@consiliency/agent-board-schema 1.24.0 → 1.25.0

package/tests/agent_board_enroll_resumption.test.sql

@@ -0,0 +1,412 @@
+-- Consiliency/message-board#176 pgTAP: OWNER-SCOPED ENROLL RESUMPTION.
+--
+-- The live failure: /enroll committed an identity, post-enroll provisioning failed, the
+-- client reported total failure, and every retry was then refused forever with
+-- `23505 this signing key is already enrolled`. 20260901000100's replay wrapper resumes
+-- only rows carrying its own `metadata.federation.replay` STAMP -- which the trapped
+-- enrollments, created before it shipped, do not have. 20260906000100 decides resumption
+-- from evidence written at the ORIGINAL enrollment instead, so an unstamped row resumes
+-- too.
+--
+-- Both directions are pinned here, and the SECURITY direction is the one that matters:
+--   * same verified (issuer, subject) -> the existing identity is RETURNED (R-1, R-2);
+--   * a DIFFERENT principal -> still raises, and the message names no handle (R-3, R-4).
+-- Every allow-side assertion is `lives_ok(...)` followed by a separate state check, never
+-- a bare `is((select ... from rpc(...)), ...)`, which aborts instead of failing (#113).
+--
+-- Failing calls are executed through pg_temp.try(), a BEGIN/EXCEPTION subtransaction that
+-- records (sqlstate, message) into `_err` and records an explicit '00000 / (no error
+-- raised)' row when the call SUCCEEDS -- so "the raise disappeared" fails an assertion
+-- rather than silently matching nothing.
+--
+-- EC-1/EC-2 are the class assertions: the route class is enumerated from pg_proc, not
+-- from a list written here, so a new fingerprint-accepting route or a new signing-key
+-- creator fails and NAMES ITSELF.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(35);
+
+-- ---------------------------------------------------------------------------
+-- Fixtures
+-- ---------------------------------------------------------------------------
+create temp table _v (name text primary key, val text) on commit drop;
+create temp table _e (
+  label text, agent_id uuid, auth_user_id uuid, provider_id text, signing_key_id uuid,
+  granted text[], key_id text, key_version int, handle text, invite_redeemed boolean
+) on commit drop;
+create temp table _err (label text primary key, state text, msg text) on commit drop;
+
+-- The four resumption RESULTS, declared UP FRONT with the RETURNS TABLE shape rather
+-- than created by `create temp table ... as <the call>`. If the call under test raises,
+-- `lives_ok` records the failure and the CTAS form would leave the table MISSING -- so
+-- every following assertion would abort the transaction instead of failing, and pgTAP
+-- would emit fewer assertions than the plan with no `not ok` to read (#113). Declared
+-- empty, those assertions return NULL and fail honestly.
+create temp table _r1 (
+  agent_id uuid, auth_user_id uuid, provider_id text, signing_key_id uuid,
+  granted_scopes text[], key_id text, key_version int, agent_handle text,
+  invite_redeemed boolean
+) on commit drop;
+create temp table _r2 (like _r1) on commit drop;
+create temp table _r6 (like _r1) on commit drop;
+create temp table _r13 (like _r1) on commit drop;
+
+
+create function pg_temp.v(p_name text) returns text language sql stable as
+$$ select val from _v where name = p_name $$;
+
+-- The exact /enroll call, as SQL text. `p_actor_sub` is null and the kind is 'agent'
+-- throughout, so the only inputs that vary across cases are the ones under test.
+create function pg_temp.enroll_sql(
+  p_iss text, p_sub text, p_slug text, p_pub text, p_fp text, p_scopes text default '{board:send}'
+) returns text language sql stable as
+$$
+  select format(
+    $q$select * from agent_board.enroll_federated_identity(%L,'message-board',%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent',%L,'{}')$q$,
+    p_iss, p_sub,
+    jsonb_build_object('iss', p_iss, 'aud', 'message-board', 'sub', p_sub)::text,
+    p_slug, p_pub, p_fp, p_scopes)
+$$;
+
+-- Run a call that is EXPECTED to raise, capturing sqlstate + message. A call that does
+-- NOT raise records '00000', so a vanished raise fails loudly instead of matching an
+-- absent row.
