@consiliency/agent-board-schema 1.25.0 → 1.28.0

package/tests/agent_board_ledger_authority.test.sql

@@ -0,0 +1,1010 @@
+-- #276 pgTAP: a fleet-revoked agent loses BOARD AUTHORITY, not only send.
+--
+-- The claim under test: an agent carrying an agent-subject `fleet_revocation_events` row cannot
+-- complete a board-role grant, a board authority-ceiling change, or a role-gate flip — on the
+-- unsigned `authenticated` route or the signed gateway route — while an agent that was never in
+-- a fleet is completely unaffected.
+--
+-- THE DIVERGENCE, asserted rather than described. `revoke_fleet_subject('agent', X)` leaves
+-- `agents.status = 'active'` and X's signing keys live; only the ledger row and the bindings
+-- change. Section 4 asserts that precondition POSITIVELY before probing the refusal, so a
+-- future change that (say) also flipped `agents.status` would make these tests pass for the
+-- WRONG reason and section 4 is what would catch it.
+--
+-- WHAT THIS FILE CAN AND CANNOT REACH. A pgTAP file runs in ONE transaction, so it proves the
+-- PREDICATE (a ledger-revoked grantor is refused) but structurally cannot produce the
+-- interleaving (`revoke_fleet_subject` committing between an authority write's ledger read and
+-- its commit) or the `agents` FOR SHARE lock that serializes it. That lives in
+-- tests/isolation/specs/ledger_authority_revoke.spec, driven by isolationtester across
+-- committed sessions.
+--
+-- Methodology, inherited from agent_board_signer_lifecycle.test.sql:
+--   * RPC probes are driven by the JWT claim blob only; SET LOCAL ROLE is never used, since it
+--     would revoke _is_service_role() and mask the branch behind a permission error.
+--   * Allow-side probes are lives_ok(...) then a SEPARATE state check. A bare
+--     `select ... from <raising rpc>(...)` ABORTS the transaction instead of failing it,
+--     silently dropping every later assertion (#113, CLAUDE.md rule 3).
+--   * Every refusal probe is followed by a state check, because a gate that raises AND writes
+--     is the failure mode throws_like alone cannot see.
+--   * The class assertions in section 9 are catalog-derived (pg_proc + stripped_body), not a
+--     list written here, so a NEW authority write that forgets the gate fails and NAMES ITSELF
+--     (CLAUDE.md rule 1). The one exemption is asserted POSITIVELY — by three properties it
+--     actually has — never by the absence of a match.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(88);
+
+create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role','authenticated','sub',p_sub)::text, true);
+end $$;
+create function pg_temp.service() returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', '', true);
+end $$;
+
+-- Fixture -------------------------------------------------------------------
+-- agent 1 = FLEET agent, owner of board 1, bound to machines A and B. The #276 subject.
+-- agent 2 = grantee, an active member of every board here.
+-- agent 3 = NON-FLEET agent, owner of board 2. It has NO fleet_machine_agents row at all —
+--           the exemption category judgement 2 is about.
+-- agent 4 = FLEET agent, owner of board 3, bound to machines A and B. Used for the
+--           multi-binding case: its binding on machine A is revoked, B stays active.
+-- agent 5 = operator principal that performs the revocations.
+
+insert into auth.users(id, instance_id, aud, role, email)
+select ('27600000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid,
+       '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+       'k276u'||n||'@t.test'
+from generate_series(1,6) n;
+
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+select ('27610000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid,
+       'agent','agent','k276-agent-'||n,'K276 Agent '||n,'active',
+       ('27600000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid
+from generate_series(1,6) n;
+
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+values
+  ('27620000-0000-4000-8000-000000000001','k276-board-1','K276 Board 1','27610000-0000-4000-8000-000000000001','private','active'),
+  ('27620000-0000-4000-8000-000000000002','k276-board-2','K276 Board 2','27610000-0000-4000-8000-000000000003','private','active'),
+  ('27620000-0000-4000-8000-000000000003','k276-board-3','K276 Board 3','27610000-0000-4000-8000-000000000004','private','active'),
+  -- board 4 exists solely for the invite ALLOW side: its owner (agent 6) is never revoked
+  -- and never role-clamped, so a failure there is the gate and not fixture coupling.
+  ('27620000-0000-4000-8000-000000000004','k276-board-4','K276 Board 4','27610000-0000-4000-8000-000000000006','private','active');
+
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+values
+  ('27620000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000001','owner','joined','27610000-0000-4000-8000-000000000001'),
+  ('27620000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000002','member','joined','27610000-0000-4000-8000-000000000001'),
+  ('27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000003','owner','joined','27610000-0000-4000-8000-000000000003'),
+  ('27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000002','member','joined','27610000-0000-4000-8000-000000000003'),
+  ('27620000-0000-4000-8000-000000000003','27610000-0000-4000-8000-000000000004','owner','joined','27610000-0000-4000-8000-000000000004'),
+  ('27620000-0000-4000-8000-000000000003','27610000-0000-4000-8000-000000000002','member','joined','27610000-0000-4000-8000-000000000004'),
+  ('27620000-0000-4000-8000-000000000004','27610000-0000-4000-8000-000000000006','owner','joined','27610000-0000-4000-8000-000000000006');
+
+-- Agent 1's live signing key: the signed route needs a decision naming a live, owned key so
+-- that a refusal can only be the #276 gate and never #269's revalidation.
+insert into agent_board.agent_signing_keys(
+  id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint,
+  status, proof_state, expires_at, revoked_at)
+values
+  ('27630000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000001',
+   'primary', 1, public.test_pubkey('k276-a'), 'raw_ed25519_base64url',
+   public.test_key_fingerprint('k276-a'), 'active', 'proven', null, null);
+
+-- Fleet substrate: one trust domain, two ACTIVE machines, and bindings for agents 1 and 4 on
+-- BOTH machines. Two machines is what makes judgement 1 testable at all.
