@consiliency/agent-board-schema 1.24.0 → 1.27.0

package/tests/agent_board_signer_lifecycle.test.sql

@@ -0,0 +1,709 @@
+-- #269 pgTAP: signer-lifecycle revalidation for the two signed AUTHORITY wrappers.
+--
+-- The claim under test: the gateway decision must say the signature VERIFIED, and at MUTATION
+-- time — not at the earlier moment Portal verified it — the decision's signer must still be an
+-- active agent, and the signing key the decision names must still exist, belong to THAT agent,
+-- be active and unexpired.
+--
+-- The verification half (section 4b) was added after the lifecycle half shipped, because
+-- nothing in the chain asked for the VERDICT: a decision naming a live signer and a live key
+-- but carrying verification_status='failed' completed the authority mutation and recorded
+-- 'failed' in the evidence row beside it. The accepted set is exactly {'verified'}; 'observed'
+-- and 'warn' label UNSIGNED writes accepted under those enforcement modes
+-- (specs/agent-provenance-signing.md:258-259), not weaker verifications.
+--
+-- What this file can and cannot reach. A pgTAP file runs in ONE transaction, so it can prove
+-- the PREDICATE (a suspended signer is refused) but structurally cannot produce the
+-- interleaving the issue is about (a revocation committing between two calls) or the row
+-- locks that serialize it. Those live in tests/isolation/specs/signer_lifecycle_revoke.spec,
+-- driven by isolationtester across committed sessions.
+--
+-- Methodology, inherited from agent_board_signed_authority_provenance.test.sql:
+--   * RPC probes are driven by the JWT claim blob only; SET LOCAL ROLE is never used, since
+--     it would revoke _is_service_role() and mask the gateway branch behind a permission
+--     error on the function itself.
+--   * Allow-side probes are lives_ok(...) then a SEPARATE state check. A bare
+--     `select ... from <raising rpc>(...)` ABORTS the transaction instead of failing it,
+--     silently dropping every later assertion (#113, CLAUDE.md rule 3).
+--   * Every refusal probe is followed by a state check, because a gate that raises AND writes
+--     is the failure mode a throws_ok alone cannot see.
+--   * The class assertions at the end are catalog-derived (pg_proc + stripped_body), not a
+--     list written here, so a NEW signed authority wrapper that forgets the revalidation
+--     fails and NAMES ITSELF (CLAUDE.md rule 1). The five exempt wrappers are asserted
+--     POSITIVELY — by the non-authority write each of them actually performs — never by the
+--     absence of a match.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(48);
+
+create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role','authenticated','sub',p_sub)::text, true);
+end $$;
+create function pg_temp.service() returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', '', true);
+end $$;
+
+-- Fixture -------------------------------------------------------------------
+-- agent 1 = board owner and the signer the gateway verifies
+-- agent 2 = grantee, an active member
+-- agent 3 = another member, holder of a perfectly live key that is NOT agent 1's
+
+insert into auth.users(id, instance_id, aud, role, email)
+select ('26900000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid,
+       '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+       'k269u'||n||'@t.test'
+from generate_series(1,3) n;
+
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+select ('26910000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid,
+       'agent','agent','k269-agent-'||n,'K269 Agent '||n,'active',
+       ('26900000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid
+from generate_series(1,3) n;
+
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+values ('26920000-0000-4000-8000-000000000001','k269-board','K269 Board',
+        '26910000-0000-4000-8000-000000000001'::uuid, 'private','active');
+
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+values
+  ('26920000-0000-4000-8000-000000000001','26910000-0000-4000-8000-000000000001','owner','joined','26910000-0000-4000-8000-000000000001'),
+  ('26920000-0000-4000-8000-000000000001','26910000-0000-4000-8000-000000000002','member','joined','26910000-0000-4000-8000-000000000001'),
+  ('26920000-0000-4000-8000-000000000001','26910000-0000-4000-8000-000000000003','member','joined','26910000-0000-4000-8000-000000000001');
+
+-- KEY A: agent 1's live key (the happy path).
+-- KEY B: agent 3's live key — the "valid, but somebody else's" case.
+-- KEY C: agent 1's key, still status='active' but past its expires_at. Nothing sweeps
+--        expires_at into status outside issue_signing_key_challenge, so this state is real.
