@consiliency/agent-board-schema 1.27.0 → 1.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.27.0",
+  "version": "1.35.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.27.0",
+  "packageVersion": "1.35.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 126,
-  "aggregateSha256": "7fbe4374b98783d1b88a075fd5b6c11723b40fccd6a4b4a7c7a80d3d1666ea2f",
+  "migrationCount": 134,
+  "aggregateSha256": "f63027fa44451c55a39fcc8f463df6ae6f4b92765578be053d8bf3b9a2bee07e",
   "migrations": [
     {
       "order": 0,
@@ -1182,6 +1182,78 @@
       "sourceRef": "message-board",
       "bytes": 29336,
       "sha256": "bfb1ae60f69dae0a0aaf1007dbf14e171f324cdced1caf9f4d490f41a60c14e5"
+    },
+    {
+      "order": 126,
+      "id": "20260909000100_agent_board_ledger_revoked_authority",
+      "filename": "20260909000100_agent_board_ledger_revoked_authority.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 67493,
+      "sha256": "7522e32c61f8845e511255d94d273d98eb7b72b2f906976c3a2494629927462d"
+    },
+    {
+      "order": 127,
+      "id": "20260910000100_agent_board_ceiling_lock_comment_truth",
+      "filename": "20260910000100_agent_board_ceiling_lock_comment_truth.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 7087,
+      "sha256": "b8ddc658be347d9e7207111968d0b8de7a88759cb3cf181f61c4ef306086f384"
+    },
+    {
+      "order": 128,
+      "id": "20260911000100_agent_board_ledger_revoked_board_creation",
+      "filename": "20260911000100_agent_board_ledger_revoked_board_creation.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 22749,
+      "sha256": "4291af2bd6c93b7d9f8ec596f41dc62edf941ea10a51529df04e223d1cbc50c5"
+    },
+    {
+      "order": 129,
+      "id": "20260912000100_agent_board_receipt_subject_gate",
+      "filename": "20260912000100_agent_board_receipt_subject_gate.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 19033,
+      "sha256": "1083f7720ccab9c9b422415f2a8eb743de5d84b0ab8d8689059bd355514e9aa9"
+    },
+    {
+      "order": 130,
+      "id": "20260913000100_agent_board_task_thread_lock_order",
+      "filename": "20260913000100_agent_board_task_thread_lock_order.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 17738,
+      "sha256": "259a05c4a6603518ab449e799fcb235b0e16a6650954cb2db19b436c0a7a1e83"
+    },
+    {
+      "order": 131,
+      "id": "20260914000100_agent_board_claim_subject_gate",
+      "filename": "20260914000100_agent_board_claim_subject_gate.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 34342,
+      "sha256": "88207b2e3f28ec8022ad4ca921721ebba877668042c66b5ac74c85e4c8cefc21"
+    },
+    {
+      "order": 132,
+      "id": "20260915000100_agent_board_fedsession_stored_identity_gate",
+      "filename": "20260915000100_agent_board_fedsession_stored_identity_gate.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 18615,
+      "sha256": "5a8f4abb822e30c2a695a310bb1742f2565bb2afd0b6a06cad43fcbdd106ad5e"
+    },
+    {
+      "order": 133,
+      "id": "20260916000100_agent_board_federated_identity_injective_slug",
+      "filename": "20260916000100_agent_board_federated_identity_injective_slug.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 84162,
+      "sha256": "d9f05e18094954f2e4ee32bf7b129f0a9ffc39bc800a5efa9cf7938e1555c8dc"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 126)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 134)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(126);
+    expect(manifest.migrationCount).toBe(134);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -141,6 +141,51 @@ describe('manifest integrity', () => {
       // MBCONSENT-B(iii) (#109/#110 + the gating race): validate and mutate the SAME
       // row. The sink gains an optional row identity and event kind.
