@consiliency/agent-board-schema 1.27.0 → 1.35.0

package/tests/agent_board_fedsession_stored_identity_gate.test.sql

@@ -0,0 +1,606 @@
+-- Consiliency/message-board#246 pgTAP: the federated-human return path returns an
+-- existing agent ONLY when that agent's STORED (issuer, subject) equals the pair the
+-- caller presented.
+--
+-- WHY THE COLLISION HERE IS CONSTRUCTED, NOT DERIVED. The owner uid is a truncated
+-- sha256 over a serialization of (issuer, subject). When this file shipped that
+-- serialization was `issuer || '|' || subject`, whose AMBIGUITY was reachable: an OPERATOR
+-- registering a second provider whose issuer carried the complementary suffix produced two
+-- real pairs on one uid. #246 change 2 (20260916000100) replaced it with a length-prefixed
+-- form and that route is gone -- so today reaching one uid from two pairs would be a
+-- preimage-class result against SHA-256, which is not something a test can do. EITHER WAY
+-- this file's gate is the property under test and it does not depend on which
+-- serialization is in force, which is the point: the state is built directly instead: enroll a real
+-- federated human, then REWRITE the (issuer, subject) stored in its
+-- metadata->'federation' stamp. The uid, the handle and the auth.users row are
+-- untouched and still derive from the caller's pair.
+--
+-- That is sound for THIS branch, and the reason is narrow enough to state exactly.
+-- The code under test reads two things and nothing else: the agent found on the
+-- derived uid, and the caller's p_issuer/p_subject. It never re-derives, never
+-- re-hashes, and never consults how the row came to be on that uid. At the point of
+-- the check, a constructed stamp mismatch and a real hash collision are the SAME
+-- STATE. What this file therefore does NOT prove is that a collision is reachable --
+-- that is the encoding question, which is a separate change (#246 change 2) with its
+-- own migration and Portal coordination. This file proves that IF two principals ever
+-- land on one uid, the second is refused.
+--
+-- WHAT IS PINNED STRUCTURALLY RATHER THAN BEHAVIOURALLY, said plainly. There are TWO
+-- return sites: step (7)'s idempotent branch and step (8)'s `exception when
+-- unique_violation` race handler. Only (7) is reachable from a single session -- (7)'s
+-- select is unfiltered on the uid, so any already-committed row on that uid is
+-- intercepted there and the insert in (8) is never attempted. Reaching (8) requires a
+-- concurrent transaction to commit the agent inside the window between (7)'s select
+-- and (8)'s insert. So (8a) is pinned by assertion 5 below, which locates the gate
+-- INSIDE the handler positionally -- not by a count, which cannot tell "both sites
+-- gated" from "one site gated twice" (see the note above assertion 3). A differential
+-- behavioural test of (8a) is a two-session isolationtester follow-up, not something
+-- this file claims.
+--
+-- Runs as postgres (service_role-equivalent), mirroring agent_board_fedsession.test.sql.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(29);
+
+-- ---------------------------------------------------------------------------
+-- Section A -- the CLASS, derived from pg_proc, not from a list written here
+-- ---------------------------------------------------------------------------
+-- Class C: an agent_board function that BOTH derives a `fed-human-` owner handle
+-- AND reads agent_board.agents keyed on auth_user_id -- i.e. a function that can
+-- hand back a row found only by the ambiguous derivation. Membership is computed
+-- from the catalog on every run, so a NEW function of this shape fails EC-1/EC-2
+-- and NAMES ITSELF rather than being silently outside a hand-written list.
+--
+-- Read through agent_board_test.stripped_body(oid, true) (#196/#199): comments and
+-- quoted identifiers are removed in one pass so this file's own prose -- which
+-- contains the words `fed-human-` and `auth_user_id` -- cannot satisfy it. Literals
+-- are KEPT deliberately, and that is the correct mode here rather than a default:
+-- every marker below IS a literal (the derivation call, the `'{federation,issuer}'`
+-- jsonb path, the raise message, the delegation call names), so stripping literals
+-- would make every assertion in sections A and A2 vacuous.
+--
+-- THE CLASS MARKER MOVED IN #246 (change 2 of 3), and the class did not. When this file
+-- shipped, "derives a fed-human owner uid" was detectable as the `fed-human-` prefix
+-- literal, because every site carried its own copy of the derivation. The derivation is
+-- now the single function agent_board._federated_identity_slug, so that literal survives
+-- in exactly one place and would make this scan find NOTHING -- passing every
+-- "every member has X" assertion vacuously, which is the failure mode assertion 1
+-- exists to stop. The marker is therefore the CALL, and membership is byte-for-byte the
+-- same set it was before: the same five derivation sites, the same one class member.