+-- KEY D: agent 1's revoked key.
+insert into agent_board.agent_signing_keys(
+  id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint,
+  status, proof_state, expires_at, revoked_at)
+values
+  ('26930000-0000-4000-8000-000000000001','26910000-0000-4000-8000-000000000001',
+   'primary', 1, public.test_pubkey('k269-a'), 'raw_ed25519_base64url',
+   public.test_key_fingerprint('k269-a'), 'active', 'proven', null, null),
+  ('26930000-0000-4000-8000-000000000002','26910000-0000-4000-8000-000000000003',
+   'primary', 1, public.test_pubkey('k269-b'), 'raw_ed25519_base64url',
+   public.test_key_fingerprint('k269-b'), 'active', 'proven', null, null),
+  ('26930000-0000-4000-8000-000000000003','26910000-0000-4000-8000-000000000001',
+   'stale', 2, public.test_pubkey('k269-c'), 'raw_ed25519_base64url',
+   public.test_key_fingerprint('k269-c'), 'active', 'proven', now() - interval '1 hour', null),
+  ('26930000-0000-4000-8000-000000000004','26910000-0000-4000-8000-000000000001',
+   'dead', 3, public.test_pubkey('k269-d'), 'raw_ed25519_base64url',
+   public.test_key_fingerprint('k269-d'), 'revoked', 'revoked', null, now());
+
+-- The gateway decision. `agent_id` is the VERIFIED signer; the key triple is what Portal
+-- resolved and what _record_signed_write_evidence copies into signature_evidence verbatim.
+create function pg_temp.gw(p_actor text, p_key text, p_key_id text, p_key_version integer)
+returns jsonb language sql immutable as $$
+  select jsonb_strip_nulls(jsonb_build_object(
+    'agent_id', p_actor,
+    'signing_key_id', p_key,
+    'key_id', p_key_id,
+    'key_version', p_key_version,
+    'algorithm', 'Ed25519',
+    'verification_status', 'verified',
+    'payload_digest', 'sha256:' || repeat('a', 64),
+    'signature_digest', 'sha256:' || repeat('b', 64),
+    'canonicalization_version', 'agent-provenance-jcs.v1',
+    'enforcement_mode', 'require_for_agent_writes',
+    'redacted', true));
+$$;
+
+-- Agent 1 signing with key A: the shape every allow-side probe uses.
+create function pg_temp.gwa() returns jsonb language sql immutable as $$
+  select pg_temp.gw('26910000-0000-4000-8000-000000000001',
+                    '26930000-0000-4000-8000-000000000001', 'primary', 1);
+$$;
+
+create function pg_temp.grant_payload(p_role text) returns jsonb language sql immutable as $$
+  select jsonb_build_object(
+    'p_board_id', '26920000-0000-4000-8000-000000000001',
+    'p_agent_id', '26910000-0000-4000-8000-000000000002',
+    'p_grantee_role', p_role);
+$$;
+
+-- ===========================================================================
+-- 1. The revalidation chokepoint exists, and it is not reachable by a caller.
+--    A SECURITY DEFINER function grants EXECUTE to PUBLIC by default, and this one
+--    takes row locks on an arbitrary agent id with no authorization of its own.
+-- ===========================================================================
+
+select has_function('agent_board', '_assert_signed_authority_signer_live', array['uuid','jsonb'],
+  'the signer-lifecycle revalidation helper exists');
+
+select is(
+  (select string_agg(distinct coalesce(pg_get_userbyid(nullif(a.grantee,0)),'PUBLIC'), ','
+            order by coalesce(pg_get_userbyid(nullif(a.grantee,0)),'PUBLIC'))
+     from pg_proc p, aclexplode(p.proacl) a
+    where p.oid = 'agent_board._assert_signed_authority_signer_live(uuid,jsonb)'::regprocedure
+      and a.privilege_type = 'EXECUTE'),
+  'postgres,service_role',
+  'the revalidation helper executes for service_role only (never PUBLIC/anon/authenticated)');
+
+select isnt(
+  (select obj_description('agent_board._assert_signed_authority_signer_live(uuid,jsonb)'::regprocedure, 'pg_proc')),
+  null,
+  'the revalidation helper carries its COMMENT');
+
+-- ===========================================================================
+-- 2. The allow side is untouched: a live signer with a live key still writes.