       '20260810000100_agent_board_consent_locking.sql',
+      // RECEIPTSUBJECTGATE (#287): a read receipt is a MEMO of access, never a SOURCE of it --
+      // mark_read requires the NAMED agent to pass the thread-access predicate, closing the
+      // route by which service_role could mint an inherit-thread grant for a third party. The
+      // predicate is parameterized (_agent_can_access_thread) and the current-agent form
+      // recomposed from it, so the disjunct set has ONE definition. The receipt grandfather is
+      // deliberately preserved and documented, not removed.
+      '20260912000100_agent_board_receipt_subject_gate.sql',
+      // CLAIMSUBJECTGATE (#291): a claim is a LOCK, never a KEY -- acquire_claim requires the
+      // NAMED agent to pass the thread-access predicate before a thread-bound claim is written,
+      // closing the sibling of the #287 mint on agent_board.claims (and, through the thread
+      // disjunct of _current_agent_can_access_task, on task access). The permanence of a
+      // released or expired claim is RATIFIED here rather than fixed, in comment on function
+      // and in specs/security.md, so a future reader cannot mistake it for an oversight.
+      '20260914000100_agent_board_claim_subject_gate.sql',
+      // TASKTHREADLOCKORDER (#281 R1): one total order for (threads, tasks) -- threads BEFORE
+      // tasks -- in append_task_event (an explicit `threads ... for key share` hoisted above the
+      // existing `tasks ... for update`, with a recheck of the pre-read thread_id) and in
+      // _upsert_delivery_recipient (the OBSGATE thread stamp hoisted above the
+      // delivery_recipients insert, whose FK takes KEY SHARE on tasks). Definition-only.
+      '20260913000100_agent_board_task_thread_lock_order.sql',
+      // FEDSESSIONIDENTITYGATE (#246): a federated human is returned only to the identity that
+      // OWNS it. The owner uid is sha256(issuer || '|' || subject), a concatenation with no
+      // length prefix and no escaping, so two distinct principals can derive the same uid --
+      // and the return path checked only `active` and `kind = 'human'`, neither of which says
+      // the row belongs to the caller. Both return sites now require the agent's stored
+      // metadata.federation issuer AND subject to equal the caller's verified pair: the
+      // idempotent branch and the unique_violation race handler, which returned an existing
+      // row with no comparison either. A missing stamp is a refusal (coalesce(..., false)),
+      // not a pass. The ambiguous DERIVATION is deliberately unchanged -- that is a separate
+      // migration with an auth.users.email re-key -- because this gate defeats the collision
+      // with the encoding still in place.
+      '20260915000100_agent_board_fedsession_stored_identity_gate.sql',
+      // FEDIDENTITYSLUG (#246): the (issuer, subject) -> owner slug derivation becomes ONE
+      // injective serialization, and the ambiguous one is dropped rather than kept beside it.
+      // `issuer || '|' || subject` has no length prefix and no escaping, so the pair is not
+      // recoverable from the preimage and two principals can derive one slug -- and the slug
+      // is not a label, it is the auth.users key _ensure_agent_auth_user builds the email
+      // from. All five live derivation sites now call agent_board._federated_identity_slug,
+      // which length-prefixes each component. NOT definition-only: the migration also
+      // BACKFILLS every existing federated owner across all four surfaces that carry the
+      // slug -- auth.users.email, raw_user_meta_data.slug, auth.identities, and the human
+      // agent's handle -- because re-deriving without re-keying the email orphans the owner
+      // (the #244 resumption lookup misses and the non-null owner conjunct fails). The owner
+      // uuid is unchanged, so no FK and no live session moves.
+      '20260916000100_agent_board_federated_identity_injective_slug.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_atomic_fleet_onboarding.test.sql

@@ -110,12 +110,21 @@
 --     demonstrated silenced that way (#198). They are presence claims, so a
 --     comment can only make a MISSING construct look present -- the same
 --     fail-open direction, on weaker claims;
---   * the two catalog CLASS assertions at the end. The serialization one decides
---     serialized/UNSERIALIZED with `strpos(p.prosrc, '_lock_board_authority_ceiling')`
---     over RAW prosrc, so a reader that DROPS the lock while keeping a comment
---     naming it still prints "serialized" -- the dangerous direction. The
---     surface-set predicates that pick the second class's member functions are raw
---     for the same reason.