+create temp view _c246 as
+select p.oid, p.proname, agent_board_test.stripped_body(p.oid, true) as body
+  from pg_proc p
+  join pg_namespace n on n.oid = p.pronamespace
+ where n.nspname = 'agent_board'
+   and p.prokind in ('f', 'p')
+   and agent_board_test.stripped_body(p.oid, true) like '%\_federated\_identity\_slug(%'
+   and agent_board_test.stripped_body(p.oid, true) ~ 'agent_board\.agents[^;]*auth_user_id\s*=';
+
+-- 1 -- the class is NOT EMPTY. A class scan that finds nothing passes every
+-- "every member has X" assertion vacuously; this is the assertion that stops that.
+select is((select count(*)::int from _c246), 1,
+  'exactly one agent_board function both derives a fed-human owner uid and reads agents on auth_user_id');
+
+-- 2 -- and it is the one we think it is, named POSITIVELY (not "no unexpected members").
+select is((select string_agg(proname, ',' order by proname) from _c246),
+  '_enroll_federated_human_after_revocation_gate',
+  'that function is _enroll_federated_human_after_revocation_gate');
+
+-- BOTH return sites carry the gate -- asserted PER SITE, not as a count.
+--
+-- A count of 2 was the first version of this and it was FAIL-OPEN in a way worth
+-- recording, because it is the shape CLAUDE.md rule 1 warns about: `count = 2` is
+-- equally satisfied by two gates at step (7) and NONE at step (8). The count cannot
+-- tell "both sites gated" from "one site gated twice", so it does not assert the
+-- property whose name it carries. Mutation M7 builds exactly that body and the count
+-- stays green while the two positional assertions below go red.
+--
+-- The body is split on the handler's own `exception when unique_violation`, which is
+-- the syntactic boundary between the two return sites: everything before it is step
+-- (7)'s idempotent branch, everything after it is step (8)'s race handler.
+-- Every assertion below is written as EVERY-MEMBER-vs-ALL-MEMBERS, comparing two
+-- name lists rather than reading a scalar out of the class. That is not style: the
+-- scalar form (`(select pre_handler from _c246parts)`) was the first version, and
+-- mutation M8 -- which adds a SECOND function to the class -- made it raise
+-- `more than one row returned by a subquery`, ABORTING the file after 2 of 27
+-- assertions. The mutation was still caught, by assertions 1 and 2, but 25
+-- assertions died with it, which is precisely the shape CLAUDE.md rule 3 exists to
+-- stop. In this form a new class member reds these assertions and is NAMED in the
+-- `have:` line instead of killing the run.
+create temp view _c246parts as
+select proname,
+       (regexp_split_to_array(body, 'exception\s+when\s+unique_violation'))[1] as pre_handler,
+       (regexp_split_to_array(body, 'exception\s+when\s+unique_violation'))[2] as in_handler,
+       array_length(regexp_split_to_array(body, 'exception\s+when\s+unique_violation'), 1) as parts
+  from _c246;
+
+-- 3 -- the split boundary is UNAMBIGUOUS for every member. With a second `exception
+-- when unique_violation` the two assertions below would be reading arbitrary halves,
+-- so this is asserted before anything is read from them.
+select is(
+  (select string_agg(proname, ',' order by proname) from _c246parts where parts = 2),
+  (select string_agg(proname, ',' order by proname) from _c246),
+  'every class member has exactly one `exception when unique_violation`, so the per-site split is unambiguous');
+
+-- 4 -- SITE (7a): the idempotent branch, everything before the handler.
+select is(
+  (select string_agg(proname, ',' order by proname) from _c246parts
+    where pre_handler ~ 'coalesce\(\s*v_existing\.metadata\s*#>>\s*''\{federation,issuer\}''\s*=\s*p_issuer\s+and\s+v_existing\.metadata\s*#>>\s*''\{federation,subject\}''\s*=\s*p_subject\s*,\s*false\s*\)'),
+  (select string_agg(proname, ',' order by proname) from _c246),
+  'every class member carries the gate at return site (7a) -- the idempotent branch, BEFORE the unique_violation handler');
+
+-- 5 -- SITE (8a): the race handler, everything after. This is the site a single
+-- session cannot reach (step (7)'s unfiltered select intercepts any committed row),
+-- so this assertion is the ONLY thing standing between it and being ungated.