+create function pg_temp.try(p_label text, p_sql text) returns void language plpgsql as
+$$
+begin
+  begin
+    execute p_sql;
+    insert into _err values (p_label, '00000', '(no error raised)');
+  exception when others then
+    insert into _err values (p_label, sqlstate, sqlerrm);
+  end;
+end
+$$;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_iss1 text := 'https://res-a-' || replace(substr(gen_random_uuid()::text, 1, 8), '-', '') || '.test';
+  v_iss2 text;
+  v_pub text;
+  i int;
+begin
+  v_iss1 := 'https://res-a-' || s || '.test';
+  v_iss2 := 'https://res-b-' || s || '.test';
+
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values
+    (v_iss1, 'message-board', true, true, '{board:send,board:read}', '{board:x}', '{agent,human}'),
+    (v_iss2, 'message-board', true, true, '{board:send,board:read}', '{board:x}', '{agent,human}');
+
+  insert into _v values
+    ('s', s), ('iss1', v_iss1), ('iss2', v_iss2),
+    ('suba', 'portal|a-' || s), ('subb', 'portal|b-' || s);
+
+  -- Eight real Ed25519-shaped keys: 32 random bytes re-encoded through the SAME
+  -- canonical base64url form the enroll contract requires, and their in-DB fingerprints.
+  for i in 1..8 loop
+    v_pub := rtrim(translate(encode(gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+    insert into _v values ('pub' || i, v_pub), ('fp' || i, agent_board._raw_key_fingerprint(v_pub));
+  end loop;
+end
+$$;
+
+-- Eight enrollments. E1/E3..E8 are then stripped of their replay stamp, which is exactly
+-- the state every identity enrolled before 20260901000100 is in -- the #176 victim's
+-- state. E2 keeps its stamp.
+do $$
+declare
+  i int;
+  v_slug text;
+begin
+  for i in 1..8 loop
+    v_slug := 'res-' || i || '-' || pg_temp.v('s');
+    -- E2 is the STAMPED fixture and the only one that needs two scopes: the frozen
+    -- contract compares them as JSONB, which preserves ORDER, and R-14 pins that.
+    execute format('insert into _e select %L, * from (%s) t', 'E' || i,
+      pg_temp.enroll_sql(pg_temp.v('iss1'), pg_temp.v('suba'), v_slug,
+                         pg_temp.v('pub' || i), pg_temp.v('fp' || i),
+                         case when i = 2 then '{board:send,board:read}' else '{board:send}' end));
+  end loop;
+
+  update agent_board.agents a
+     set metadata = a.metadata #- '{federation,replay}'
+   where a.id in (select agent_id from _e where label <> 'E2');
+
+  -- E3: owned, unstamped, but the agent is revoked -> must NOT be revived by resumption.
+  update agent_board.agents a set status = 'revoked' where a.id = (select agent_id from _e where label = 'E3');
+
+  -- E4: evidence (i) broken -- owner_user_id repointed at an unrelated auth user.
+  update agent_board.agents a
+     set owner_user_id = agent_board._ensure_agent_auth_user('res-unrelated-owner-' || pg_temp.v('s'))
+   where a.id = (select agent_id from _e where label = 'E4');
+
+  -- E5: evidence (ii) broken -- the creation-time federation subject is gone.
+  update agent_board.agents a
+     set metadata = a.metadata #- '{federation,subject}'
+   where a.id = (select agent_id from _e where label = 'E5');
+
+  -- E6: evidence (iii) broken -- the original enrollment's audit row is gone.
+  delete from agent_board.enrollment_federation_audit e
+   where e.agent_id = (select agent_id from _e where label = 'E6');
+
+  -- E7: audit row present but recording no granted scopes -> ownership holds, the
+  -- identity is not resumable. This is what makes branch (b) reachable rather than
+  -- implied by the ownership conjunction.