+insert into agent_board.fleet_trust_domains(id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+values ('27640000-0000-4000-8000-000000000001','k276-domain','K276 Domain','tailnet',
+        '27610000-0000-4000-8000-000000000005','active', now());
+
+insert into agent_board.fleet_machines(id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint, lifecycle_state, enrolled_at)
+values
+  ('27650000-0000-4000-8000-00000000000a','27640000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000005','k276-machine-a','fp-k276-a','active', now()),
+  ('27650000-0000-4000-8000-00000000000b','27640000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000005','k276-machine-b','fp-k276-b','active', now());
+
+insert into agent_board.fleet_machine_agents(id, machine_id, agent_id, agent_role, lifecycle_state)
+values
+  ('27660000-0000-4000-8000-00000000001a','27650000-0000-4000-8000-00000000000a','27610000-0000-4000-8000-000000000001','phase_worker','active'),
+  ('27660000-0000-4000-8000-00000000001b','27650000-0000-4000-8000-00000000000b','27610000-0000-4000-8000-000000000001','phase_worker','active'),
+  ('27660000-0000-4000-8000-00000000004a','27650000-0000-4000-8000-00000000000a','27610000-0000-4000-8000-000000000004','phase_worker','active'),
+  ('27660000-0000-4000-8000-00000000004b','27650000-0000-4000-8000-00000000000b','27610000-0000-4000-8000-000000000004','phase_worker','active');
+
+create function pg_temp.gwa() returns jsonb language sql immutable as $$
+  select jsonb_build_object(
+    'agent_id', '27610000-0000-4000-8000-000000000001',
+    'signing_key_id', '27630000-0000-4000-8000-000000000001',
+    'key_id', 'primary',
+    'key_version', 1,
+    'algorithm', 'Ed25519',
+    'verification_status', 'verified',
+    'payload_digest', 'sha256:' || repeat('a', 64),
+    'signature_digest', 'sha256:' || repeat('b', 64),
+    'canonicalization_version', 'agent-provenance-jcs.v1',
+    'enforcement_mode', 'require_for_agent_writes',
+    'redacted', true);
+$$;
+
+create function pg_temp.grant_payload(p_role text) returns jsonb language sql immutable as $$
+  select jsonb_build_object(
+    'p_board_id', '27620000-0000-4000-8000-000000000001',
+    'p_agent_id', '27610000-0000-4000-8000-000000000002',
+    'p_grantee_role', p_role);
+$$;
+
+create function pg_temp.role_on(p_board uuid, p_agent uuid) returns text language sql stable as $$
+  select role from agent_board.board_memberships where board_id = p_board and agent_id = p_agent;
+$$;
+
+-- ===========================================================================
+-- 1. The gate helper exists, is unreachable by a caller, and is documented.
+--    A SECURITY DEFINER function grants EXECUTE to PUBLIC by default and this one locks and
+--    reads rows for an arbitrary agent id with no authorization of its own (#118).
+-- ===========================================================================
+
+select has_function('agent_board', '_assert_actor_not_fleet_revoked', array['uuid','text'],
+  'the fleet-revocation gate helper exists');
+
+select is(
+  (select string_agg(distinct coalesce(pg_get_userbyid(nullif(a.grantee,0)),'PUBLIC'), ','
+            order by coalesce(pg_get_userbyid(nullif(a.grantee,0)),'PUBLIC'))
+     from pg_proc p, aclexplode(p.proacl) a
+    where p.oid = 'agent_board._assert_actor_not_fleet_revoked(uuid,text)'::regprocedure
+      and a.privilege_type = 'EXECUTE'),
+  'postgres,service_role',
+  'the gate helper executes for service_role only (never PUBLIC/anon/authenticated)');
+
+select isnt(
+  (select obj_description('agent_board._assert_actor_not_fleet_revoked(uuid,text)'::regprocedure, 'pg_proc')),
+  null,
+  'the gate helper carries its COMMENT');
+
+-- The null branch is unreachable from all three chokepoints (each resolves or gates its actor
+-- first), so it is pinned by calling the helper DIRECTLY rather than left as a branch no
+-- mutation could falsify (CLAUDE.md rule 2).
+select pg_temp.service();
+
+select throws_like(
+  $$select agent_board._assert_actor_not_fleet_revoked(null::uuid, 'probe')$$,
+  '%fleet_revoked_unresolved%',
+  'the gate fails closed on a null actor');
+
+-- ===========================================================================
+-- 2. ALLOW SIDE, unsigned and signed: a fleet-bound but NOT-revoked owner is untouched.
+--    This is the blast-radius assertion — the gate must cost an unrevoked fleet agent nothing.
+-- ===========================================================================
+
+select pg_temp.claims('27600000-0000-0000-0000-000000000001');
+
+select lives_ok(
+  $$create temp table _c1 as
+    select * from agent_board.grant_board_role(
+      '27620000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000002','admin')$$,
+  'an ACTIVE, fleet-BOUND, unrevoked owner still completes an unsigned grant');
+
+select is(
+  pg_temp.role_on('27620000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000002'),
+  'admin',
+  'and it actually raised the grantee role');
+
+select pg_temp.service();
+
+select lives_ok(
+  $$create temp table _sg as
+    select * from agent_board.signed_grant_board_role(pg_temp.grant_payload('member'), pg_temp.gwa())$$,
+  'and the SIGNED route by the same unrevoked owner still completes');
+
+select is(
+  pg_temp.role_on('27620000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000002'),
+  'member',
+  'and the signed grant actually wrote the grantee role');
+
+-- ===========================================================================
+-- 3. JUDGEMENT 2, asserted POSITIVELY: a principal with NO fleet binding is unaffected.
+--    A predicate phrased as "has an active binding" would refuse this grant. Never asserted by
+--    the absence of a match — agent 3 completes a real grant and the role is read back.
+-- ===========================================================================
+
+select is(
+  (select count(*)::int from agent_board.fleet_machine_agents
+    where agent_id = '27610000-0000-4000-8000-000000000003'),
+  0,
+  'agent 3 has NO fleet binding at all — the exemption category, established before it is used');
+
+select pg_temp.claims('27600000-0000-0000-0000-000000000003');
+
+select lives_ok(
+  $$create temp table _c2 as
+    select * from agent_board.grant_board_role(
+      '27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000002','admin')$$,
+  'a NON-FLEET owner still completes a grant [judgement 2: no capability regression]');
+
+select is(
+  pg_temp.role_on('27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000002'),
+  'admin',
+  'and the non-fleet grant actually wrote the role');
+
+select lives_ok(
+  $$create temp table _c3 as
+    select * from agent_board.set_board_role_gate('27620000-0000-4000-8000-000000000002', true)$$,
+  'a NON-FLEET owner still flips the role gate');
+
+select lives_ok(
+  $$create temp table _c4 as
+    select * from agent_board.set_board_authority_ceiling('27620000-0000-4000-8000-000000000002','owner')$$,
+  'a NON-FLEET owner still sets the board authority ceiling');
+
+select is(
+  (select max_grantable_role from agent_board.board_authority_ceilings
+    where board_id = '27620000-0000-4000-8000-000000000002'),
+  'owner',
+  'and the non-fleet ceiling write landed');
+
+-- ===========================================================================
+-- 4. THE PRECONDITION, asserted before the refusal is probed. revoke_fleet_subject('agent')
+--    changes the ledger and the bindings and NOTHING else — the agent stays active and its
+--    signing key stays live. Without this, every refusal below could be passing because some
+--    OTHER predicate started failing, which is the "succeeds/fails for the wrong reason"
+--    trap this repo has been bitten by.