+-- ===========================================================================
+
+select pg_temp.service();
+
+select lives_ok(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('admin'), pg_temp.gwa())$$,
+  'a signed grant by an ACTIVE owner with a LIVE key still succeeds');
+
+select is(
+  (select role from agent_board.board_memberships
+    where board_id = '26920000-0000-4000-8000-000000000001'
+      and agent_id = '26910000-0000-4000-8000-000000000002'),
+  'admin',
+  'and it actually raised the grantee role');
+
+select is(
+  (select count(*)::int from agent_board.signature_evidence where operation = 'grant_board_role'),
+  1,
+  'and it recorded exactly one signature_evidence row');
+
+select lives_ok(
+  $$select * from agent_board.signed_set_board_authority_ceiling(
+      jsonb_build_object(
+        'p_board_id', '26920000-0000-4000-8000-000000000001',
+        'p_max_grantable_role', 'owner'),
+      pg_temp.gwa())$$,
+  'a signed ceiling change by an ACTIVE owner with a LIVE key still succeeds');
+
+select is(
+  (select max_grantable_role from agent_board.board_authority_ceilings
+    where board_id = '26920000-0000-4000-8000-000000000001'),
+  'owner',
+  'and it actually wrote the ceiling');
+
+-- ===========================================================================
+-- 3. Agent lifecycle. Each of the three non-active states is refused, and the
+--    refusal leaves no write behind.
+-- ===========================================================================
+
+update agent_board.agents set status = 'suspended'
+ where id = '26910000-0000-4000-8000-000000000001';
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'), pg_temp.gwa())$$,
+  '%signer_not_active%',
+  'a SUSPENDED signer cannot complete a signed grant');
+
+select is(
+  (select role from agent_board.board_memberships
+    where board_id = '26920000-0000-4000-8000-000000000001'
+      and agent_id = '26910000-0000-4000-8000-000000000002'),
+  'admin',
+  'and the refused grant did not raise the grantee');
+
+select throws_like(
+  $$select * from agent_board.signed_set_board_authority_ceiling(
+      jsonb_build_object(
+        'p_board_id', '26920000-0000-4000-8000-000000000001',
+        'p_max_grantable_role', 'member'),
+      pg_temp.gwa())$$,
+  '%signer_not_active%',
+  'a SUSPENDED signer cannot complete a signed ceiling change either');
+
+select is(
+  (select max_grantable_role from agent_board.board_authority_ceilings
+    where board_id = '26920000-0000-4000-8000-000000000001'),
+  'owner',
+  'and the refused ceiling change left the committed ceiling alone');
+
+update agent_board.agents set status = 'revoked'
+ where id = '26910000-0000-4000-8000-000000000001';
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'), pg_temp.gwa())$$,
+  '%signer_not_active%',
+  'a REVOKED signer cannot complete a signed grant');
+
+update agent_board.agents set status = 'inactive'
+ where id = '26910000-0000-4000-8000-000000000001';
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'), pg_temp.gwa())$$,
+  '%signer_not_active%',
+  'an INACTIVE signer cannot complete a signed grant');
+
+update agent_board.agents set status = 'active'
+ where id = '26910000-0000-4000-8000-000000000001';
+
+-- ===========================================================================
+-- 4. Key lifecycle. The signer is active throughout this section, so every
+--    refusal below is attributable to the KEY and nothing else.
+-- ===========================================================================
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gw('26910000-0000-4000-8000-000000000001',
+                 '26930000-0000-4000-8000-000000000004', 'dead', 3))$$,
+  '%signer_key_not_live%',
+  'a REVOKED signing key cannot complete a signed grant');
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gw('26910000-0000-4000-8000-000000000001',
+                 '26930000-0000-4000-8000-000000000003', 'stale', 2))$$,
+  '%signer_key_expired%',
+  'an EXPIRED signing key cannot complete a signed grant');
+
+-- The ownership half. Key B is active, proven and unexpired -- it is simply agent 3's. The
+-- signer here is the real owner, so the inner grant SUCCEEDS and only the ownership check
+-- can be what refuses this.
