@consiliency/agent-board-schema 1.25.0 → 1.28.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/fixtures/already-applied.json +8 -0
- package/migrations/20260908000100_agent_board_signer_lifecycle_revalidation.sql +451 -0
- package/migrations/20260909000100_agent_board_ledger_revoked_authority.sql +1036 -0
- package/package.json +1 -1
- package/schema-manifest.json +21 -3
- package/src/tooling.test.mjs +2 -2
- package/tests/agent_board_atomic_fleet_onboarding.test.sql +23 -2
- package/tests/agent_board_ledger_authority.test.sql +1010 -0
- package/tests/agent_board_signed_authority_provenance.test.sql +24 -1
- package/tests/agent_board_signer_lifecycle.test.sql +715 -0
- package/tests/catalog/p_metadata_parameters.json +12 -0
- package/tests/isolation/expected/ledger_authority_revoke.out +483 -0
- package/tests/isolation/expected/signed_grant_onboarding_deadlock.out +220 -0
- package/tests/isolation/expected/signer_lifecycle_revoke.out +307 -0
- package/tests/isolation/specs/ledger_authority_revoke.spec +290 -0
- package/tests/isolation/specs/signed_grant_onboarding_deadlock.spec +159 -0
- package/tests/isolation/specs/signer_lifecycle_revoke.spec +186 -0
|
@@ -26,7 +26,7 @@ set search_path = extensions, public, agent_board;
|
|
|
26
26
|
|
|
27
27
|
begin;
|
|
28
28
|
|
|
29
|
-
select plan(
|
|
29
|
+
select plan(40);
|
|
30
30
|
|
|
31
31
|
create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
|
|
32
32
|
begin
|
|
@@ -293,6 +293,9 @@ select throws_like(
|
|
|
293
293
|
'%exceeds grantor role or board authority ceiling%',
|
|
294
294
|
'the wrapper grants no authority: a member signer still cannot mint an owner');
|
|
295
295
|
|
|
296
|
+
-- This probe named a 'failed' verification but carried NO agent_id, so it was refused for
|
|
297
|
+
-- ACTOR ABSENCE and never once exercised the failed status -- a description claiming what no
|
|
298
|
+
-- assertion backed. It is now two probes, each refused for the reason it names.
|
|
296
299
|
select throws_like(
|
|
297
300
|
$$select * from agent_board.signed_grant_board_role(
|
|
298
301
|
jsonb_build_object(
|
|
@@ -303,6 +306,26 @@ select throws_like(
|
|
|
303
306
|
'%actor_mismatch%',
|
|
304
307
|
'a gateway decision naming no actor cannot write evidence at all');
|
|
305
308
|
|
|
309
|
+
-- The status probe proper: the SAME decision the allow-side probes use -- verified signer,
|
|
310
|
+
-- live key, an owner granting a role the inner gates permit -- with only verification_status
|
|
311
|
+
-- flipped to 'failed'. Without the #269 verification check this grant COMPLETES and mints an
|
|
312
|
+
-- evidence row recording 'failed' beside a mutation that succeeded.
|
|
313
|
+
select throws_like(
|
|
314
|
+
$$select * from agent_board.signed_grant_board_role(
|
|
315
|
+
jsonb_build_object(
|
|
316
|
+
'p_board_id', '24720000-0000-4000-8000-000000000001',
|
|
317
|
+
'p_agent_id', '24710000-0000-4000-8000-000000000002',
|
|
318
|
+
'p_grantee_role', 'admin'),
|
|
319
|
+
pg_temp.gw('24710000-0000-4000-8000-000000000001')
|
|
320
|
+
|| jsonb_build_object('verification_status','failed'))$$,
|
|
321
|
+
'%signer_not_verified%',
|
|
322
|
+
'a FAILED verification is refused for its STATUS, by a signer who is otherwise fully entitled');
|
|
323
|
+
|
|
324
|
+
select is(
|
|
325
|
+
(select count(*)::int from agent_board.signature_evidence where operation = 'grant_board_role'),
|
|
326
|
+
1,
|
|
327
|
+
'and the failed-verification attempt minted no evidence row');
|
|
328
|
+
|
|
306
329
|
-- ===========================================================================
|
|
307
330
|
-- 5. signed_set_board_authority_ceiling.
|
|
308
331
|
-- ===========================================================================
|