+select is(
+  (select string_agg(proname, ',' order by proname) from _c246parts
+    where in_handler ~ 'coalesce\(\s*v_existing\.metadata\s*#>>\s*''\{federation,issuer\}''\s*=\s*p_issuer\s+and\s+v_existing\.metadata\s*#>>\s*''\{federation,subject\}''\s*=\s*p_subject\s*,\s*false\s*\)'),
+  (select string_agg(proname, ',' order by proname) from _c246),
+  'every class member carries the gate at return site (8a) -- INSIDE the unique_violation race handler');
+
+-- 6 and 7 -- both sites raise the SAME refusal, so neither becomes a
+-- distinguishable oracle and one log phrase covers both. Split PER SITE for the
+-- same reason assertions 4 and 5 are: this was written as a body-wide
+-- `count(matches) = 2` and it was the identical fail-open -- M7 (gate twice at (7),
+-- none at (8)) reded assertion 5 and left the count GREEN, so the count could not
+-- see a site that raises nothing. Finding the shape and fixing it in one place
+-- while leaving it in the assertion immediately below is the "does the fix
+-- reproduce one level down" check, and this is that check's answer. A gate is only
+-- half the property: a body could gate both sites and raise a DIFFERENT message at
+-- one of them, which is why the raise is pinned per site rather than inferred from
+-- the gate's position.
+select is(
+  (select string_agg(proname, ',' order by proname) from _c246parts
+    where pre_handler ~ 'federated identity mismatch'),
+  (select string_agg(proname, ',' order by proname) from _c246),
+  'every class member raises the "federated identity mismatch" refusal at site (7a) -- the idempotent branch');
+
+-- 7
+select is(
+  (select string_agg(proname, ',' order by proname) from _c246parts
+    where in_handler ~ 'federated identity mismatch'),
+  (select string_agg(proname, ',' order by proname) from _c246),
+  'every class member raises the "federated identity mismatch" refusal at site (8a) -- INSIDE the race handler');
+
+-- ---------------------------------------------------------------------------
+-- Section A2 -- the four NON-members, each exempt for a POSITIVELY ASSERTED reason
+-- ---------------------------------------------------------------------------
+-- The class query above excludes four of the five fed-human derivation sites. An
+-- exemption asserted only by ABSENCE from a scan is the soft spot in every class
+-- test (CLAUDE.md rule 1), so each one's claim is stated positively here and read
+-- from the CATALOG, never from the migration files -- the same reason the fix
+-- targets the delegate and not the wrapper: a migration that introduced a check is
+-- often not the one holding the live one.
+
+-- 8 -- the derivation set itself, as an EXACT SET. A new fed-human derivation site
+-- fails this and NAMES ITSELF, which is what makes the four exemptions below a
+-- closed list rather than a list someone remembered to update.
+-- #246: same marker move as the class view above -- a site "derives" by CALLING
+-- agent_board._federated_identity_slug now. The expected set is unchanged, which is the
+-- point: routing six copied expressions through one helper moved no site into or out of
+-- this list. The helper itself is excluded by name because it is the DEFINITION, not a
+-- site; agent_board_federated_identity_injective_slug.test.sql CLS-1/CLS-2 assert from
+-- the other direction that no function outside it holds a derivation of its own.
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.prokind in ('f', 'p')
+      and p.proname <> '_federated_identity_slug'
+      and agent_board_test.stripped_body(p.oid, true) like '%\_federated\_identity\_slug(%'),
+  '_enroll_federated_human_after_revocation_gate,_enroll_federated_identity_once,enroll_federated_human,enroll_federated_identity,onboard_federated_fleet_agent',
+  'the fed-human derivation set is exactly these five functions');
+
+-- 9 -- enroll_federated_identity is exempt because it ALREADY compares the caller's
+-- pair against the creation-time stamp (#176/#244). Asserted on BOTH conjuncts: a
+-- check on the issuer alone would be an exemption whose claim is wider than its code.
+select ok(
+  (select agent_board_test.stripped_body(p.oid, true)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'enroll_federated_identity')
+    ~ 'v_creation_federation\s*->>\s*''issuer''\s*=\s*p_issuer'
+  and (select agent_board_test.stripped_body(p.oid, true)
+         from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+        where n.nspname = 'agent_board' and p.proname = 'enroll_federated_identity')
+    ~ 'v_creation_federation\s*->>\s*''subject''\s*=\s*p_subject',
+  'EXEMPT: enroll_federated_identity already compares BOTH stored issuer and subject to the caller''s pair');
+
+-- 10 -- onboard_federated_fleet_agent is exempt because it does not decide identity
+-- itself: it delegates to enroll_federated_identity.