+--   * the ONE remaining deliberate raw read, added by message-board#277: the
+--     KNOWN-STALE record for set_board_authority_ceiling's inline every-reader
+--     claim. Its evidence IS a comment, so a stripped body cannot see it by
+--     construction. It is a PRESENCE claim, so the fail-open direction is "a
+--     comment makes a missing thing look present" -- which is exactly what it is
+--     asserting, deliberately.
+--
+-- CORRECTED BY message-board#277, because this paragraph was itself an example of
+-- the defect #277 fixes -- prose claiming what the code no longer does. It used to
+-- say the catalog CLASS assertions at the end decide serialized/UNSERIALIZED with
+-- `strpos(p.prosrc, …)` over RAW prosrc. They do not, and had not since #196/#199:
+-- the serialization state and the surface-set predicates all read
+-- agent_board_test.stripped_body(), and one surface predicate reads
+-- stripped_body(oid, true) because its marker is a string literal. Verified against
+-- the statements themselves, not against this list.
 -- All of it is inside exact-set or presence assertions that #196 Bucket A
 -- deliberately excluded; it belongs to the follow-up that closes Buckets B and C,
 -- together with the nesting hole in the strip described above.
@@ -123,7 +132,7 @@ create extension if not exists pgtap with schema extensions;
 set search_path = extensions, public, agent_board;
 
 begin;
-select plan(54);
+select plan(58);
 
 -- ---------------------------------------------------------------------------
 -- The stripped-body reader every positional assertion below uses is
@@ -491,42 +500,153 @@ select ok(
   'the ceiling setter holds the same lock before its owner gate and upsert [BACKSTOP: tests/isolation/specs/ceiling_setter_lock_before_upsert.spec]'
 );
 
+-- THE CEILING CLASSES, DERIVED ONCE (message-board#277). Both sides of this lock
+-- -- who READS the ceiling for authorization, and who WRITES it -- are needed by
+-- four assertions below, one of which compares them to the lock helper's own
+-- COMMENT. Written out four times they would be four things that can drift; the
+-- drift would show up as one of them failing, but only after someone read four
+-- copies to work out which was right. So the predicates live here, once.
+--
+-- CALL SHAPE for the serialization state, not strpos on a bare name: that is the
+-- dangerous direction -- a reader that DROPS the lock but keeps a variable named
+-- after it would still print "serialized".
+-- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
+-- IDENTITY: `\m_lock_board_authority_ceiling\s*\(` also matches
+-- `zz_other._lock_board_authority_ceiling(...)` (measured true). Every live call
+-- site in agent_board is `agent_board.`-qualified, so requiring the qualification
+-- costs nothing today and is fail-CLOSED if someone later writes an unqualified
+-- call (it reads as NOT calling). Overload count is pinned separately, so schema +
+-- name is the identity.
+--
+-- The WRITE predicate names the DML verb and the relation together rather than
+-- "mentions board_authority_ceilings", so _grant_within_ceiling -- which reads the
+-- table and is the reason the read class exists at all -- is not miscounted as a
+-- writer. It sees only STATIC SQL in the function's own body: a write built into an
+-- `execute` string is a literal and is stripped away, and a write performed by a
+-- TRIGGER or by a callee belongs to that object, not to this one. Same blindness
+-- the positional claims above carry and for the same reason; stated here so the
+-- class is not read as "every write to this table", which it is not.