+  update agent_board.enrollment_federation_audit e
+     set granted_scopes = null
+   where e.agent_id = (select agent_id from _e where label = 'E7');
+
+  -- E8: the ONE exemption in the ownership conjunction, modelled on the atomic-fleet
+  -- backfill fixture -- an agent that predates the owner model and carries NO
+  -- owner_user_id. Evidence (i) is unavailable there rather than contradicted.
+  update agent_board.agents a set owner_user_id = null
+   where a.id = (select agent_id from _e where label = 'E8');
+end
+$$;
+
+-- ---------------------------------------------------------------------------
+-- EC-1/EC-2 -- the class, enumerated from the catalog
+-- ---------------------------------------------------------------------------
+
+-- Every route a client can re-present an enrolled key to, taken from pg_proc.proargnames.
+-- A fourth such route added later fails this and names itself in the diff.
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proargnames && array['p_agent_public_key_fingerprint']),
+  '_enroll_federated_identity_once, enroll_federated_identity, onboard_federated_fleet_agent',
+  'EC-1: exactly three agent_board routes accept an enrolled key fingerprint (pg_proc-derived)');
+
+-- ...and only two functions in the whole schema can CREATE a signing key, so
+-- onboard_federated_fleet_agent necessarily reaches an already-enrolled key through
+-- enroll_federated_identity rather than deciding the duplicate case itself.
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prokind = 'f'
+      and agent_board_test.strip_sql(p.prosrc) ~* 'insert into agent_board\.agent_signing_keys'),
+  '_enroll_federated_identity_once, mint_delegated_child',
+  'EC-2: only the enroll creator and delegated-child mint insert signing keys (strip_sql-derived)');
+
+-- ---------------------------------------------------------------------------
+-- R-1 -- THE #176 FIX: an unstamped enrollment resumes for its owner
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r1 ' || pg_temp.enroll_sql(
+     pg_temp.v('iss1'), pg_temp.v('suba'), 'res-1-' || pg_temp.v('s'),
+     pg_temp.v('pub1'), pg_temp.v('fp1'), '{board:send}')),
+  'R-1: re-presenting an already-enrolled key as the same verified (issuer, subject) SUCCEEDS (unstamped row)');
+select is(
+  (select agent_id from _r1),
+  (select agent_id from _e where label = 'E1'),
+  'R-1: the resumption returns the EXISTING agent identity');
+select is(
+  (select signing_key_id from _r1),
+  (select signing_key_id from _e where label = 'E1'),
+  'R-1: the resumption returns the EXISTING signing key, not a new one');
+select is(
+  (select agent_handle from _r1),
+  (select handle from _e where label = 'E1'),
+  'R-1: the resumption returns the server-assigned handle the client lost');
+select is(
+  (select provider_id from _r1),
+  (select provider_id from _e where label = 'E1'),
+  'R-1: provider_id survives the unstamped path (it is read from the creation-time federation object)');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k where k.fingerprint = pg_temp.v('fp1')),
+  1, 'R-1: the resumption enrolled no second key for that fingerprint');
+select is(
+  (select count(*)::int from agent_board.agents a where a.id in (select agent_id from _e) or a.handle like 'res-1-%'),
+  8, 'R-1: the resumption created no ninth agent');
+
+-- ---------------------------------------------------------------------------
+-- R-2 -- an unstamped resumption cannot ESCALATE
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r2 ' || pg_temp.enroll_sql(
+     pg_temp.v('iss1'), pg_temp.v('suba'), 'res-1-different-slug',
+     pg_temp.v('pub1'), pg_temp.v('fp1'), '{board:send,board:read}')),
+  'R-2: an unstamped resumption tolerates a different slug and a wider scope request');
+select is(
+  (select granted_scopes from _r2),
+  '{board:send}'::text[],
+  'R-2: it returns the ORIGINAL granted scopes -- the wider request grants nothing');
+select is(
+  (select agent_id from _r2),
+  (select agent_id from _e where label = 'E1'),
+  'R-2: and it still returns the original identity, not a second one');
+
+-- ---------------------------------------------------------------------------
+-- R-3 / R-4 -- THE SECURITY DIRECTION: a different principal is still refused
+-- ---------------------------------------------------------------------------
+select pg_temp.try('squat-subject', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('subb'), 'res-squat-' || pg_temp.v('s'),
+  pg_temp.v('pub1'), pg_temp.v('fp1'), '{board:send}')));
+-- sqlstate ALONE does not pin this: with the ownership refusal bypassed the request
+-- falls through to the state gate, which raises the SAME 23505 for its own reason. The
+-- assertion therefore requires the OWNERSHIP refusal specifically.