+--
+-- WHAT THIS PINS, exactly: that the CALL APPEARS. Call presence is NOT inheritance
+-- -- a dead call, or one whose result is discarded, would satisfy this identically.
+-- The inheritance argument rests on reading the function (its `select * into
+-- v_enroll from agent_board.enroll_federated_identity(...)` is the sole identity
+-- route, and it raises on that path rather than branching around it), which is a
+-- reviewer's claim and not this assertion's. What the assertion DOES buy is that
+-- the delegation cannot be silently removed without a named failure here, which is
+-- the change that would make the exemption false.
+select ok(
+  (select agent_board_test.stripped_body(p.oid, true)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'onboard_federated_fleet_agent')
+    ~ 'agent_board\.enroll_federated_identity\s*\(',
+  'EXEMPT: onboard_federated_fleet_agent CALLS agent_board.enroll_federated_identity (call presence only -- see comment)');
+
+-- 11 -- _enroll_federated_identity_once is exempt because it has no existing-agent
+-- return path to gate at all: it ALWAYS creates.
+--
+-- WHAT THIS PINS, exactly: that an INSERT into agent_board.agents is present. An
+-- insert proves neither "always" nor "no return path" -- both of those are read off
+-- the function, not measured here. The absence half comes from the CLASS QUERY
+-- (assertions 1-2): this function derives a fed-human handle but does not read
+-- agent_board.agents on auth_user_id, which is why it is not a member. So the
+-- exemption rests on the class query for the absence and on this assertion for the
+-- positive half, and neither is asked to carry the other's weight.
+--
+-- The trailing `\s*\(` is load-bearing, not tidiness. Without it the pattern was
+-- `agent_board\.agents` unanchored, which a mutation renaming the target to
+-- `agent_board.agents_MUTATED` still satisfied by PREFIX -- the assertion stayed
+-- green while the claim it makes was false. Caught by mutation M11 producing no
+-- failure at all, which is the only reason it is not still there.
+select ok(
+  (select agent_board_test.stripped_body(p.oid, true)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_enroll_federated_identity_once')
+    ~ 'insert\s+into\s+agent_board\.agents\s*\(',
+  'EXEMPT: _enroll_federated_identity_once INSERTS into agent_board.agents (insert presence only -- see comment)');
+
+-- 12 -- enroll_federated_human is exempt because 20260901000130 reduced it to a
+-- wrapper: it derives the uid for the owner lock, then delegates. This is the
+-- assertion that would have caught the brief''s misattribution.
+--
+-- `agent_board\.` is OPTIONAL on purpose. The function pins
+-- `search_path = agent_board, public`, so a bare `_enroll_federated_human_after_
+-- revocation_gate(...)` resolves identically; requiring the qualified spelling would
+-- make this red on a legitimate refactor that changed nothing. That direction is a
+-- false alarm rather than a hole, but a class assertion nobody trusts gets deleted.