+-- ===========================================================================
+
+select pg_temp.service();
+
+select lives_ok(
+  $$create temp table _rv as
+    select * from agent_board.revoke_fleet_subject(
+      'agent','27610000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000005',
+      'k276 operator revocation')$$,
+  'revoke_fleet_subject(agent, 1) succeeds');
+
+select is(
+  (select count(*)::int from agent_board.fleet_revocation_events
+    where subject_kind = 'agent' and subject_id = '27610000-0000-4000-8000-000000000001'),
+  1,
+  'it wrote exactly one agent-subject ledger row');
+
+select is(
+  (select status from agent_board.agents where id = '27610000-0000-4000-8000-000000000001'),
+  'active',
+  'PRECONDITION: the revoked agent is STILL active — the ledger row is the only authority signal');
+
+select is(
+  (select status from agent_board.agent_signing_keys where id = '27630000-0000-4000-8000-000000000001'),
+  'active',
+  'PRECONDITION: its signing key is STILL live, so #269 revalidation cannot be what refuses below');
+
+select is(
+  (select role from agent_board.board_memberships
+    where board_id = '27620000-0000-4000-8000-000000000001'
+      and agent_id = '27610000-0000-4000-8000-000000000001'),
+  'owner',
+  'PRECONDITION: it is STILL a board owner, so the owner gate cannot be what refuses below');
+
+-- ===========================================================================
+-- 5. THE REFUSAL: unsigned route. This is the wider door — `authenticated`, no gateway.
+-- ===========================================================================
+
+select pg_temp.claims('27600000-0000-0000-0000-000000000001');
+
+select throws_like(
+  $$select * from agent_board.grant_board_role(
+      '27620000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000002','owner')$$,
+  '%fleet_revoked:%grant_board_role%',
+  'a ledger-revoked grantor cannot complete an UNSIGNED grant');
+
+select is(
+  pg_temp.role_on('27620000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000002'),
+  'member',
+  'and the refused unsigned grant wrote nothing');
+
+-- ===========================================================================
+-- 6. THE REFUSAL: signed route. Inherited by construction — the check lives INSIDE
+--    grant_board_role, and signed_grant_board_role is its only other referrer in the database.
+--    Asserted anyway, because "by construction" is a claim until something fails on it.
+-- ===========================================================================
+
+select pg_temp.service();
+
+select throws_like(
+  $$select * from agent_board.signed_grant_board_role(pg_temp.grant_payload('owner'), pg_temp.gwa())$$,
+  '%fleet_revoked:%grant_board_role%',
+  'a ledger-revoked signer cannot complete a SIGNED grant either [Portal #362 divergence test]');
+
+select is(
+  pg_temp.role_on('27620000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000002'),
+  'member',
+  'and the refused signed grant wrote nothing');
+
+-- IDENTITY, not a count. `count(*) = 1` would still read 1 if the ALLOW-side write stopped
+-- recording and the REFUSAL path started recording instead — the two errors cancel, and the
+-- assertion cannot tell the difference. Pinning the surviving row's id to the one the
+-- section-2 allow-side call returned makes both halves observable: a second row breaks the
+-- count half, a substituted row breaks the identity half.
+select is(
+  (select string_agg(se.id::text, ',' order by se.id) from agent_board.signature_evidence se
+    where se.operation = 'grant_board_role'),
+  (select sg.signature_evidence_id::text from _sg sg),
+  'and it recorded no NEW evidence row — the only grant_board_role evidence in the database is '
+  'still exactly the row section 2''s allow-side signed write returned');
+
+select throws_like(
+  $$select * from agent_board.signed_set_board_authority_ceiling(
+      jsonb_build_object('p_board_id','27620000-0000-4000-8000-000000000001',
+                         'p_max_grantable_role','observer'),
+      pg_temp.gwa())$$,
+  '%fleet_revoked:%set_board_authority_ceiling%',
+  'and the SIGNED ceiling wrapper is refused for the same principal');
+
+-- A service_role gateway that SUPPLIES the revoked principal as the grantor argument is
+-- refused too: the gate binds the principal the write is attributed to, not the connection role.
+select throws_like(
+  $$select * from agent_board.grant_board_role(
+      '27620000-0000-4000-8000-000000000001','27610000-0000-4000-8000-000000000002','owner',
+      '27610000-0000-4000-8000-000000000001')$$,
+  '%fleet_revoked:%',
+  'service_role supplying the revoked principal as p_grantor_agent_id is refused too');
+
+-- Back to the authenticated owner: the signed probes above ran as service_role, and the two
+-- setters gate on current_agent_id(), which service_role does not have.
+select pg_temp.claims('27600000-0000-0000-0000-000000000001');
+
+-- The two SETTERS are probed last in this section deliberately. Each refusal probe leaves a
+-- write behind when the gate is removed, and a ceiling written by an earlier probe would then
+-- make the signed grant below fail on _grant_within_ceiling instead of on the gate -- masking
+-- the evidence-row assertion from every mutation. Ordering is load-bearing, not cosmetic.
+select throws_like(
+  $$select * from agent_board.set_board_authority_ceiling(
+      '27620000-0000-4000-8000-000000000001','observer')$$,
+  '%fleet_revoked:%set_board_authority_ceiling%',
+  'a ledger-revoked owner cannot change the board authority ceiling');
+
+select is(
+  (select count(*)::int from agent_board.board_authority_ceilings
+    where board_id = '27620000-0000-4000-8000-000000000001'),
+  0,
+  'and the refused ceiling change wrote no ceiling row (the raise rolled the upsert back)');
+
+select throws_like(
+  $$select * from agent_board.set_board_role_gate('27620000-0000-4000-8000-000000000001', true)$$,
+  '%fleet_revoked:%set_board_role_gate%',
+  'a ledger-revoked owner cannot flip the board role gate');
+
+select is(
+  (select role_gate_enforced from agent_board.boards where id = '27620000-0000-4000-8000-000000000001'),
+  false,
+  'and the refused gate flip left the boards row alone (the raise rolled the UPDATE back)');
+
+-- ===========================================================================
+-- 7. JUDGEMENT 1 — the multi-binding case, and the agreement with the send path.
+--
+--    Agent 4 is bound to machines A and B. Its binding on A is revoked permanently; B stays
+--    active. That is a PER-MACHINE fact. evaluate_fleet_sender_policy answers it by candidate
+--    selection (it finds B and proceeds), so authority must too. Only the AGENT-SUBJECT ledger
+--    row is agent-wide, and then both must refuse. Both halves are asserted on BOTH paths, so
+--    the two can never be right separately and wrong together.