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gw('26910000-0000-4000-8000-000000000001',
+                 '26930000-0000-4000-8000-000000000002', 'primary', 1))$$,
+  '%signer_key_not_owned%',
+  'a LIVE key belonging to another agent cannot authorize this signer');
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      jsonb_build_object('agent_id', '26910000-0000-4000-8000-000000000001',
+                         'verification_status', 'verified'))$$,
+  '%signer_key_absent: signed authority write requires a gateway-verified signing key%',
+  'a decision that names no signing key cannot complete a signed authority write');
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gw('26910000-0000-4000-8000-000000000001',
+                 '26930000-0000-4000-8000-0000000000ff', 'primary', 1))$$,
+  '%signer_key_absent: signed authority write names a signing key that does not exist%',
+  'a decision naming a signing key that does not exist is refused');
+
+-- Evidence integrity: _record_signed_write_evidence copies key_id/key_version from the
+-- decision verbatim, so a decision whose text identifiers disagree with the row just
+-- revalidated would mint evidence naming a key that was never checked.
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gw('26910000-0000-4000-8000-000000000001',
+                 '26930000-0000-4000-8000-000000000001', 'rotated', 1))$$,
+  '%signer_key_mismatch: gateway decision key_id does not match%',
+  'a decision whose key_id disagrees with the revalidated key is refused');
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gw('26910000-0000-4000-8000-000000000001',
+                 '26930000-0000-4000-8000-000000000001', 'primary', 7))$$,
+  '%signer_key_mismatch: gateway decision key_version does not match%',
+  'a decision whose key_version disagrees with the revalidated key is refused');
+
+-- ===========================================================================
+-- 4b. The gateway's VERDICT. Every probe above varies a LIFECYCLE fact; none of them asks
+--     whether the signature actually verified. A decision naming a live signer and a live
+--     key but carrying verification_status='failed' satisfied the whole chain and COMPLETED
+--     the grant, minting an evidence row that recorded 'failed' beside a mutation that had
+--     succeeded (_record_signed_write_evidence admits 'failed' by design,
+--     20260710000000:88). Each probe below is pg_temp.gwa() -- the decision the allow-side
+--     probes use -- with ONLY verification_status altered, so the refusal is attributable to
+--     the status and to nothing else.
+-- ===========================================================================
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gwa() || jsonb_build_object('verification_status', 'failed'))$$,
+  '%signer_not_verified%',
+  'a FAILED verification cannot complete a signed grant, live signer and live key or not');
+
+select throws_like(
+  $$select * from agent_board.signed_set_board_authority_ceiling(
+      jsonb_build_object(
+        'p_board_id', '26920000-0000-4000-8000-000000000001',
+        'p_max_grantable_role', 'member'),
+      pg_temp.gwa() || jsonb_build_object('verification_status', 'failed'))$$,
+  '%signer_not_verified%',
+  'a FAILED verification cannot complete a signed ceiling change either');
+
+-- 'observed' and 'warn' are NOT weaker verifications: specs/agent-provenance-signing.md:258-259
+-- defines both as the label an UNSIGNED write receives under enforcement_mode 'observe' and
+-- 'warn'. Admitting either would re-open the same hole under another name, so the accepted set
+-- has exactly one member. These two probes are what pin exact-match over a set: widening the
+-- predicate to `in ('verified','warn')` reds the 'warn' one alone.
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gwa() || jsonb_build_object('verification_status', 'warn'))$$,
+  '%signer_not_verified%',
+  'WARN -- an unsigned write accepted under enforcement_mode=warn -- cannot complete a signed grant');
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gwa() || jsonb_build_object('verification_status', 'observed'))$$,
+  '%signer_not_verified%',
+  'OBSERVED -- an unsigned write accepted under enforcement_mode=observe -- cannot complete a signed grant');
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gwa() || jsonb_build_object('verification_status', 'unsigned'))$$,
+  '%signer_not_verified%',
+  'an UNSIGNED decision cannot complete a signed grant');
+
+-- Fail CLOSED on absent and on empty: `is distinct from` puts both in the same branch as a
+-- wrong value, rather than letting a missing key read as "nothing to object to".