+select ok(
+  (select agent_board_test.stripped_body(p.oid, true)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'enroll_federated_human')
+    ~ '(agent_board\.)?_enroll_federated_human_after_revocation_gate\s*\(',
+  'EXEMPT: enroll_federated_human is a wrapper -- it delegates the return path to the gated function');
+
+-- ---------------------------------------------------------------------------
+-- Fixtures -- one approved provider, one active default board, seven identities
+-- ---------------------------------------------------------------------------
+create temp table _g (
+  iss text, aud text, board_id uuid,
+  sub_l text, agent_l uuid, handle_l text,   -- L: legitimate owner, stamp untouched
+  sub_m text, agent_m uuid,                  -- M: BOTH stamp fields rewritten
+  sub_i text, agent_i uuid,                  -- I: only the stamp ISSUER rewritten
+  sub_s text, agent_s uuid,                  -- S: only the stamp SUBJECT rewritten
+  sub_x text, agent_x uuid,                  -- X: stamp rewritten AND status suspended
+  sub_n text, agent_n uuid,                  -- N: no federation stamp at all
+  sub_p text, agent_p uuid,                  -- P: federation stamp missing only `subject`
+  sub_q text, agent_q uuid                   -- Q: federation stamp missing only `issuer`
+) on commit drop;
+grant all on table _g to authenticated, service_role;
+
+create temp table _err (label text primary key, sqlstate text, msg text) on commit drop;
+grant all on table _err to authenticated, service_role;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_iss text; v_board uuid; v_owner uuid;
+  v_l uuid; v_hl text; v_m uuid; v_i uuid; v_ss uuid; v_x uuid; v_n uuid; v_p uuid;
+  v_sub_l text; v_sub_m text; v_sub_i text; v_sub_s text; v_sub_x text; v_sub_n text; v_sub_p text;
+  v_sub_q text; v_q uuid;
+  v_other_iss text := 'https://other-idp-' || s || '.test';
+  v_other_sub text := 'other-principal-' || s;
+begin
+  v_iss    := 'https://fedid-' || s || '.test';
+  v_sub_l  := 'g246-legit-'    || s;
+  v_sub_m  := 'g246-both-'     || s;
+  v_sub_i  := 'g246-issuer-'   || s;
+  v_sub_s  := 'g246-subject-'  || s;
+  v_sub_x  := 'g246-suspend-'  || s;
+  v_sub_n  := 'g246-nostamp-'  || s;
+  v_sub_p  := 'g246-partial-'  || s;
+  v_sub_q  := 'g246-noiss-'    || s;
+
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status)
+  values ('system', 'system'::agent_board.agent_kind, 'g246-owner-' || s, 'G246 Owner', 'active')
+  returning id into v_owner;
+
+  insert into agent_board.boards(slug, name, created_by_agent_id, visibility, status)
+  values ('g246-board-' || s, 'G246 Board', v_owner, 'private', 'active')
+  returning id into v_board;
+
+  -- default_board_id is set so the auto-join side effect is LIVE on the return path;
+  -- without it EC-13 below would pass no matter what the gate did.
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes,
+     allowed_agent_kinds, default_board_id)
+  values (v_iss, 'message-board', true, true, '{}', '{}', '{human}', v_board);
+
+  select e.agent_id, e.handle into v_l, v_hl from agent_board.enroll_federated_human(
+    v_iss, 'message-board', v_sub_l,
+    jsonb_build_object('sub', v_sub_l, 'email_verified', false), 'Legit') e;
+  select e.agent_id into v_m from agent_board.enroll_federated_human(
+    v_iss, 'message-board', v_sub_m,
+    jsonb_build_object('sub', v_sub_m, 'email_verified', false), 'Both') e;
+  select e.agent_id into v_i from agent_board.enroll_federated_human(
+    v_iss, 'message-board', v_sub_i,
+    jsonb_build_object('sub', v_sub_i, 'email_verified', false), 'IssuerOnly') e;
+  select e.agent_id into v_ss from agent_board.enroll_federated_human(
+    v_iss, 'message-board', v_sub_s,
+    jsonb_build_object('sub', v_sub_s, 'email_verified', false), 'SubjectOnly') e;
+  select e.agent_id into v_x from agent_board.enroll_federated_human(
+    v_iss, 'message-board', v_sub_x,
+    jsonb_build_object('sub', v_sub_x, 'email_verified', false), 'Suspended') e;
+  select e.agent_id into v_n from agent_board.enroll_federated_human(
+    v_iss, 'message-board', v_sub_n,
+    jsonb_build_object('sub', v_sub_n, 'email_verified', false), 'NoStamp') e;
+  select e.agent_id into v_p from agent_board.enroll_federated_human(
+    v_iss, 'message-board', v_sub_p,
+    jsonb_build_object('sub', v_sub_p, 'email_verified', false), 'Partial') e;
+  select e.agent_id into v_q from agent_board.enroll_federated_human(
+    v_iss, 'message-board', v_sub_q,
+    jsonb_build_object('sub', v_sub_q, 'email_verified', false), 'NoIssuer') e;
+
+  -- THE CONSTRUCTION. Rewrite the stored stamp so it names a DIFFERENT principal
+  -- while the uid, handle and auth.users row still derive from the caller's pair --
+  -- the state a real collision produces, built directly (see the file header).
+  update agent_board.agents a
+     set metadata = jsonb_set(jsonb_set(a.metadata, '{federation,issuer}', to_jsonb(v_other_iss), true),
+                              '{federation,subject}', to_jsonb(v_other_sub), true)
+   where a.id in (v_m, v_x);
+  -- Only the ISSUER differs (subject still matches the caller) -- pins that the
+  -- issuer conjunct is load-bearing on its own.