+-- ===========================================================================
+
+select pg_temp.service();
+
+select lives_ok(
+  $$create temp table _rb as
+    select * from agent_board.revoke_fleet_machine_agent_binding(
+      '27660000-0000-4000-8000-00000000004a','27610000-0000-4000-8000-000000000005',
+      'k276 per-machine binding revocation')$$,
+  'agent 4''s binding on machine A is revoked; its binding on machine B stays active');
+
+select is(
+  (select lifecycle_state from agent_board.fleet_machine_agents
+    where id = '27660000-0000-4000-8000-00000000004b'),
+  'active',
+  'PRECONDITION: the machine-B binding really is still active (the multi-binding shape exists)');
+
+select is(
+  (select denial_class from agent_board.evaluate_fleet_sender_policy(
+      '27610000-0000-4000-8000-000000000004','27610000-0000-4000-8000-000000000002',
+      '27650000-0000-4000-8000-00000000000b')),
+  'recipient_policy_denied',
+  'SEND PATH: one revoked binding does not make agent 4 machine_revoked — it gets past the '
+  'revocation check on its surviving binding');
+
+select pg_temp.claims('27600000-0000-0000-0000-000000000004');
+
+select lives_ok(
+  $$create temp table _c5 as
+    select * from agent_board.grant_board_role(
+      '27620000-0000-4000-8000-000000000003','27610000-0000-4000-8000-000000000002','admin')$$,
+  'AUTHORITY PATH agrees: one revoked binding does not remove agent 4''s ability to grant');
+
+select is(
+  pg_temp.role_on('27620000-0000-4000-8000-000000000003','27610000-0000-4000-8000-000000000002'),
+  'admin',
+  'and that grant really landed');
+
+-- Now the AGENT-WIDE act, on the same agent, with a binding still nominally in play.
+select pg_temp.service();
+
+-- Mint an admin link for agent 4 while it is STILL unrevoked. Section 10 redeems it: this is
+-- the outstanding-link case, the one the mint gate structurally cannot reach and the reason
+-- both halves of the invite route are gated.
+select lives_ok(
+  $$create temp table _pre as select * from agent_board.create_invite_link(
+      '27620000-0000-4000-8000-000000000003','admin','joined',5, now() + interval '2 days',
+      '27610000-0000-4000-8000-000000000004')$$,
+  'agent 4 mints an admin invite link BEFORE it is revoked');
+
+select lives_ok(
+  $$create temp table _rv4 as
+    select * from agent_board.revoke_fleet_subject(
+      'agent','27610000-0000-4000-8000-000000000004','27610000-0000-4000-8000-000000000005',
+      'k276 agent-wide revocation')$$,
+  'agent 4 is now revoked as an agent-SUBJECT');
+
+select is(
+  (select denial_class from agent_board.evaluate_fleet_sender_policy(
+      '27610000-0000-4000-8000-000000000004','27610000-0000-4000-8000-000000000002',
+      '27650000-0000-4000-8000-00000000000b')),
+  'machine_revoked',
+  'SEND PATH: the agent-subject ledger row denies agent 4 on the machine it was still bound to');
+
+select pg_temp.claims('27600000-0000-0000-0000-000000000004');
+
+select throws_like(
+  $$select * from agent_board.grant_board_role(
+      '27620000-0000-4000-8000-000000000003','27610000-0000-4000-8000-000000000002','owner')$$,
+  '%fleet_revoked:%',
+  'AUTHORITY PATH agrees: the agent-subject row denies agent 4 too [judgement 1: one answer]');
+
+select is(
+  pg_temp.role_on('27620000-0000-4000-8000-000000000003','27610000-0000-4000-8000-000000000002'),
+  'admin',
+  'and the refused grant left agent 2 where the earlier grant put it');
+
+-- ===========================================================================
+-- 8. NO SUPERSESSION CLAUSE, mirrored from the send path. reactivate_fleet_machine stamps a
+--    supersession point that the sender policy honours for MACHINE-subject events only; it
+--    never un-revokes a sender agent. A future `effective_at` comparison added to the gate
+--    would let a reactivated machine silently restore a revoked agent's authority, so the
+--    absence is pinned as a behaviour, not left to the comment.
+-- ===========================================================================
+
+select pg_temp.service();
+
+select lives_ok(
+  $$create temp table _rm as
+    select * from agent_board.revoke_fleet_subject(
+      'machine','27650000-0000-4000-8000-00000000000b','27610000-0000-4000-8000-000000000005',
+      'k276 machine revocation')$$,
+  'machine B is revoked, so it has a machine-subject ledger row that CAN be superseded');
+
+select lives_ok(
+  $$create temp table _ra as
+    select * from agent_board.reactivate_fleet_machine(
+      '27650000-0000-4000-8000-00000000000b','27610000-0000-4000-8000-000000000005','k276 reactivation')$$,
+  'and it is reactivated, stamping the supersession point AFTER agent 4''s agent-subject revocation');
+
+select pg_temp.claims('27600000-0000-0000-0000-000000000004');
+
+select throws_like(
+  $$select * from agent_board.grant_board_role(
+      '27620000-0000-4000-8000-000000000003','27610000-0000-4000-8000-000000000002','owner')$$,
+  '%fleet_revoked:%',
+  'a machine reactivation does NOT restore a ledger-revoked agent''s authority (no supersession)');
+
+-- ===========================================================================
+-- 9. CLASS ASSERTIONS (catalog-derived, CLAUDE.md rule 1).
+--
+--    The class is not "the three functions #276 happened to edit". It is: every agent_board
+--    function that WRITES a board-authority relation, derived from pg_proc by scanning stripped
+--    bodies (never raw prosrc — #196/#199, a comment or a literal naming a marker must not be
+--    able to satisfy any of these). Both sides are derived and compared, so a new authority
+--    write that omits the gate appears in one set and not the other and the difference NAMES it.
+--
+--    THE MEMBERSHIPS ARM MATCHES ANY INSERT, and the reason is a defect this assertion had.
+--    It first matched `update … set … role =` only. Review found `create_board` — which is
+--    EXECUTE-able by `authenticated` — seeding `role = 'owner'` with an INSERT, and its
+--    `on conflict … do update set role = 'owner'` is an UPDATE of bm.role that the UPDATE-shaped
+--    regex STILL could not match, because the table name precedes `do update`. The description
+--    said "WRITE" while the regex checked one syntax: a comment claiming more than the assertion
+--    does, which is this repo's recorded failure shape.
+--
+--    Shape-blind costs nothing and is strictly stronger. Measured: the any-insert form names the
+--    SAME five membership writers a role-token form does. It subsumes on-conflict by
+--    construction (that clause exists only inside an insert) and it also catches a positional
+--    insert naming no columns, which any column-matching form would miss.