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gwa() - 'verification_status')$$,
+  '%signer_not_verified: signed authority write requires a verified gateway decision, got (absent)%',
+  'a decision carrying NO verification_status at all is refused, not defaulted');
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gwa() || jsonb_build_object('verification_status', ''))$$,
+  '%signer_not_verified: signed authority write requires a verified gateway decision, got (absent)%',
+  'an EMPTY verification_status is refused too');
+
+-- The client-side SigningVerificationStatus vocabulary (contract.ts:268) is a DIFFERENT
+-- vocabulary -- 'signed' / 'valid_signature' / 'unsigned_compatibility' / 'invalid_signature'
+-- -- and none of its values may satisfy a gate written against the evidence vocabulary. An
+-- exact match gets this for free; a "not in (bad values)" formulation would have admitted it.
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gwa() || jsonb_build_object('verification_status', 'valid_signature'))$$,
+  '%signer_not_verified%',
+  'a value from the CLIENT-side signing vocabulary does not satisfy the evidence-vocabulary gate');
+
+-- The refusal must happen BEFORE the row locks, so it cannot be defeated by lifecycle state:
+-- an unverified decision has no standing regardless of whose key it names. With the signer
+-- suspended, a lifecycle-first ordering would report signer_not_active instead.
+update agent_board.agents set status = 'suspended'
+ where id = '26910000-0000-4000-8000-000000000001';
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(
+      pg_temp.grant_payload('member'),
+      pg_temp.gwa() || jsonb_build_object('verification_status', 'failed'))$$,
+  '%signer_not_verified%',
+  'the verification verdict is checked BEFORE the lifecycle locks, not after');
+
+update agent_board.agents set status = 'active'
+ where id = '26910000-0000-4000-8000-000000000001';
+
+select is(
+  (select count(*)::int from agent_board.signature_evidence where operation = 'grant_board_role'),
+  1,
+  'none of the twenty refusals above minted a second grant evidence row');
+
+select is(
+  (select role from agent_board.board_memberships
+    where board_id = '26920000-0000-4000-8000-000000000001'
+      and agent_id = '26910000-0000-4000-8000-000000000002'),
+  'admin',
+  'and none of them changed the grantee role');
+
+-- ===========================================================================
+-- 5. The two CHECKs the predicate RELIES ON, asserted positively.
+--
+--    _assert_signed_authority_signer_live does NOT re-test proof_state='proven' or
+--    revoked_at is null: both are consequences of status='active' under these table
+--    constraints, and a branch no mutation can falsify is an unpinnable construct
+--    (CLAUDE.md rule 2). The reliance is therefore proven HERE. If either CHECK is ever
+--    dropped, this fails rather than the predicate silently losing a guarantee.
+-- ===========================================================================
+
+select throws_like(
+  $$update agent_board.agent_signing_keys
+       set proof_state = 'unproven'
+     where id = '26930000-0000-4000-8000-000000000001'$$,
+  '%violates check constraint "agent_signing_keys_active_requires_proof"%',
+  'RELIED ON: an active key cannot be unproven (agent_signing_keys_active_requires_proof)');
+
+select throws_like(
+  $$update agent_board.agent_signing_keys
+       set revoked_at = now()
+     where id = '26930000-0000-4000-8000-000000000001'$$,
+  '%violates check constraint "agent_signing_keys_revoked_shape"%',
+  'RELIED ON: an active key cannot carry revoked_at (agent_signing_keys_revoked_shape)');
+
+-- ===========================================================================
+-- 6. Class assertions (catalog-derived, CLAUDE.md rule 1).
+--
+--    The class is not "the two wrappers #269 happened to edit". It is: every signed_*
+--    wrapper whose inner write is an AUTHORITY write. Both sides are derived from pg_proc
+--    and compared, so a new authority wrapper that omits the revalidation appears in one
+--    set and not the other and the symmetric difference NAMES it. stripped_body (not raw
+--    prosrc) is used throughout: a comment or a string literal mentioning a marker must not
+--    be able to satisfy any of these (#196/#199).