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'squat-subject'),
+  'R-3: a key owned by a DIFFERENT subject at the same issuer is refused AS a different principal (23505)');
+select ok(
+  (select position(h in msg) = 0 from _err, (select handle h from _e where label = 'E1') x where label = 'squat-subject'),
+  'R-3: the refusal names NO handle -- a squatter learns nothing about who holds the key');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k where k.fingerprint = pg_temp.v('fp1')),
+  1, 'R-3: the refused squat left exactly one key on that fingerprint');
+
+select pg_temp.try('squat-issuer', (select pg_temp.enroll_sql(
+  pg_temp.v('iss2'), pg_temp.v('suba'), 'res-squat2-' || pg_temp.v('s'),
+  pg_temp.v('pub1'), pg_temp.v('fp1'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'squat-issuer'),
+  'R-4: the same subject at a DIFFERENT approved issuer is refused as a different principal');
+select ok(
+  (select position(h in msg) = 0 from _err, (select handle h from _e where label = 'E1') x where label = 'squat-issuer'),
+  'R-4: that refusal names no handle either');
+
+-- ---------------------------------------------------------------------------
+-- R-5 / R-6 -- a STAMPED enrollment keeps its frozen contract; only the message improves
+-- ---------------------------------------------------------------------------
+select pg_temp.try('frozen', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-2-renamed',
+  pg_temp.v('pub2'), pg_temp.v('fp2'), '{board:send,board:read}')));
+select is((select state from _err where label = 'frozen'), '23505',
+  'R-5: a stamped enrollment re-presented by its owner with a DIFFERENT slug still raises (frozen contract intact)');
+select ok(
+  (select position(h in msg) > 0 from _err, (select handle h from _e where label = 'E2') x where label = 'frozen'),
+  'R-5: but the message now NAMES the existing handle');
+select ok(
+  (select msg like '%need not be repeated%' from _err where label = 'frozen'),
+  'R-5: and says enrollment need not be repeated -- the actionable half of the ask');
+
+select lives_ok(
+  (select 'insert into _r6 ' || pg_temp.enroll_sql(
+     pg_temp.v('iss1'), pg_temp.v('suba'), 'res-2-' || pg_temp.v('s'),
+     pg_temp.v('pub2'), pg_temp.v('fp2'), '{board:send,board:read}')),
+  'R-6: an EXACT stamped replay still succeeds (the released path is unregressed)');
+select is(
+  (select agent_id from _r6),
+  (select agent_id from _e where label = 'E2'),
+  'R-6: and still returns the original identity');
+
+-- ---------------------------------------------------------------------------
+-- R-7 -- resumption never revives an identity that is not usable
+-- ---------------------------------------------------------------------------
+select pg_temp.try('revoked', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-3-' || pg_temp.v('s'),
+  pg_temp.v('pub3'), pg_temp.v('fp3'), '{board:send}')));
+select is((select state from _err where label = 'revoked'), '23505',
+  'R-7: an owned but REVOKED identity is not resumable');
+select ok(
+  (select position(h in msg) > 0 from _err, (select handle h from _e where label = 'E3') x where label = 'revoked'),
+  'R-7: its owner is told which handle is stuck');
+
+-- ---------------------------------------------------------------------------
+-- R-8/R-9/R-10 -- each of the three ownership evidences is load-bearing
+-- ---------------------------------------------------------------------------
+select pg_temp.try('no-owner-match', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-4-' || pg_temp.v('s'),
+  pg_temp.v('pub4'), pg_temp.v('fp4'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'no-owner-match'),
+  'R-8: evidence (i) -- owner_user_id not equal to the derived owner reads as NOT owned');
+
+select pg_temp.try('no-creation-stamp', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-5-' || pg_temp.v('s'),
+  pg_temp.v('pub5'), pg_temp.v('fp5'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'no-creation-stamp'),
+  'R-9: evidence (ii) -- a missing creation-time federation subject reads as NOT owned (null is not a pass)');
+