+-- ===========================================================================
+
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and (agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+agent_board\.board_memberships\M'
+        or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.board_memberships\M[^;]*\mset\M[^;]*\mrole\s*='
+        or agent_board_test.stripped_body(p.oid) ~* '(insert\s+into|update)\s+agent_board\.board_authority_ceilings\M'
+        or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.boards\M[^;]*\mset\M[^;]*\mrole_gate_enforced\s*='
+        or agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+agent_board\.board_invite_tokens\M')),
+  '_fedsession_autojoin_default_board,_redeem_unbounded_invite_for_agent,'
+  || '_upsert_board_membership_state,bootstrap_board_owner_memberships,create_board,'
+  || 'create_invite_link,grant_board_role,set_board_authority_ceiling,set_board_role_gate',
+  'the functions that WRITE a board-authority relation — in ANY shape, including a mintable '
+  'invite preset_role — are exactly these nine');
+
+-- EITHER helper counts as consulting the ledger: the invite redeem path calls the UNLOCKED
+-- predicate (see the migration header), so a side that matched only the share-locking assert
+-- would report the gated redeem path as ungated. The two helpers are excluded because they ARE
+-- the gate — _assert_actor_not_fleet_revoked calls _actor_fleet_revoked, so it matches its own
+-- regex.
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname not in ('_assert_actor_not_fleet_revoked', '_actor_fleet_revoked')
+      and agent_board_test.stripped_body(p.oid) ~ '\m(_assert_actor_not_fleet_revoked|_actor_fleet_revoked)\s*\('),
+  '_redeem_unbounded_invite_for_agent,create_invite_link,grant_board_role,'
+  || 'set_board_authority_ceiling,set_board_role_gate',
+  'the functions that consult the fleet revocation ledger are exactly these five');
+
+-- The gate proper: the two sets must differ by EXACTLY the four asserted exemptions, and any
+-- other member of the difference is NAMED in the failure. Each excluded name is licensed by a
+-- positive disposition below, never by the absence of a match.
+select is(
+  (select string_agg(x.proname || ':' || x.why, '; ' order by x.proname)
+     from (
+       select p.proname,
+              case when agent_board_test.stripped_body(p.oid) ~ '\m(_assert_actor_not_fleet_revoked|_actor_fleet_revoked)\s*\('
+                   then 'consults the ledger but writes no authority relation'
+                   else 'writes an authority relation with NO ledger gate'
+              end as why
+         from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+        where n.nspname = 'agent_board'
+          and p.proname not in (
+                -- the four asserted exemptions...
+                '_upsert_board_membership_state', 'create_board',
+                '_fedsession_autojoin_default_board', 'bootstrap_board_owner_memberships',
+                -- ...and the two helpers, which ARE the gate rather than users of it
+                '_assert_actor_not_fleet_revoked', '_actor_fleet_revoked')
+          and ((agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+agent_board\.board_memberships\M'
+             or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.board_memberships\M[^;]*\mset\M[^;]*\mrole\s*='
+             or agent_board_test.stripped_body(p.oid) ~* '(insert\s+into|update)\s+agent_board\.board_authority_ceilings\M'
+             or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.boards\M[^;]*\mset\M[^;]*\mrole_gate_enforced\s*='
+             or agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+agent_board\.board_invite_tokens\M')
+              <> (agent_board_test.stripped_body(p.oid) ~ '\m(_assert_actor_not_fleet_revoked|_actor_fleet_revoked)\s*\('))
+     ) x),
+  null,
+  'no function writes an authority relation without the ledger gate, or vice versa');
+
+-- ---------------------------------------------------------------------------
+-- EXEMPTION A — _upsert_board_membership_state (the unauthorized membership primitive).
+--
+-- The signature is asserted as an EXACT STRING, not as a `role` word match. `_` is a word
+-- CHARACTER in POSIX regex, so there is no word boundary between `p_` and `role`:
+--   'p_role text'         ~ '\mrole\M'  ->  false
+--   'p_grantee_role text' ~ '\mrole\M'  ->  false
+-- and every parameter in this codebase is `p_*`. The word-match form this assertion first used
+-- would therefore have stayed GREEN while somebody added `p_role` and threaded it into the role
+-- write — destroying the very claim the assertion exists to make.
+--
+-- string_agg over ALL oids of the name, not a single-row lookup: `create or replace` cannot add
+-- a parameter, so that mutation can only land as a new OVERLOAD, and a scalar subquery over two
+-- oids ABORTS the file instead of failing one assertion (CLAUDE.md rule 3).
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(pg_get_function_identity_arguments(p.oid), ' | ' order by p.oid)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_upsert_board_membership_state'),
+  'p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid, '
+  || 'p_metadata jsonb, p_membership_id uuid, p_event_kind text',
+  'EXEMPTION A1: _upsert_board_membership_state takes EXACTLY these parameters — no role among '
+  'them, and no overload carrying one');
+
+select is(
+  (select string_agg(distinct coalesce(pg_get_userbyid(nullif(a.grantee,0)),'PUBLIC'), ','
+            order by coalesce(pg_get_userbyid(nullif(a.grantee,0)),'PUBLIC'))
+     from pg_proc p, aclexplode(p.proacl) a
+    where p.oid = (select p2.oid from pg_proc p2 join pg_namespace n2 on n2.oid = p2.pronamespace
+                    where n2.nspname = 'agent_board' and p2.proname = '_upsert_board_membership_state')
+      and a.privilege_type = 'EXECUTE'),
+  'postgres,service_role',
+  'EXEMPTION A2: and it is not EXECUTE-able by authenticated, anon or PUBLIC');
+
+select pg_temp.service();
+
+select lives_ok(
+  $$create temp table _cl as select agent_board._upsert_board_membership_state(
+      '27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000003',
+      'left','27610000-0000-4000-8000-000000000003','{}'::jsonb)$$,
+  'EXEMPTION A3 (setup): the owner of board 2 is moved to a terminal state');
+
+select lives_ok(
+  $$create temp table _cl2 as select agent_board._upsert_board_membership_state(
+      '27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000003',
+      'joined','27610000-0000-4000-8000-000000000003','{}'::jsonb)$$,
+  'EXEMPTION A3 (act): and re-entered as active');
+
+select is(
+  pg_temp.role_on('27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000003'),
+  'member',
+  'EXEMPTION A3: its only role write is the ROLERESET clamp to the table default — it DEMOTES '
+  'an owner and can never confer authority, which is why it needs no ledger gate');
+
+
+-- EXEMPTION A4 — the claim A1 could not make on its own.
+--
+-- A1 pins the HELPER's signature, and A3 demonstrates the ROLERESET clamp. Neither establishes
+-- the broader sentence the exemption actually rests on: "no caller can hand this helper a role".
+-- A1 covers the helper; A3 covers one code path. The gap is every OTHER function that reaches
+-- the primitive — a caller that gained a role parameter and threaded it through would leave
+-- both green while making the exemption false.