+-- ===========================================================================
+
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname like 'signed\_%'
+      and agent_board_test.stripped_body(p.oid)
+          ~ '\m(grant_board_role|set_board_authority_ceiling|set_board_role_gate)\s*\('),
+  'signed_grant_board_role,signed_set_board_authority_ceiling',
+  'the signed wrappers that perform an AUTHORITY write are exactly these two');
+
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname like 'signed\_%'
+      and agent_board_test.stripped_body(p.oid)
+          ~ '\m_assert_signed_authority_signer_live\s*\('),
+  'signed_grant_board_role,signed_set_board_authority_ceiling',
+  'the signed wrappers that revalidate the signer are exactly these two');
+
+-- The gate proper: the two sets must not merely each be right today, they must be EQUAL,
+-- and any member of the difference is named in the failure.
+select is(
+  (select string_agg(x.proname || ':' || x.why, '; ' order by x.proname)
+     from (
+       select p.proname,
+              case when agent_board_test.stripped_body(p.oid)
+                        ~ '\m(grant_board_role|set_board_authority_ceiling|set_board_role_gate)\s*\('
+                   then 'authority write with NO signer revalidation'
+                   else 'revalidates a signer but performs no authority write'
+              end as why
+         from pg_proc p
+         join pg_namespace n on n.oid = p.pronamespace
+        where n.nspname = 'agent_board'
+          and p.proname like 'signed\_%'
+          and (agent_board_test.stripped_body(p.oid)
+                 ~ '\m(grant_board_role|set_board_authority_ceiling|set_board_role_gate)\s*\(')
+              <> (agent_board_test.stripped_body(p.oid)
+                 ~ '\m_assert_signed_authority_signer_live\s*\(')
+     ) x),
+  null,
+  'no signed wrapper is on one side of the authority/revalidation pairing without the other');
+
+-- The five exemptions, asserted POSITIVELY: each names the non-authority write it actually
+-- performs. An exemption list justified by the ABSENCE of a match is the soft spot this
+-- repo has been bitten by, so none is used here.
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname like 'signed\_%'
+      and agent_board_test.stripped_body(p.oid)
+          ~ '\m(send_direct_message|send_multicast_message|post_board_message|append_task_event|create_tasking_delivery)\s*\('),
+  'signed_append_task_event,signed_create_tasking_delivery,signed_post_board_message,'
+  || 'signed_send_direct_message,signed_send_multicast_message',
+  'the five exempt wrappers each perform a message/task write, which is why they are exempt');
+
+-- Blast radius, stated as an assertion rather than as prose: the shared actor chokepoint is
+-- still reached by all SEVEN wrappers and #269 added nothing to it.
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname like 'signed\_%'
+      and agent_board_test.stripped_body(p.oid) ~ '\m_signed_write_actor_id\s*\('),
+  'signed_append_task_event,signed_create_tasking_delivery,signed_grant_board_role,'
+  || 'signed_post_board_message,signed_send_direct_message,signed_send_multicast_message,'
+  || 'signed_set_board_authority_ceiling',
+  'all seven signed wrappers still resolve their actor through the shared _signed_write_actor_id');
+
+select ok(
+  agent_board_test.stripped_body('agent_board._signed_write_actor_id(jsonb,jsonb,text)'::regprocedure)
+    !~ '\m(agents|agent_signing_keys)\M',
+  'the shared actor chokepoint reads no lifecycle table: the five message wrappers are unchanged');
+
+-- ===========================================================================
+-- 7. Position of the call, asserted from the catalog. The revalidation must sit AFTER the
+--    inner authority call: hoisting it inverts the ceiling wrapper's lock order against
+--    onboard_federated_fleet_agent on (advisory, agents), and it rewrites two existing #247
+--    assertions that expect the inner gate's error first. Prose in the migration is not a
+--    guard; this is.
+-- ===========================================================================
+
+-- Each claim below guards BOTH markers with `> 0`. A bare `strpos(A) < strpos(B)` returns
+-- `0 < N` = TRUE when the LEFT marker is absent, so it passes on a body it no longer matches
+-- -- the fail-open shape documented at length in agent_board_atomic_fleet_onboarding.test.sql's
+-- header, which shipped green once with the ordering it named genuinely inverted (#198).