+select pg_temp.try('no-audit-row', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-6-' || pg_temp.v('s'),
+  pg_temp.v('pub6'), pg_temp.v('fp6'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'no-audit-row'),
+  'R-10: evidence (iii) -- a missing enrollment audit row reads as NOT owned');
+
+-- ---------------------------------------------------------------------------
+-- R-11 -- branch (b) is reachable on its own, not merely implied by ownership
+-- ---------------------------------------------------------------------------
+select pg_temp.try('no-granted-scopes', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-7-' || pg_temp.v('s'),
+  pg_temp.v('pub7'), pg_temp.v('fp7'), '{board:send}')));
+select is((select state from _err where label = 'no-granted-scopes'), '23505',
+  'R-11: an audit row recording NO granted scopes is owned but not resumable');
+select ok(
+  (select position(h in msg) > 0 from _err, (select handle h from _e where label = 'E7') x where label = 'no-granted-scopes'),
+  'R-11: and because ownership IS proven there, the owner is told the handle');
+
+-- ---------------------------------------------------------------------------
+-- R-12 -- the internal creator stays a hard refusal, but an actionable one
+-- ---------------------------------------------------------------------------
+select pg_temp.try('once-direct', (select format(
+  $q$select * from agent_board._enroll_federated_identity_once(%L,'message-board',%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+  pg_temp.v('iss1'), pg_temp.v('suba'),
+  jsonb_build_object('iss', pg_temp.v('iss1'), 'aud', 'message-board', 'sub', pg_temp.v('suba'))::text,
+  'res-once-' || pg_temp.v('s'), pg_temp.v('pub1'), pg_temp.v('fp1'))));
+select is((select state from _err where label = 'once-direct'), '23505',
+  'R-12: _enroll_federated_identity_once still refuses an already-enrolled key outright (no twin resumption)');
+select ok(
+  (select position(h in msg) > 0 and msg like '%need not be repeated%'
+     from _err, (select handle h from _e where label = 'E1') x where label = 'once-direct'),
+  'R-12: and its refusal now names the holder and says enrollment need not be repeated');
+
+-- ---------------------------------------------------------------------------
+-- R-13 -- the null-owner exemption, asserted POSITIVELY and in BOTH directions
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r13 ' || pg_temp.enroll_sql(
+     pg_temp.v('iss1'), pg_temp.v('suba'), 'res-8-' || pg_temp.v('s'),
+     pg_temp.v('pub8'), pg_temp.v('fp8'), '{board:send}')),
+  'R-13: a row with NO owner_user_id (pre-owner-model, the atomic-fleet backfill shape) still resumes for its owner');
+select is(
+  (select agent_id from _r13),
+  (select agent_id from _e where label = 'E8'),
+  'R-13: and it resumes to that same pre-owner-model identity');
+select pg_temp.try('null-owner-squat', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('subb'), 'res-8-squat-' || pg_temp.v('s'),
+  pg_temp.v('pub8'), pg_temp.v('fp8'), '{board:send}')));
+select ok(
+  (select state = '23505' and msg like '%to a different principal%'
+     from _err where label = 'null-owner-squat'),
+  'R-13: the exemption does NOT open a squat -- the same null-owner row refuses a different subject as one');
+
+-- ---------------------------------------------------------------------------
+-- R-14 -- the frozen scope comparison is ORDER-SENSITIVE, and that is asserted
+-- rather than assumed
+-- ---------------------------------------------------------------------------
+-- `v_replay -> 'requestedScopes' is distinct from to_jsonb(v_requested_scopes)` is a
+-- JSONB comparison and a jsonb array preserves order, so the SAME scopes in a different
+-- order are a DIFFERENT request. That is pre-existing released behaviour of the frozen
+-- contract (20260901000100), not something #176 introduced, and this migration
+-- deliberately does not loosen it. It is pinned here because the offline MockEnroll
+-- sorted its scope arrays and so disagreed with production silently; the client now
+-- asserts the same property, and neither side can drift without one of them going red.