+--
+-- So the whole caller set is swept, in the EXACT-signature form rather than a word match (`_`
+-- is a word character in POSIX regex, so `\mrole\M` does not match `p_role`, and every
+-- parameter here is `p_*` — the same evasion G2 closed). A new caller, a removed caller, or an
+-- existing caller gaining ANY parameter all change this string, and the failure prints the set.
+--
+-- Swept and clean at the time of writing: not one of the five declares a role-bearing
+-- parameter. `invite_board_member` and `update_board_membership` admit at the membership floor
+-- or move membership STATE; a `member` holds no authority to grant anything onward. That is why
+-- they are outside the ratified criterion and are recorded as a bounded residual in the
+-- migration header rather than gated here.
+select is(
+  (select string_agg(p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')', ' | '
+                     order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname <> '_upsert_board_membership_state'
+      and agent_board_test.stripped_body(p.oid) ~ '\m_upsert_board_membership_state\s*\('),
+  'invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)'
+  || ' | join_board(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid, p_metadata jsonb)'
+  || ' | request_join_board(p_board_id uuid, p_agent_id uuid, p_metadata jsonb)'
+  || ' | resolve_board_request(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid, p_metadata jsonb)'
+  || ' | update_board_membership(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_metadata jsonb)',
+  'EXEMPTION A4: EVERY caller of _upsert_board_membership_state takes EXACTLY these parameters '
+  '— not one declares a role, so "no caller can hand it one" is checked rather than argued');
+
+-- ---------------------------------------------------------------------------
+-- EXEMPTION B — create_board, the ONE authenticated-callable member of the class.
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(pg_get_function_identity_arguments(p.oid), ' | ' order by p.oid)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'create_board'),
+  'p_created_by_agent_id uuid, p_slug text, p_name text, p_description text, p_metadata jsonb, '
+  || 'p_visibility text',
+  'EXEMPTION B1: create_board takes EXACTLY these parameters — no role among them, and no '
+  'overload carrying one, so the owner seat it writes is a literal and not a caller choice');
+
+select ok(
+  agent_board_test.stripped_body('agent_board.create_board(uuid,text,text,text,jsonb,text)'::regprocedure, true)
+    like '%values (v_board.id, v_board.created_by_agent_id, ''joined'', ''owner'', v_board.created_by_agent_id)%',
+  'EXEMPTION B2: the seat it writes is the literal owner for the board OWN created_by_agent_id '
+  '— the resolved actor, seeding itself on a board it just inserted');
+
+select ok(
+  agent_board_test.stripped_body('agent_board.create_board(uuid,text,text,text,jsonb,text)'::regprocedure, true)
+    like '%board slug already in use%'
+  and strpos(agent_board_test.stripped_body('agent_board.create_board(uuid,text,text,text,jsonb,text)'::regprocedure, true),
+             'update agent_board.boards as b')
+    < strpos(agent_board_test.stripped_body('agent_board.create_board(uuid,text,text,text,jsonb,text)'::regprocedure, true),
+             'insert into agent_board.board_memberships'),
+  'EXEMPTION B3: the slug-COLLISION branch refuses a non-owner and updates the boards row '
+  'BEFORE the else-branch membership insert — the seat is on the fresh-board path only, so it '
+  'cannot elevate a membership on a pre-existing board');
+
+-- ...and the residual, asserted as BEHAVIOUR so #280 closing flips a test rather than a comment.
+select pg_temp.claims('27600000-0000-0000-0000-000000000001');
+
+select lives_ok(
+  $$create temp table _cb as select * from agent_board.create_board(
+      '27610000-0000-4000-8000-000000000001','k276-residual-board','K276 Residual Board')$$,
+  'RESIDUAL (#280): a ledger-revoked agent CAN still create a board and be seeded its owner');
+
+select is(
+  (select bm.role from agent_board.board_memberships bm
+     join agent_board.boards b on b.id = bm.board_id
+    where b.slug = 'k276-residual-board'
+      and bm.agent_id = '27610000-0000-4000-8000-000000000001'),
+  'owner',
+  'RESIDUAL (#280): and the owner seat really landed — this is the manufacture-new-authority '
+  'gap #276 does NOT close, measured rather than described');
+
+select throws_like(
+  $$select * from agent_board.grant_board_role(
+      (select id from agent_board.boards where slug = 'k276-residual-board'),
+      '27610000-0000-4000-8000-000000000002','admin')$$,
+  '%fleet_revoked:%',
+  'but the gate still holds on the board it just created: it cannot GRANT there either, even '
+  'as that board owner with no ceiling row');
+
+-- ---------------------------------------------------------------------------
+-- EXEMPTIONS C and D — the two remaining service_role-only seeders. (What used to be
+-- exemption C, _redeem_unbounded_invite_for_agent, is now GATED — see section 10.)
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(p.proname || '=' ||
+            has_function_privilege('authenticated', p.oid, 'EXECUTE')::text, ',' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname in ('_fedsession_autojoin_default_board','bootstrap_board_owner_memberships')),
+  '_fedsession_autojoin_default_board=false,bootstrap_board_owner_memberships=false',
+  'EXEMPTIONS C/D: neither remaining seeder is EXECUTE-able by authenticated');
+
+select ok(
+  agent_board_test.stripped_body('agent_board._fedsession_autojoin_default_board(agent_board.identity_providers,uuid)'::regprocedure, true)
+    like '%p_provider.default_board_id, p_agent_id, ''member'', ''joined''%',
+  'EXEMPTION C: the fedsession autojoin seeds the literal member — the BASE role, which confers '
+  'no authority at all');
+
+select is(
+  (select string_agg(pg_get_function_identity_arguments(p.oid), ' | ' order by p.oid)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'bootstrap_board_owner_memberships'),
+  '',
+  'EXEMPTION D: bootstrap_board_owner_memberships takes NO arguments — it backfills the board '
+  'own recorded owner_agent_id and can name no other principal');
+
+
+-- ===========================================================================
+-- 10. G3 — THE INVITE ROUTE. An admin-preset link is a deferred grant of admin, so a
+--     ledger-revoked agent must not be able to mint one, and an outstanding one must stop
+--     conferring. Both halves are driven, and the discriminating pair against the adjacent
+--     R-LINK-2 check is asserted explicitly: the creator here is ACTIVE (so R-LINK-2 passes)
+--     and only the ledger row refuses.
+--
+--     Agent 3 is the NON-FLEET owner of board 2 and is used for the allow side; agent 1 is the
+--     ledger-revoked owner of board 1. Agent 5 redeems.
+-- ===========================================================================
+
+-- ALLOW SIDE FIRST: an unrevoked owner still mints and the link still redeems, so the gate
+-- cannot be passing below merely because invites are broken.