+  update agent_board.agents a
+     set metadata = jsonb_set(a.metadata, '{federation,issuer}', to_jsonb(v_other_iss), true)
+   where a.id = v_i;
+  -- Only the SUBJECT differs (issuer still matches) -- pins the subject conjunct.
+  update agent_board.agents a
+     set metadata = jsonb_set(a.metadata, '{federation,subject}', to_jsonb(v_other_sub), true)
+   where a.id = v_ss;
+  -- No stamp at all, and a stamp missing exactly one field: both must FAIL CLOSED.
+  update agent_board.agents a set metadata = a.metadata - 'federation' where a.id = v_n;
+  update agent_board.agents a
+     set metadata = jsonb_set(a.metadata, '{federation}', (a.metadata -> 'federation') - 'subject', true)
+   where a.id = v_p;
+  -- Q: stamp missing only `issuer`. The migration header claims fail-closed when the
+  -- stamp lacks issuer OR subject, and until this fixture existed only the subject
+  -- half had one -- a claim wider than any assertion behind it. Note the surviving
+  -- SUBJECT conjunct would refuse a genuinely different caller anyway, so this
+  -- fixture presents the CORRECT subject: the refusal can then only come from the
+  -- NULL issuer conjunct.
+  update agent_board.agents a
+     set metadata = jsonb_set(a.metadata, '{federation}', (a.metadata -> 'federation') - 'issuer', true)
+   where a.id = v_q;
+  -- X is additionally suspended, so its refusal can be compared against M's.
+  update agent_board.agents a set status = 'suspended', updated_at = now() where a.id = v_x;
+
+  -- Delete M's auto-join membership so a re-run of the return path WOULD recreate it
+  -- (auto-join is first-time-only; without this deletion EC-13 could not fail).
+  delete from agent_board.board_memberships bm where bm.agent_id = v_m and bm.board_id = v_board;
+
+  insert into _g values (
+    v_iss, 'message-board', v_board,
+    v_sub_l, v_l, v_hl, v_sub_m, v_m, v_sub_i, v_i, v_sub_s, v_ss,
+    v_sub_x, v_x, v_sub_n, v_n, v_sub_p, v_p, v_sub_q, v_q);
+end
+$$;
+
+-- ---------------------------------------------------------------------------
+-- Section B -- THE REGRESSION RISK: the legitimate owner must still be returned
+-- ---------------------------------------------------------------------------
+-- Asserted POSITIVELY and first, while every fixture is pristine. A careless
+-- equality check breaks idempotency for a real owner, and that failure mode is worse
+-- for this deployment than the collision it defends against.
+create temp table _idem_before as
+  select count(*)::int as n from agent_board.enrollment_federation_audit e
+   where e.agent_id = (select agent_l from _g);
+
+-- 13 -- #113: an allow-side call NEVER runs inside an is() value expression; a raise
+-- there aborts the file with no `not ok`. lives_ok captures, then assertions read.
+select lives_ok(
+  (select format($q$create temp table _idem as
+      select * from agent_board.enroll_federated_human(%L, 'message-board', %L, %L::jsonb, 'Legit')$q$,
+     iss, sub_l, jsonb_build_object('sub', sub_l, 'email_verified', false)::text) from _g),
+  'the legitimate owner re-presenting its OWN (issuer, subject) is accepted [call succeeds]');
+
+-- 14
+select is((select agent_id from _idem), (select agent_l from _g),
+  'the owner gets ITS OWN agent back (idempotency preserved)');
+
+-- 15
+select is((select kind || '/' || status from _idem), 'human/active',
+  'the returned identity is still an active human');
+
+-- 16
+select is((select handle from _idem), (select handle_l from _g),
+  'the returned handle is unchanged (the derivation is untouched by this change)');
+
+-- 17 -- the idempotent return still appends its audit row: the gate refuses, it does
+-- not silently degrade the accepted path into a no-op.
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e
+    where e.agent_id = (select agent_l from _g)) - (select n from _idem_before),
+  1,
+  'the accepted re-provision appends exactly one audit row');
+
+-- ---------------------------------------------------------------------------
+-- Section C -- a MISMATCHED caller is refused, and each conjunct is load-bearing
+-- ---------------------------------------------------------------------------
+create temp table _audit_before as
+  select count(*)::int as n from agent_board.enrollment_federation_audit e
+   where e.agent_id = (select agent_m from _g);
+
+-- 18
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human(%L, 'message-board', %L, %L::jsonb, null)$q$,
+     iss, sub_m, jsonb_build_object('sub', sub_m, 'email_verified', false)::text) from _g),
+  '42501', null,
+  'a caller whose pair differs from the stored stamp in BOTH fields is refused (42501)');
+
+-- 19 -- issuer differs, subject matches. Fails if the issuer conjunct is dropped.