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board.grant_board_role(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board._assert_signed_authority_signer_live(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board.grant_board_role(')
+  < strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board._assert_signed_authority_signer_live('),
+  'signed_grant_board_role revalidates AFTER the inner grant, not before');
+
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board.signed_set_board_authority_ceiling(jsonb,jsonb)'::regprocedure),
+         'agent_board.set_board_authority_ceiling(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.signed_set_board_authority_ceiling(jsonb,jsonb)'::regprocedure),
+         'agent_board._assert_signed_authority_signer_live(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.signed_set_board_authority_ceiling(jsonb,jsonb)'::regprocedure),
+         'agent_board.set_board_authority_ceiling(')
+  < strpos(agent_board_test.stripped_body('agent_board.signed_set_board_authority_ceiling(jsonb,jsonb)'::regprocedure),
+         'agent_board._assert_signed_authority_signer_live('),
+  'signed_set_board_authority_ceiling revalidates AFTER the inner upsert, not before');
+
+-- And the revalidation must precede the evidence row, so a refused write never even attempts
+-- to mint attestation.
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board._assert_signed_authority_signer_live(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board._record_signed_write_evidence(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board._assert_signed_authority_signer_live(')
+  < strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board._record_signed_write_evidence('),
+  'and it revalidates BEFORE recording evidence');
+
+-- ===========================================================================
+-- 8. Lock order INSIDE the helper: agents BEFORE agent_signing_keys.
+--
+--    Section 7 pins where the helper is CALLED. Nothing pinned the order of the two share
+--    locks it takes, and that order is the load-bearing ABBA-safety claim: _revoke_agent_principal
+--    (20260901000100:1292) takes `agents ... for update` and THEN loops the keys, and
+--    revoke_fleet_subject's signing_key branch does the same. Taking the key first here
+--    inverts against both.
+--
+--    NO RUNTIME COUNTERPARTY DISCRIMINATES THIS. The mutation that motivated these three --
+--    inserting `perform 1 from agent_board.agent_signing_keys k where k.id = v_signing_key_id
+--    for share;` ABOVE the agents block, leaving the check/error sequence intact -- leaves the
+--    pgTAP suite green (it is order-insensitive) AND every isolation permutation green,
+--    because each adversary takes its locks in ONE statement, so the intra-statement order
+--    never reaches a golden. These assertions are therefore the SOLE PIN, which is exactly why
+--    they must not be fail-open.
+--
+--    Shape: two PRESENCE claims carrying the lock MODE (so a downgrade to a weaker mode, or a
+--    lock deleted outright, reds by name), then one POSITIONAL claim guarded on both markers.
+--    Presence is asserted with `~` rather than strpos so the marker can span the newlines the
+--    body actually contains without any local text rewriting -- rolling a private strip is
+--    what scripts/lint-pgtap-source-assertions.mjs rule 2 prohibits. All three read
+--    stripped_body, so a comment or literal naming a marker cannot satisfy them.
+-- ===========================================================================
+
+select ok(
+  agent_board_test.stripped_body('agent_board._assert_signed_authority_signer_live(uuid,jsonb)'::regprocedure)
+    ~ 'from agent_board\.agents a\s+where a\.id = p_actor_agent_id\s+for share',
+  'the revalidation share-locks the signer''s agents row (FOR SHARE, not a weaker mode)');
+
+select ok(
+  agent_board_test.stripped_body('agent_board._assert_signed_authority_signer_live(uuid,jsonb)'::regprocedure)
+    ~ 'from agent_board\.agent_signing_keys k\s+where k\.id = v_signing_key_id\s+for share',
+  'and it share-locks the signing key row named by the decision (FOR SHARE)');
+
+-- The board advisory lock must be taken BEFORE the inner grant, which is what makes the
+-- wrapper acyclic against onboard_federated_fleet_agent. Without it the wrapper's order is
+-- board_memberships(grantee) -> agents(signer) against onboarding's agents -> board_memberships:
+-- a reproduced `deadlock detected` between two honest callers. The RUNTIME counterparty is
+-- tests/isolation/specs/signed_grant_onboarding_deadlock.spec, which discriminates the removal
+-- as a golden diff; this assertion is the static half.