+select pg_temp.claims('27600000-0000-0000-0000-000000000006');
+
+select lives_ok(
+  $$create temp table _mk as select * from agent_board.create_invite_link(
+      '27620000-0000-4000-8000-000000000004','admin','joined',5,
+      now() + interval '2 days')$$,
+  'ALLOW: a NON-REVOKED owner still mints an admin invite link');
+
+select is(
+  (select preset_role from _mk),
+  'admin',
+  'and the minted link really carries the admin preset');
+
+select pg_temp.claims('27600000-0000-0000-0000-000000000005');
+
+select lives_ok(
+  $$create temp table _rd as select * from agent_board.redeem_invite_link((select code from _mk))$$,
+  'ALLOW: and it redeems, conferring admin on the redeemer');
+
+select is(
+  pg_temp.role_on('27620000-0000-4000-8000-000000000004','27610000-0000-4000-8000-000000000005'),
+  'admin',
+  'and the admin seat really landed — this is the capability #276 must not regress');
+
+-- MINT, REFUSED. Agent 1 is ledger-revoked (section 4) and still an ACTIVE owner of board 1.
+select pg_temp.claims('27600000-0000-0000-0000-000000000001');
+
+select throws_like(
+  $$select * from agent_board.create_invite_link(
+      '27620000-0000-4000-8000-000000000001','admin','joined',5, now() + interval '2 days')$$,
+  '%fleet_revoked:%create_invite_link%',
+  'G3 MINT: a ledger-revoked owner cannot mint an admin invite link');
+
+select is(
+  (select count(*)::int from agent_board.board_invite_tokens
+    where board_id = '27620000-0000-4000-8000-000000000001'),
+  0,
+  'and the refused mint left NO token behind — the raise discarded it, so no code escaped');
+
+select throws_like(
+  $$select * from agent_board.create_invite_link(
+      '27620000-0000-4000-8000-000000000001','member','joined',5, now() + interval '2 days')$$,
+  '%fleet_revoked:%create_invite_link%',
+  'and a member-preset link is refused too: the gate is on the principal, not on the preset');
+
+-- REDEEM, REFUSED — via a link minted BEFORE the creator was revoked, which is the case the
+-- mint gate cannot reach and the reason both halves exist.
+-- The link was minted in section 7 while agent 4 was still unrevoked; agent 4 has since been
+-- ledger-revoked there. Assert the discriminating precondition: R-LINK-2
+-- passes for it, so a refusal below can only be the #276 clause.
+select is(
+  (select status from agent_board.agents where id = '27610000-0000-4000-8000-000000000004'),
+  'active',
+  'PRECONDITION: the link creator is STILL active, so R-LINK-2 passes and only the ledger '
+  'clause can refuse the redemption');
+
+select pg_temp.claims('27600000-0000-0000-0000-000000000005');
+
+select throws_like(
+  $$select * from agent_board.redeem_invite_link((select code from _pre))$$,
+  'invite is not usable',
+  'G3 REDEEM: an outstanding link from a ledger-revoked creator stops conferring — and raises '
+  'the UNIFORM message, not a fleet_revoked prefix, so a code-bearer learns nothing about the '
+  'creator lifecycle');
+
+select is(
+  (select count(*)::int from agent_board.board_memberships
+    where board_id = '27620000-0000-4000-8000-000000000003'
+      and agent_id = '27610000-0000-4000-8000-000000000005'),
+  0,
+  'and the refused redemption wrote NO membership');
+
+select is(
+  (select uses_count from agent_board.board_invite_tokens where code = (select code from _pre)),
+  0,
+  'and consumed no use');
+
+select is(
+  (select count(*)::int from agent_board.board_invite_redemptions r
+     join agent_board.board_invite_tokens t on t.id = r.invite_id
+    where t.code = (select code from _pre)),
+  0,
+  'and left no redemption ledger row');
+
+-- The REDEEMER's own revocation is NOT a bar: receiving a membership is not conferring one.
+select pg_temp.service();
+
+select lives_ok(
+  $$create temp table _mk2 as select * from agent_board.create_invite_link(
+      '27620000-0000-4000-8000-000000000004','member','joined',5, now() + interval '2 days',
+      '27610000-0000-4000-8000-000000000006')$$,
+  'a NON-revoked creator mints a second link on board 4');
+
+select pg_temp.claims('27600000-0000-0000-0000-000000000001');
+
+select lives_ok(
+  $$create temp table _rd2 as select * from agent_board.redeem_invite_link((select code from _mk2))$$,
+  'a ledger-revoked REDEEMER may still redeem: receiving authority is not conferring it, and '
+  'the gate is keyed on the creator');
+
+select is(
+  (select membership_state from agent_board.board_memberships
+    where board_id = '27620000-0000-4000-8000-000000000004'
+      and agent_id = '27610000-0000-4000-8000-000000000001'),
+  'joined',
+  'and that redemption really placed the revoked redeemer');
+
+-- The residual companion: the board a revoked agent CAN still create is not a way back in.
+select throws_like(
+  $$select * from agent_board.create_invite_link(
+      (select id from agent_board.boards where slug = 'k276-residual-board'),
+      'admin','joined',5, now() + interval '2 days')$$,
+  '%fleet_revoked:%',
+  'RESIDUAL (#280) is contained: on the board it just created, a revoked agent still cannot '
+  'mint a link either — so the residual confers nothing on anyone else');
+
+
+-- The RESIDUAL BOUND rests on a lock that is already in this function: the token FOR UPDATE is
+-- its FIRST statement, before the ledger read, so two redemptions of the SAME token cannot both
+-- sit between their ledger read and their commit. Delete that ordering and the disclosure in
+-- the migration header ("at most one per outstanding token") stops being true, which is why it
+-- is pinned here rather than asserted in prose. Both markers guarded with `> 0` (#198).
+-- Two claims, not one, and the first version of this assertion made only the second. It
+-- compared the POSITION of the token table reference against the ledger read — a proxy for
+-- "locks the token first" that says nothing about whether the read is a lock at all.
+-- Mutation-tested: demoting `for update` to a plain read left it GREEN while destroying the
+-- per-token bound it exists to defend. It now requires the token select to BE a lock, requires
+-- that lock to be the function's only one (so `for update` is an unambiguous position marker),
+-- and only then compares positions. Both markers guarded with `> 0` (#198).