+create temp table _ceiling_class as
+select 'agent_board.' || regexp_replace(p.oid::regprocedure::text, '^([^(]*\.)?', '') as ident,
+       p.proname::text as name,   -- text, not `name`: array_agg(name) has no is(name[], text[]) overload
+       (strpos(lower(agent_board_test.stripped_body(p.oid)), '_grant_within_ceiling') > 0) as is_reader,
+       (agent_board_test.stripped_body(p.oid) ~*
+          '(insert\s+into|update|delete\s+from|merge\s+into)\s+(only\s+)?(agent_board\.)?board_authority_ceilings\M') as is_writer,
+       (agent_board_test.stripped_body(p.oid) ~* '\magent_board\._lock_board_authority_ceiling\s*\(') as serialized
+  from pg_proc p
+  join pg_namespace n on n.oid = p.pronamespace
+ where n.nspname = 'agent_board';
+
 -- CLASS (catalog-derived, EC-4 form). Every agent_board function that reads the
 -- ceiling for authorization, enumerated from pg_proc — never from a list written
 -- here — each carrying its serialization state POSITIVELY. A new reader changes
 -- the array and NAMES ITSELF in the diff; a reader that is serialized without
--- being declared here also fails. The three UNSERIALIZED entries are the
--- knowingly-unfixed remainder of the class recorded in 20260901000110's header:
--- they carry the same absence race and are out of #186's scope.
+-- being declared here also fails. The two UNSERIALIZED entries are what remains of
+-- the knowingly-unfixed set recorded in 20260901000110's header (it recorded three;
+-- #276 retired one): they carry the same absence race and are out of #186's scope.
 select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below are string literals in the expected array, never invoked
-  (select array_agg(entry order by entry) from (
-     select 'agent_board.' || regexp_replace(p.oid::regprocedure::text, '^([^(]*\.)?', '') || ' => ' ||
-            -- CALL SHAPE, not strpos on a bare name: this is the dangerous
-            -- direction -- a reader that DROPS the lock but keeps a variable named
-            -- after it would still print "serialized".
-      -- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
-      -- IDENTITY: `\m_lock_board_authority_ceiling\s*\(` also matches
-      -- `zz_other._lock_board_authority_ceiling(...)` (measured true). Every live call
-      -- site in agent_board is `agent_board.`-qualified, so requiring the
-      -- qualification costs nothing today and is fail-CLOSED if someone later writes
-      -- an unqualified call (it reads as NOT calling). Overload count is pinned
-      -- separately, so schema + name is the identity.
-            case when agent_board_test.stripped_body(p.oid) ~* '\magent_board\._lock_board_authority_ceiling\s*\('
-                 then 'serialized' else 'UNSERIALIZED' end as entry
-       from pg_proc p
-       join pg_namespace n on n.oid = p.pronamespace
-      where n.nspname = 'agent_board'
-        and strpos(lower(agent_board_test.stripped_body(p.oid)), '_grant_within_ceiling') > 0
-   ) readers),
+  (select array_agg(ident || ' => ' || case when serialized then 'serialized' else 'UNSERIALIZED' end
+            order by ident || ' => ' || case when serialized then 'serialized' else 'UNSERIALIZED' end)
+     from _ceiling_class where is_reader),
   array[
     'agent_board._redeem_unbounded_invite_for_agent(text,uuid) => UNSERIALIZED',
     'agent_board.create_invite_link(uuid,text,text,integer,timestamp with time zone,uuid,jsonb) => UNSERIALIZED',
-    'agent_board.grant_board_role(uuid,uuid,text,uuid) => UNSERIALIZED',
+    -- Retired from UNSERIALIZED by #276 (20260909000100). Adding the fleet-ledger gate made
+    -- grant_board_role row-lock both agents and board_memberships, which section 9 of
+    -- agent_board_signer_lifecycle.test.sql requires to be advisory-serialised; taking that
+    -- lock also closes this reader's exposure to the ceiling row's ABSENCE, one of the three
+    -- 20260901000110 left explicitly undetermined.
