@consiliency/agent-board-schema 1.25.0 → 1.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.25.0",
+  "version": "1.28.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.25.0",
+  "packageVersion": "1.28.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 125,
-  "aggregateSha256": "0ce03fcc8b0ae0113e9b6de2c8e8bc346cf735a86fcca0221ffc8103d604969f",
+  "migrationCount": 127,
+  "aggregateSha256": "c550b9a50fadba563b30975d911079bdd96f59ac64a752553df9fcfb5df0e6d4",
   "migrations": [
     {
       "order": 0,
@@ -1173,6 +1173,24 @@
       "sourceRef": "message-board",
       "bytes": 12633,
       "sha256": "21111e289e0bb70ac3236f5422476c0c51d0bca5a815c11dd4e48b6932cf7c6b"
+    },
+    {
+      "order": 125,
+      "id": "20260908000100_agent_board_signer_lifecycle_revalidation",
+      "filename": "20260908000100_agent_board_signer_lifecycle_revalidation.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 29336,
+      "sha256": "bfb1ae60f69dae0a0aaf1007dbf14e171f324cdced1caf9f4d490f41a60c14e5"
+    },
+    {
+      "order": 126,
+      "id": "20260909000100_agent_board_ledger_revoked_authority",
+      "filename": "20260909000100_agent_board_ledger_revoked_authority.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 67493,
+      "sha256": "7522e32c61f8845e511255d94d273d98eb7b72b2f906976c3a2494629927462d"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 125)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 127)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(125);
+    expect(manifest.migrationCount).toBe(127);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,

package/tests/agent_board_atomic_fleet_onboarding.test.sql

@@ -521,7 +521,12 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
   array[
     'agent_board._redeem_unbounded_invite_for_agent(text,uuid) => UNSERIALIZED',
     'agent_board.create_invite_link(uuid,text,text,integer,timestamp with time zone,uuid,jsonb) => UNSERIALIZED',
-    'agent_board.grant_board_role(uuid,uuid,text,uuid) => UNSERIALIZED',
+    -- Retired from UNSERIALIZED by #276 (20260909000100). Adding the fleet-ledger gate made
+    -- grant_board_role row-lock both agents and board_memberships, which section 9 of
+    -- agent_board_signer_lifecycle.test.sql requires to be advisory-serialised; taking that
+    -- lock also closes this reader's exposure to the ceiling row's ABSENCE, one of the three
+    -- 20260901000110 left explicitly undetermined.
+    'agent_board.grant_board_role(uuid,uuid,text,uuid) => serialized',
     'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) => serialized'
   ]::text[],
   'every ceiling-authorization reader in pg_proc is declared with its serialization state'
@@ -569,6 +574,12 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
           or strpos(agent_board_test.stripped_body(p.oid, true), 'board_authority_ceilings:') > 0)
    ) definers),
   array[
+    -- Joined this class in #276: it reads the fleet revocation ledger. This is the UNLOCKED
+    -- predicate; the share-locking _assert_actor_not_fleet_revoked wrapper left this surface
+    -- when the two were split, because it now reaches the ledger through this function rather
+    -- than naming the table itself. Internal — it reads rows for an arbitrary agent id with no
+    -- authorization of its own, so service_role only, like every other helper here.
+    'agent_board._actor_fleet_revoked(uuid) [definer] => service_role',
     'agent_board._lock_board_authority_ceiling(uuid) [invoker] => service_role',
     'agent_board._redeem_fleet_invite_for_agent(text,uuid) [definer] => service_role',
     'agent_board._redeem_invite_for_agent(text,uuid) [definer] => service_role',
@@ -577,11 +588,21 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     'agent_board.enroll_federated_human(text,text,text,jsonb,text) [definer] => service_role',
     'agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text) [definer] => service_role',
     'agent_board.evaluate_fleet_sender_policy(uuid,uuid,uuid,uuid,text,uuid,boolean) [definer] => authenticated,service_role',
+    -- Joined this class in #276: the live grant chokepoint now takes _lock_board_authority_ceiling
+    -- (forced by the section-9 agents/board_memberships class in agent_board_signer_lifecycle.test.sql
+    -- once the ledger gate made it lock both). Still authenticated,service_role — #276 removes
+    -- authority from a revoked principal, it does not change who may call the RPC.
+    'agent_board.grant_board_role(uuid,uuid,text,uuid) [definer] => authenticated,service_role',
     'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) [definer] => service_role',
     'agent_board.reactivate_fleet_machine(uuid,uuid,text) [definer] => service_role',
     'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb) [definer] => authenticated,service_role',
     'agent_board.revoke_human_subtree(uuid,uuid,text) [definer] => service_role',
-    'agent_board.set_board_authority_ceiling(uuid,text,uuid) [definer] => authenticated,service_role'
+    'agent_board.set_board_authority_ceiling(uuid,text,uuid) [definer] => authenticated,service_role',
+    -- Joined this class in #269 F4: the signed grant wrapper now takes the board advisory lock
+    -- FIRST, because its order was board_memberships(grantee) -> agents(signer) against
+    -- onboard_federated_fleet_agent's agents -> board_memberships -- a reproduced ABBA between
+    -- two honest callers. It is service_role-only like every other signed_* wrapper (#118).
+    'agent_board.signed_grant_board_role(jsonb,jsonb) [definer] => service_role'
   ]::text[],
   'every function on this migration set''s surface is declared with its definer flag and exact EXECUTE grantees'
 );