+select ok(
+  agent_board_test.stripped_body('agent_board._redeem_unbounded_invite_for_agent(text,uuid)'::regprocedure)
+    ~ 'from agent_board\.board_invite_tokens t[^;]*\mfor update\M'
+  and (select count(*) from regexp_matches(
+         agent_board_test.stripped_body('agent_board._redeem_unbounded_invite_for_agent(text,uuid)'::regprocedure),
+         'for update', 'g')) = 1
+  and strpos(agent_board_test.stripped_body('agent_board._redeem_unbounded_invite_for_agent(text,uuid)'::regprocedure),
+         'for update') > 0
+  and strpos(agent_board_test.stripped_body('agent_board._redeem_unbounded_invite_for_agent(text,uuid)'::regprocedure),
+         'agent_board._actor_fleet_revoked(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board._redeem_unbounded_invite_for_agent(text,uuid)'::regprocedure),
+         'for update')
+    < strpos(agent_board_test.stripped_body('agent_board._redeem_unbounded_invite_for_agent(text,uuid)'::regprocedure),
+         'agent_board._actor_fleet_revoked('),
+  'the redeem path LOCKS the token (FOR UPDATE, its only row lock) before it reads the ledger — '
+  'which is what bounds the accepted window to one redemption PER OUTSTANDING TOKEN rather '
+  'than per creator');
+
+-- FLEET ONBOARDING INHERITS THE REDEEM GATE, through _redeem_fleet_invite_for_agent. This is a
+-- real behaviour change on a live path: an onboarding invite minted by a since-revoked owner
+-- stops admitting. Asserted from the call graph rather than left for an operator to discover.
+select ok(
+  agent_board_test.stripped_body('agent_board._redeem_fleet_invite_for_agent(text,uuid)'::regprocedure)
+    ~ '\m_redeem_unbounded_invite_for_agent\s*\(',
+  'the FLEET redemption core delegates to the gated unbounded core, so fleet onboarding '
+  'inherits the creator-revocation gate by construction');
+
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid) ~ '\m_redeem_unbounded_invite_for_agent\s*\('),
+  '_redeem_fleet_invite_for_agent,_redeem_invite_for_agent',
+  'and those are the only two callers of it, so no redemption route bypasses the gate');
+
+-- The gate's serialization rests on a claim about OTHER functions: every writer of an
+-- agent-subject ledger row takes the agents row lock BEFORE the write, so the FOR SHARE in the
+-- helper conflicts with it. Pinned from the catalog, so a future ledger writer that skips the
+-- lock fails here and names itself instead of silently reopening the TOCTOU.
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid) ~* '(insert\s+into|update)\s+agent_board\.fleet_revocation_events\M'),
+  '_revoke_agent_principal,revoke_fleet_subject',
+  'the writers of the fleet revocation ledger are exactly these two');
+
+-- Both markers guarded with `> 0`: a bare `strpos(A) < strpos(B)` is `0 < N` = TRUE when the
+-- LEFT marker is absent, so it passes on a body it no longer matches (#198).
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb)'::regprocedure),
+         'agent_board.agents a where a.id = p_subject_id for update') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb)'::regprocedure),
+         'insert into agent_board.fleet_revocation_events') > 0
+  and strpos(agent_board_test.stripped_body('agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb)'::regprocedure),
+         'agent_board.agents a where a.id = p_subject_id for update')
+    < strpos(agent_board_test.stripped_body('agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb)'::regprocedure),
+         'insert into agent_board.fleet_revocation_events'),
+  'revoke_fleet_subject locks the agents row BEFORE writing the ledger — what the gate''s FOR SHARE conflicts with');
+
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
+         'agent_board.agents a where a.id = p_agent_id for update') > 0
+  and strpos(agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
+         'insert into agent_board.fleet_revocation_events') > 0
+  and strpos(agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
+         'agent_board.agents a where a.id = p_agent_id for update')
+    < strpos(agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure),
+         'insert into agent_board.fleet_revocation_events'),
+  '_revoke_agent_principal locks the agents row BEFORE writing the ledger too');
+
+-- The lock the gate itself takes, and its MODE. FOR KEY SHARE would not conflict with the FOR
+-- NO KEY UPDATE a plain status change takes; the isolation spec is what proves the conflict,
+-- this is what stops the mode being quietly weakened.
+select ok(
+  agent_board_test.stripped_body('agent_board._assert_actor_not_fleet_revoked(uuid,text)'::regprocedure)
+    ~ 'agent_board\.agents a where a\.id = p_actor_agent_id for share',
+  'the gate takes FOR SHARE on the actor''s agents row (not KEY SHARE, not a bare read)');
+
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board._assert_actor_not_fleet_revoked(uuid,text)'::regprocedure),
+         'for share') > 0
+  and strpos(agent_board_test.stripped_body('agent_board._assert_actor_not_fleet_revoked(uuid,text)'::regprocedure),
+         'agent_board._actor_fleet_revoked(') > 0
+  and strpos(agent_board_test.stripped_body('agent_board._assert_actor_not_fleet_revoked(uuid,text)'::regprocedure),
+         'for share')
+    < strpos(agent_board_test.stripped_body('agent_board._assert_actor_not_fleet_revoked(uuid,text)'::regprocedure),
+         'agent_board._actor_fleet_revoked('),
+  'and it takes that lock BEFORE reading the ledger, which is the whole point of taking it');
+
+-- The split, asserted from the catalog. The predicate lives in ONE function so the locked and
+-- unlocked callers cannot drift into asking two different questions, and the UNLOCKED one must
+-- stay unlocked — an `agents` lock reappearing in it is the deadlock the header enumerates.
+select ok(
+  agent_board_test.stripped_body('agent_board._actor_fleet_revoked(uuid)'::regprocedure)
+    ~ 'agent_board\.fleet_revocation_events'
+  and agent_board_test.stripped_body('agent_board._actor_fleet_revoked(uuid)'::regprocedure)
+    !~ '\mfor\s+(share|update|key\s+share|no\s+key\s+update)\M',
+  'the unlocked predicate reads the ledger and takes NO row lock — what makes it safe to call '
+  'from the invite redeem path, which is reached holding a boards lock');
+
+select is(
+  (select string_agg(distinct coalesce(pg_get_userbyid(nullif(a.grantee,0)),'PUBLIC'), ','
+            order by coalesce(pg_get_userbyid(nullif(a.grantee,0)),'PUBLIC'))
+     from pg_proc p, aclexplode(p.proacl) a
+    where p.oid = 'agent_board._actor_fleet_revoked(uuid)'::regprocedure
+      and a.privilege_type = 'EXECUTE'),
+  'postgres,service_role',
+  'and the unlocked predicate is service_role-only, like the assert it was split out of');
+
+-- The gate must not have acquired a supersession clause. `effective_at` appearing in the body
+-- would mean a machine reactivation could restore a revoked agent's authority.
+select ok(
+  agent_board_test.stripped_body('agent_board._assert_actor_not_fleet_revoked(uuid,text)'::regprocedure)
+    !~ '\m(effective_at|reactivated_at)\M',
+  'the gate has no supersession clause, matching the send path''s agent-subject predicate');
+
+select finish();
+rollback;