+select pg_temp.try('frozen-scope-order', (select pg_temp.enroll_sql(
+  pg_temp.v('iss1'), pg_temp.v('suba'), 'res-2-' || pg_temp.v('s'),
+  pg_temp.v('pub2'), pg_temp.v('fp2'), '{board:read,board:send}')));
+select ok(
+  (select state = '23505' and position(h in msg) > 0
+     from _err, (select handle h from _e where label = 'E2') x
+    where label = 'frozen-scope-order'),
+  'R-14: the SAME frozen scopes REORDERED are a different frozen contract and raise, naming the handle');
+
+select * from finish();
+rollback;

package/tests/agent_board_federated_lock_order_class.test.sql

@@ -86,9 +86,7 @@ fns as (
   select p.oid,
          p.proname,
          p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')' as sig,
-         regexp_replace(p.prosrc,
-           $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
-           ' ', 'g') as body,
+         agent_board_test.stripped_body(p.oid) as body,
          p.proconfig
     from pg_proc p
     join pg_namespace n on n.oid = p.pronamespace

package/tests/agent_board_fedsession_provider_absence_gate.test.sql

@@ -70,9 +70,12 @@ select is(
                 $g$raise\s+exception\s+'issuer/audience not in the identity-provider allowlist \(rejected before any owner or board lock\)'$g$)), 0) as p_gate,
               strpos(d, '_ensure_agent_auth_user') as p_ensure,
               strpos(d, substring(d from 'from\s+auth\.users[^;]{0,250}?for\s+update')) as p_lock
-         from (select regexp_replace(p.prosrc,
-                       $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
-                       '\2', 'g') as d
+         -- LITERALS KEPT (the `true`): the gate marker G-2 locates IS the raise
+         -- message, so stripping literals would delete it and the positional claim
+         -- would read 'gate-missing' forever. Comments -- including the NESTED
+         -- block comment of message-board#199, which the regex this replaced could
+         -- not see -- are still removed.
+         from (select agent_board_test.stripped_body(p.oid, true) as d
                  from pg_proc p
                  join pg_namespace n on n.oid = p.pronamespace
                 where n.nspname = 'agent_board'
@@ -159,9 +162,9 @@ select is(
      join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and p.prokind = 'f'
-      and regexp_replace(p.prosrc,
-            $re$(\$[A-Za-z_0-9]*\$).*?\1|('([^']|'')*')|(--[^\n]*)|(/\*([^*]|\*+[^*/])*\*+/)$re$,
-            '\2', 'g') ~ 'not in the identity-provider allowlist'),
+      -- LITERALS KEPT: membership in this class is defined by a function raising
+      -- that MESSAGE, so the marker is a literal by construction.
+      and agent_board_test.stripped_body(p.oid, true) ~ 'not in the identity-provider allowlist'),
   '_enroll_federated_human_after_revocation_gate, _enroll_federated_identity_once, '
   || 'enroll_federated_human, enroll_federated_identity',
   'G-8: exactly four routes reject an absent identity provider');

package/tests/agent_board_fleet_machine_reactivation.test.sql

@@ -43,7 +43,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(22);
+select plan(23);
 
 -- (1)(2) Shape.
 select has_function(
@@ -378,6 +378,30 @@ select is(
 -- CLASS (rule #1): catalog-derived — every machine-subject revocation READER honors
 -- reactivated_at; the WRITER exemption is asserted positively.
 ------------------------------------------------------------------------------------------
+-- (21a) NON-VACUITY, asserted BEFORE the class below. That class is
+-- `string_agg(offender) is null` -- so it passes just as happily when the
+-- enumeration reaches NOTHING as when every reader conforms. Found while
+-- re-deriving the strip modes for the message-board#196 review: flipping the
+-- membership predicate to a literal-stripped read empties the class (the marker
+-- `fre.subject_kind = ''machine''` has a literal operand and cannot survive it)
+-- and the file stayed 22/22 GREEN. A green that survives its own class being
+-- deleted is not evidence, so the membership set is pinned as an exact set here
+-- and a new reader NAMES ITSELF in this diff.