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human(%L, 'message-board', %L, %L::jsonb, null)$q$,
+     iss, sub_i, jsonb_build_object('sub', sub_i, 'email_verified', false)::text) from _g),
+  '42501', null,
+  'a caller whose stored stamp ISSUER differs (subject matches) is refused (42501)');
+
+-- 20 -- subject differs, issuer matches. Fails if the subject conjunct is dropped.
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human(%L, 'message-board', %L, %L::jsonb, null)$q$,
+     iss, sub_s, jsonb_build_object('sub', sub_s, 'email_verified', false)::text) from _g),
+  '42501', null,
+  'a caller whose stored stamp SUBJECT differs (issuer matches) is refused (42501)');
+
+-- Capture the actual refusal texts for the message + no-oracle assertions below.
+do $$
+declare r record; v_state text; v_msg text;
+begin
+  select * into r from _g;
+
+  -- An email is supplied HERE deliberately. Step (7)'s accepted branch MERGES it into
+  -- the owner's auth.users.raw_user_meta_data before returning, so under the defect a
+  -- colliding caller writes ITS OWN email onto the VICTIM's owner row. EC-16 asserts
+  -- that did not happen.
+  begin
+    perform agent_board.enroll_federated_human(r.iss, 'message-board', r.sub_m,
+      jsonb_build_object('sub', r.sub_m, 'email', 'attacker-' || r.sub_m || '@example.test',
+                         'email_verified', true), null);
+  exception when others then
+    get stacked diagnostics v_state = returned_sqlstate, v_msg = message_text;
+    insert into _err values ('mismatch_active', v_state, v_msg);
+  end;
+
+  begin
+    perform agent_board.enroll_federated_human(r.iss, 'message-board', r.sub_x,
+      jsonb_build_object('sub', r.sub_x, 'email_verified', false), null);
+  exception when others then
+    get stacked diagnostics v_state = returned_sqlstate, v_msg = message_text;
+    insert into _err values ('mismatch_suspended', v_state, v_msg);
+  end;
+
+  begin
+    perform agent_board.enroll_federated_human(r.iss, 'message-board', r.sub_n,
+      jsonb_build_object('sub', r.sub_n, 'email_verified', false), null);
+  exception when others then
+    get stacked diagnostics v_state = returned_sqlstate, v_msg = message_text;
+    insert into _err values ('no_stamp', v_state, v_msg);
+  end;
+
+  begin
+    perform agent_board.enroll_federated_human(r.iss, 'message-board', r.sub_p,
+      jsonb_build_object('sub', r.sub_p, 'email_verified', false), null);
+  exception when others then
+    get stacked diagnostics v_state = returned_sqlstate, v_msg = message_text;
+    insert into _err values ('partial_stamp', v_state, v_msg);
+  end;
+
+  begin
+    perform agent_board.enroll_federated_human(r.iss, 'message-board', r.sub_q,
+      jsonb_build_object('sub', r.sub_q, 'email_verified', false), null);
+  exception when others then
+    get stacked diagnostics v_state = returned_sqlstate, v_msg = message_text;
+    insert into _err values ('no_issuer', v_state, v_msg);
+  end;
+end
+$$;
+
+-- 21 -- the refusal is the #246 refusal, not some other 42501 that happens to fire.
+select matches(
+  (select msg from _err where label = 'mismatch_active'),
+  '^federated identity mismatch: ',
+  'the refusal is the #246 stored-identity refusal, identifiable by its own phrase');
+
+-- 22 -- IT LEAKS NOTHING ABOUT THE OTHER PRINCIPAL. The message is echoed verbatim to
+-- the UNTRUSTED caller: supabase/functions/portal-session/index.ts returns
+-- {error:"provision_rejected", detail:<message>} with HTTP 403. So it must name no
+-- handle, no agent id, and neither of the stored pair's values.