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board._lock_board_authority_ceiling(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board.grant_board_role(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board._lock_board_authority_ceiling(')
+  < strpos(agent_board_test.stripped_body('agent_board.signed_grant_board_role(jsonb,jsonb)'::regprocedure),
+         'agent_board.grant_board_role('),
+  'the grant wrapper takes the board advisory lock BEFORE the inner grant [CONFIRMATORY: signed_grant_onboarding_deadlock.spec discriminates its removal]');
+
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board._assert_signed_authority_signer_live(uuid,jsonb)'::regprocedure),
+         'from agent_board.agents a') > 0
+  and strpos(agent_board_test.stripped_body('agent_board._assert_signed_authority_signer_live(uuid,jsonb)'::regprocedure),
+         'from agent_board.agent_signing_keys k') > 0
+  and strpos(agent_board_test.stripped_body('agent_board._assert_signed_authority_signer_live(uuid,jsonb)'::regprocedure),
+         'from agent_board.agents a')
+  < strpos(agent_board_test.stripped_body('agent_board._assert_signed_authority_signer_live(uuid,jsonb)'::regprocedure),
+         'from agent_board.agent_signing_keys k'),
+  'and it takes them agents-BEFORE-keys, matching _revoke_agent_principal [SOLE PIN: no isolation permutation discriminates this ordering]');
+
+-- ===========================================================================
+-- 9. CLASS (catalog-derived, CLAUDE.md rule 1): the agents/board_memberships cycle class.
+--
+--    F4 was an ABBA between signed_grant_board_role and onboard_federated_fleet_agent on
+--    (board_memberships, agents). The fix is only as good as the claim that those are the ONLY
+--    two functions that lock both — and that claim must come from pg_catalog, not from this
+--    file. Any function that row-locks both relations can close the same cycle, so every member
+--    must take the board advisory lock that serialises them.
+--
+--    THE CALL GRAPH IS CLOSED OVER FIRST, because a body-text scan cannot see a lock taken in a
+--    CALLEE and EVERY lock the wrapper takes is in one: board_memberships in grant_board_role's
+--    UPDATE, agents and agent_signing_keys in _assert_signed_authority_signer_live. A direct
+--    scan reports the wrapper as locking nothing and the class as a single member — which is
+--    exactly how this defect stayed invisible to the section-7 assertions.
+--
+--    Edges are OVER-approximated (any bare `name(` occurrence counts as a call). Over-connecting
+--    adds candidates to the expected array, which is visible and harmless; under-connecting
+--    would silently drop a site, which is the direction that hides a defect.
+-- ===========================================================================
+
+select is(
+  (with recursive fns as (
+     select p.oid, p.proname, agent_board_test.stripped_body(p.oid) as b
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+   ), edges as (
+     select f.proname as caller, g.proname as callee
+       from fns f join fns g on g.proname <> f.proname
+      where f.b ~ ('\m' || g.proname || '\s*\(')
+   ), closure as (
+     select proname as root, proname as reached from fns
+     union
+     select c.root, e.callee from closure c join edges e on e.caller = c.reached
+   ), direct as (
+     select proname,
+            (b ~ 'agent_board\.agents[^;]*for (update|share)') as locks_agents,
+            (b ~ 'agent_board\.board_memberships[^;]*for (update|share)'
+             or b ~ 'update agent_board\.board_memberships') as locks_memberships,
+            (b ~ '\magent_board\._lock_board_authority_ceiling\s*\(') as takes_advisory
+       from fns
+   ), agg as (
+     select c.root,
+            bool_or(d.locks_agents) as locks_agents,
+            bool_or(d.locks_memberships) as locks_memberships,
+            bool_or(d.takes_advisory) as takes_advisory
+       from closure c join direct d on d.proname = c.reached
+      group by c.root
+   )
+   select array_agg(root || case when takes_advisory then ' => serialised by the board advisory lock'
+                                 else ' => NOT SERIALISED (can deadlock against onboarding)' end
+                    order by root)
+     from agg
+    where locks_agents and locks_memberships),
+  array[
+    'onboard_federated_fleet_agent => serialised by the board advisory lock',
+    'signed_grant_board_role => serialised by the board advisory lock'
+  ]::text[],
+  'every function that row-locks BOTH agents and board_memberships takes the board advisory lock (transitive; a new one names itself)');
+
+select finish();
+
+rollback;