+    'agent_board.grant_board_role(uuid,uuid,text,uuid) => serialized',
     'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) => serialized'
   ]::text[],
   'every ceiling-authorization reader in pg_proc is declared with its serialization state'
 );
 
+-- CLASS (catalog-derived, message-board#277). The WRITE side of the same lock,
+-- declared the same way. The helper's COMMENT makes a claim about writers as well
+-- as readers, and until now only ONE writer was checked -- by name, in the
+-- lock-before-upsert assertion above. A second writer could appear with no lock at
+-- all and nothing here would notice; the comment would still say every writer takes
+-- it. Now it names itself.
+select is( -- pgtap-allow-raise-checked: catalog read only; the RPC name below is a string literal in the expected array, never invoked
+  (select array_agg(ident || ' => ' || case when serialized then 'serialized' else 'UNSERIALIZED' end
+            order by ident || ' => ' || case when serialized then 'serialized' else 'UNSERIALIZED' end)
+     from _ceiling_class where is_writer),
+  array[
+    'agent_board.set_board_authority_ceiling(uuid,text,uuid) => serialized'
+  ]::text[],
+  'every function that WRITES board_authority_ceilings is declared with its serialization state'
+);
+
+-- The COMMENT on the lock helper is the most discoverable statement of intent about
+-- it -- it is attached to the lock itself -- and until #277 it claimed a property
+-- that the reader class above ACTIVELY REFUTED: "every RPC that writes the ceiling
+-- and every RPC that reads it for authorization takes this FIRST". Two of the four
+-- readers do not take it at all. Correcting the sentence would have fixed today and
+-- left the same rot mechanism in place: prose three files away from the assertion
+-- that knows the answer.
+--
+-- So the COMMENT now carries the two lists in a fixed machine-readable form and this
+-- assertion compares them, name for name and state for state, to the SAME
+-- catalog-derived classes the two assertions above declare. A reader or writer added,
+-- removed, or moved between serialized and UNSERIALIZED fails here as well, and the
+-- failure prints the disagreeing lists side by side.
+--
+-- FAIL-CLOSED ON A MANGLED BLOCK: an absent or malformed block makes substring()
+-- return NULL, which is coalesced to a sentinel that no catalog list can equal --
+-- never to the empty list, which is a real and different answer ('(none)').
+-- Deleting the block is therefore a failure, not a silent pass. Mutation-verified in
+-- all three directions (state flipped, name dropped, block deleted).
+select is(
+  (select array[
+     coalesce(string_agg(name, ', ' order by name) filter (where is_writer and serialized), '(none)'),
+     coalesce(string_agg(name, ', ' order by name) filter (where is_writer and not serialized), '(none)'),
+     coalesce(string_agg(name, ', ' order by name) filter (where is_reader and serialized), '(none)'),
+     coalesce(string_agg(name, ', ' order by name) filter (where is_reader and not serialized), '(none)')
+   ] from _ceiling_class),
+  (select array[
+     coalesce(substring(c from 'WRITERS\[serialized: ([^]]*)\]'), '(NO WRITERS BLOCK IN THE COMMENT)'),
+     coalesce(substring(c from 'WRITERS\[serialized: [^]]*\]\[UNSERIALIZED: ([^]]*)\]'), '(NO WRITERS UNSERIALIZED BLOCK IN THE COMMENT)'),
+     coalesce(substring(c from 'READERS\[serialized: ([^]]*)\]'), '(NO READERS BLOCK IN THE COMMENT)'),
+     coalesce(substring(c from 'READERS\[serialized: [^]]*\]\[UNSERIALIZED: ([^]]*)\]'), '(NO READERS UNSERIALIZED BLOCK IN THE COMMENT)')
+   ] from (select obj_description('agent_board._lock_board_authority_ceiling(uuid)'::regprocedure, 'pg_proc') as c) d),
+  'the ceiling lock COMMENT names exactly the catalog-derived writers and readers, with the same serialization state'
+);
+
+-- The COMMENT lists BARE NAMES (onboard_federated_fleet_agent alone has 23
+-- parameters; a signature list would be unreadable and would rot on any signature
+-- change). A bare name is an identity only while no two members of these classes
+-- share one -- otherwise the comparison above would accept the wrong overload's
+-- state. Catalog-derived, so a colliding overload fails here and prints its name.