+select ok(
+  (select msg from _err where label = 'mismatch_active')
+    not like '%' || (select metadata #>> '{federation,issuer}' from agent_board.agents where id = (select agent_m from _g)) || '%'
+  and (select msg from _err where label = 'mismatch_active')
+    not like '%' || (select metadata #>> '{federation,subject}' from agent_board.agents where id = (select agent_m from _g)) || '%'
+  and (select msg from _err where label = 'mismatch_active')
+    not like '%' || (select handle from agent_board.agents where id = (select agent_m from _g)) || '%'
+  and (select msg from _err where label = 'mismatch_active')
+    not like '%' || (select agent_m from _g)::text || '%',
+  'the refusal names neither the stored issuer/subject, nor the handle, nor the agent id of the row it refused');
+
+-- ---------------------------------------------------------------------------
+-- Section D -- the refusal has NO side effect, which is the damage #246 names
+-- ---------------------------------------------------------------------------
+-- 23 -- the audit row is the poisoning: under the defect, the mismatched caller's
+-- (issuer, subject) was appended onto the VICTIM's agent_id, corrupting the stored
+-- evidence enroll_federated_identity's #176/#244 resumption conjunction reads.
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e
+    where e.agent_id = (select agent_m from _g)),
+  (select n from _audit_before),
+  'a refused call appends NO audit row onto the agent it refused (no evidence poisoning)');
+
+-- 24 -- nor does the refused caller's EMAIL reach the victim's owner row. Step (7)'s
+-- accepted branch merges `fedsession_email` into auth.users.raw_user_meta_data before
+-- returning; under the defect that is the attacker's address written onto the owner
+-- auth.users row of the identity it collided with.
+select is(
+  (select count(*)::int from auth.users u, agent_board.agents a, _g g
+    where a.id = g.agent_m and u.id = a.auth_user_id
+      and u.raw_user_meta_data ->> 'fedsession_email' is not null),
+  0,
+  'a refused call writes no fedsession_email onto the owner auth.users row it refused');
+
+-- 25 -- the auto-join side effect does not fire either. M's membership was deleted in
+-- the fixture, so the return path WOULD recreate it (auto-join is first-time-only).
+select is(
+  (select count(*)::int from agent_board.board_memberships bm, _g g
+    where bm.agent_id = g.agent_m and bm.board_id = g.board_id),
+  0,
+  'a refused call performs no default-board auto-join for the agent it refused');
+
+-- ---------------------------------------------------------------------------
+-- Section E -- NO ORACLE: the gate runs before the status and kind branches
+-- ---------------------------------------------------------------------------
+-- 26 -- X is mismatched AND suspended. If the gate were placed after the status
+-- branch, this would be the 'a non-active identity already exists' refusal instead,
+-- telling a colliding caller the victim's account state.
+select is(
+  (select sqlstate || ' ' || msg from _err where label = 'mismatch_suspended'),
+  (select sqlstate || ' ' || msg from _err where label = 'mismatch_active'),
+  'a mismatched caller gets the IDENTICAL refusal whether the existing agent is active or suspended');
+
+-- ---------------------------------------------------------------------------
+-- Section F -- FAIL CLOSED on a missing or partial stamp
+-- ---------------------------------------------------------------------------
+-- Measured before choosing this posture: on the canonical project (2026-08-16) there
+-- is 1 agent reachable on this path, 0 of them lack a stamp, and all 110 of its audit
+-- rows agree with the stamp on both fields -- so refusing breaks no live owner. The
+-- creation branch has written both fields unconditionally since 20260728000100:243.
+-- 27
+select is(
+  (select sqlstate || '|' || (msg like 'federated identity mismatch:%')::text
+     from _err where label = 'no_stamp'),
+  '42501|true',
+  'an agent with NO metadata->federation stamp is refused, not admitted (fail closed)');
+
+-- 28
+select is(
+  (select sqlstate || '|' || (msg like 'federated identity mismatch:%')::text
+     from _err where label = 'partial_stamp'),
+  '42501|true',
+  'an agent whose stamp is missing only `subject` is refused (a NULL conjunct reads as NOT-mine)');
+
+-- 29 -- the missing-ISSUER-only half of the fail-closed claim. Added because the
+-- migration header named it and no fixture covered it -- a claim wider than its
+-- evidence, which is the exact shape this bundle argues against. The caller here
+-- presents the CORRECT subject, so the surviving subject conjunct cannot be what
+-- refuses: only the NULL issuer conjunct can.
+select is(
+  (select sqlstate || '|' || (msg like 'federated identity mismatch:%')::text
+     from _err where label = 'no_issuer'),
+  '42501|true',
+  'an agent whose stamp is missing only `issuer` is refused, with the correct subject presented');
+
+select * from finish();
+rollback;