+select is(
+  (select
+     coalesce((select string_agg(p.proname, ', ' order by p.proname)
+                 from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+                where n.nspname = 'agent_board' and p.prokind = 'f'
+                  -- DATA literal -> case-SENSITIVE; see the rule at the offender class below
+                  and agent_board_test.stripped_body(p.oid, true) ~ 'fre\.subject_kind = ''machine'''), '(none)')
+     || ' | ' ||
+     coalesce((select string_agg(c.relname, ', ' order by c.relname)
+                 from pg_class c join pg_namespace n on n.oid = c.relnamespace
+                where n.nspname = 'agent_board' and c.relkind = 'v'
+                  and agent_board_test.stripped_viewdef(c.oid, true) ~ 'fre\.subject_kind = ''machine'''), '(none)')),
+  'evaluate_fleet_sender_policy, reactivate_fleet_machine | v_fleet_machine_status',
+  'the machine-subject revocation reader class is REACHED and is exactly these three -- the class assertion below cannot pass by finding nothing');
+
 -- (21) Enumerate readers (functions + views) whose definition tests a machine-subject
 -- revocation event (`fre.subject_kind = 'machine'`) but does NOT reference reactivated_at.
 -- Expected: none. A new non-conforming reader appears here BY NAME (rule #1: offenders name
@@ -391,16 +415,43 @@ select is(
           join pg_namespace n on n.oid = p.pronamespace
          where n.nspname = 'agent_board'
            and p.prokind = 'f'
-           and pg_get_functiondef(p.oid) ~ 'fre\.subject_kind = ''machine'''
-           and pg_get_functiondef(p.oid) not ilike '%reactivated_at%'
+           -- TWO MODES ON PURPOSE, and mixing them was a live fail-open
+           -- (message-board#196 review, red-team seat).
+           --
+           -- MEMBERSHIP (literals KEPT): the marker `fre.subject_kind = ''machine''`
+           -- has a string literal as its operand, so it cannot be located in a
+           -- literal-stripped body. This direction is fail-CLOSED anyway -- a
+           -- literal that fakes the marker ADDS an offender and reddens the
+           -- expected-empty set.
+           --
+           -- THE GUARD CHECK (literals STRIPPED): `reactivated_at` is a COLUMN
+           -- NAME, i.e. code. Read with literals kept, a reader that dropped the
+           -- guard while any literal still mentioned `reactivated_at` fell out of
+           -- the offender set and the class went 22/22 GREEN with the guard gone
+           -- (measured on evaluate_fleet_sender_policy). That is the exemption
+           -- category becoming the hole, CLAUDE.md rule 1's named trap.
+           -- CASE: this marker is compared as DATA, so it stays case-SENSITIVE.
+           -- The rule the suite now follows, and the line the round-1 `gi` sweep
+           -- got wrong here: a marker SPELLED AS CODE (a relation, function or
+           -- column name) is matched case-INSENSITIVELY, because PostgreSQL folds
+           -- unquoted identifiers and a case-sensitive scan is fail-open for a
+           -- class filter. A marker COMPARED AS DATA -- a string literal operand,
+           -- or a raise message -- stays case-SENSITIVE, because nothing folds it:
+           -- `'machine' = 'MACHINE'` is FALSE at runtime, so a `~*` here cannot
+           -- tell a working predicate from a broken one. Measured: rewriting the
+           -- live predicate to `= 'MACHINE'` -- which matches no rows -- left this
+           -- file 23/23 GREEN under `~*`.