+select is(
+  (select array_agg(name order by name) from (
+     select name from _ceiling_class where is_reader or is_writer group by name having count(*) > 1
+   ) dupes),
+  null::text[],
+  'no two ceiling readers/writers share a bare name, so the COMMENT may identify them by name'
+);
+
+-- KNOWN STALE, RECORDED POSITIVELY (message-board#277). The same overclaim the
+-- helper's COMMENT carried is ALSO an inline comment inside
+-- set_board_authority_ceiling's live body: "Same board-keyed advisory lock every
+-- ceiling READER for authorization takes." It is false in the same way and for the
+-- same two readers. It is NOT corrected in #277 because correcting prose inside a
+-- body means recreating a SECURITY DEFINER function -- a much wider blast radius
+-- than a `comment on function`, and a decision to take deliberately rather than to
+-- smuggle into a comment fix.
+--
+-- Asserted POSITIVELY rather than left as a note in a PR body (CLAUDE.md rule 1: an
+-- exemption states its claim, never relies on absence). WHEN YOU FIX IT: this
+-- assertion fails and names itself -- delete it, and re-derive the COMMENT's blocks
+-- from the catalog while you are there. Raw prosrc on purpose: the evidence IS a
+-- comment, so the stripped body cannot see it (presence claim, not positional).
+select ok(
+  (select p.prosrc from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'set_board_authority_ceiling')
+    like '%Same board-keyed advisory lock every ceiling READER for authorization takes%',
+  'KNOWN STALE (#277): set_board_authority_ceiling still carries the refuted every-reader claim inline -- pinned here so fixing it cannot go unnoticed'
+);
+
 -- CLASS (catalog-derived). Every function that touches this migration set's own
 -- surface — the bounded-invite table, the human revocation registry, the fleet
 -- revocation ledger, or the ceiling lock — with its exact non-owner EXECUTE
@@ -569,6 +689,12 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
           or strpos(agent_board_test.stripped_body(p.oid, true), 'board_authority_ceilings:') > 0)
    ) definers),
   array[
+    -- Joined this class in #276: it reads the fleet revocation ledger. This is the UNLOCKED
+    -- predicate; the share-locking _assert_actor_not_fleet_revoked wrapper left this surface
+    -- when the two were split, because it now reaches the ledger through this function rather
+    -- than naming the table itself. Internal — it reads rows for an arbitrary agent id with no
+    -- authorization of its own, so service_role only, like every other helper here.
+    'agent_board._actor_fleet_revoked(uuid) [definer] => service_role',
     'agent_board._lock_board_authority_ceiling(uuid) [invoker] => service_role',
     'agent_board._redeem_fleet_invite_for_agent(text,uuid) [definer] => service_role',
     'agent_board._redeem_invite_for_agent(text,uuid) [definer] => service_role',
@@ -577,6 +703,11 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     'agent_board.enroll_federated_human(text,text,text,jsonb,text) [definer] => service_role',
     'agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text) [definer] => service_role',
     'agent_board.evaluate_fleet_sender_policy(uuid,uuid,uuid,uuid,text,uuid,boolean) [definer] => authenticated,service_role',
+    -- Joined this class in #276: the live grant chokepoint now takes _lock_board_authority_ceiling
+    -- (forced by the section-9 agents/board_memberships class in agent_board_signer_lifecycle.test.sql
+    -- once the ledger gate made it lock both). Still authenticated,service_role — #276 removes
+    -- authority from a revoked principal, it does not change who may call the RPC.
+    'agent_board.grant_board_role(uuid,uuid,text,uuid) [definer] => authenticated,service_role',
     'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) [definer] => service_role',
     'agent_board.reactivate_fleet_machine(uuid,uuid,text) [definer] => service_role',
     'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb) [definer] => authenticated,service_role',