(
+    'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure, true))) = 0,
   'post_board_message references no JWKS');
 
 select finish();