+           and agent_board_test.stripped_body(p.oid, true) ~ 'fre\.subject_kind = ''machine'''
+           and agent_board_test.stripped_body(p.oid) not ilike '%reactivated_at%'
         union all
         select c.relname
           from pg_class c
           join pg_namespace n on n.oid = c.relnamespace
          where n.nspname = 'agent_board'
            and c.relkind = 'v'
-           and pg_get_viewdef(c.oid) ~ 'fre\.subject_kind = ''machine'''
-           and pg_get_viewdef(c.oid) not ilike '%reactivated_at%'
+           -- same split for the view half: marker keeps literals, guard does not
+           and agent_board_test.stripped_viewdef(c.oid, true) ~ 'fre\.subject_kind = ''machine'''
+           and agent_board_test.stripped_viewdef(c.oid) not ilike '%reactivated_at%'
       ) offenders
   ),
   null,

package/tests/agent_board_mint_harden.test.sql

@@ -22,7 +22,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(31);
+select plan(32);
 
 create temp table _mh (
   owner_id uuid,
@@ -119,9 +119,33 @@ select is(
       where n.nspname = 'agent_board' and p.prokind = 'f')
    select coalesce(string_agg(proname, ', ' order by proname), '')
      from fns
-    where pg_get_functiondef(oid) ~* 'insert[[:space:]]+into[[:space:]]+(agent_board\.)?agent_signing_keys'
-      and pg_get_functiondef(oid) ~ 'fingerprint'
-      and pg_get_functiondef(oid) !~ '_raw_key_fingerprint'),
+    where agent_board_test.stripped_body(oid) ~* 'insert[[:space:]]+into[[:space:]]+(agent_board\.)?agent_signing_keys'
+      -- CASE-INSENSITIVE, and that is load-bearing rather than tidiness. SQL folds
+      -- unquoted identifiers, but `prosrc` is stored VERBATIM, so a writer spelling
+      -- the same call `AGENT_BOARD.…` or the same column `FINGERPRINT` is identical
+      -- to PostgreSQL and invisible to a case-sensitive scan. For a MEMBERSHIP
+      -- filter that is the fail-OPEN direction: the offender simply leaves the
+      -- class and the expected-empty assertion stays green. (Same mechanism
+      -- agent_board_wake_recovery.test.sql records for its own WR-7 filter.)
+      and agent_board_test.stripped_body(oid) ~* 'fingerprint'
+      -- message-board#196 Bucket B, demonstrated: read RAW, ONE comment mentioning
+      -- _raw_key_fingerprint dropped the forging writer out of this set and the
+      -- file went fully green with the bypass live.
+      -- ANCHORED TO THE CALL SHAPE, not to a bare identifier substring
+      -- (message-board#196 review). `!~ '_raw_key_fingerprint'` is satisfied by ANY identifier
+      -- containing it, so a forging writer with an argument named
+      -- `p_raw_key_fingerprint` -- not even a suspicious name -- fell out of this
+      -- offender set and the file stayed green. `\m` will not match inside
+      -- `p_...` (both are word characters, so there is no boundary), and the
+      -- trailing `\(` requires an actual call rather than a mention.
+      -- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
+      -- IDENTITY: `\m_raw_key_fingerprint\s*\(` also matches
+      -- `zz_other._raw_key_fingerprint(...)` (measured true). Every live call
+      -- site in agent_board is `agent_board.`-qualified, so requiring the
+      -- qualification costs nothing today and is fail-CLOSED if someone later writes
+      -- an unqualified call (it reads as NOT calling). Overload count is pinned
+      -- separately, so schema + name is the identity.
+      and agent_board_test.stripped_body(oid) !~* '\magent_board\._raw_key_fingerprint\s*\('),
   '',
   'no agent_signing_keys.fingerprint writer bypasses _raw_key_fingerprint (catalog-derived; a new writer names itself)');
 
@@ -299,5 +323,16 @@ select ok(has_function_privilege('service_role',
   'agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean)', 'EXECUTE'),
   'service_role retains EXECUTE on mint_delegated_child');
 
+
+-- The schema-qualified call anchor above treats `agent_board._raw_key_fingerprint` as an
+-- IDENTITY. That is only true while the name resolves to exactly one function:
+-- a second overload would be a different implementation the same anchor accepts.
+-- Catalog-derived, so a new overload fails here and the count names itself.
+select is(
+  (select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_raw_key_fingerprint'),
+  1,
+  'agent_board._raw_key_fingerprint has exactly ONE overload, so the schema-qualified call anchor identifies it uniquely');
+
 select finish();
 rollback;