@consiliency/agent-board-schema 1.28.0 → 1.38.0

package/tests/agent_board_ledger_authority.test.sql

@@ -28,15 +28,28 @@
 --     is the failure mode throws_like alone cannot see.
 --   * The class assertions in section 9 are catalog-derived (pg_proc + stripped_body), not a
 --     list written here, so a NEW authority write that forgets the gate fails and NAMES ITSELF
---     (CLAUDE.md rule 1). The one exemption is asserted POSITIVELY — by three properties it
+--     (CLAUDE.md rule 1). Each remaining exemption is asserted POSITIVELY — by properties it
 --     actually has — never by the absence of a match.
+--
+-- #280 (20260911000100) AMENDS THIS FILE'S CLAIM. `create_board` was #276's ONE
+-- authenticated-callable exemption, and its residual was asserted here as BEHAVIOUR — a
+-- ledger-revoked agent COULD create a board and be seeded owner — precisely so that closing #280
+-- would be a deliberate test change rather than a silent behaviour change. The owner ratified
+-- "revoked means revoked", so those assertions are FLIPPED in section 11 and the EXEMPTION B
+-- block that licensed them is DELETED rather than left standing: its three properties are still
+-- true, but they exist to license an exemption that no longer exists, and a live assertion that
+-- licenses nothing is this repo's recorded failure shape. The exemption list is now THREE and
+-- the ledger-consult set is now SIX; both are derived from pg_catalog on every run, so those two
+-- edits must agree with the shipped schema or the difference NAMES create_board.
 
 create extension if not exists pgtap with schema extensions;
 set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(88);
+-- 88 at #276; #280 deletes 7 (EXEMPTION B1/B2/B3, the three RESIDUAL assertions, and a fourth
+-- residual companion in section 10 that named only the slug) and adds 10 in section 11.
+select plan(91);
 
 create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
 begin
@@ -544,13 +557,17 @@ select is(
     where n.nspname = 'agent_board'
       and p.proname not in ('_assert_actor_not_fleet_revoked', '_actor_fleet_revoked')
       and agent_board_test.stripped_body(p.oid) ~ '\m(_assert_actor_not_fleet_revoked|_actor_fleet_revoked)\s*\('),
-  '_redeem_unbounded_invite_for_agent,create_invite_link,grant_board_role,'
+  '_redeem_unbounded_invite_for_agent,create_board,create_invite_link,grant_board_role,'
   || 'set_board_authority_ceiling,set_board_role_gate',
-  'the functions that consult the fleet revocation ledger are exactly these five');
+  'the functions that consult the fleet revocation ledger are exactly these six (#280 added '
+  'create_board)');
 
--- The gate proper: the two sets must differ by EXACTLY the four asserted exemptions, and any
+-- The gate proper: the two sets must differ by EXACTLY the three asserted exemptions, and any
 -- other member of the difference is NAMED in the failure. Each excluded name is licensed by a
--- positive disposition below, never by the absence of a match.
+-- positive disposition below, never by the absence of a match. create_board was the fourth
+-- until #280 gated it; removing it from this list is what makes the migration's claim checkable
+-- rather than asserted — if the gate were dropped from the function, create_board reappears in
+-- the difference and this assertion prints its name.
 select is(
   (select string_agg(x.proname || ':' || x.why, '; ' order by x.proname)
      from (
@@ -562,8 +579,8 @@ select is(
          from pg_proc p join pg_namespace n on n.oid = p.pronamespace
         where n.nspname = 'agent_board'
           and p.proname not in (
-                -- the four asserted exemptions...
-                '_upsert_board_membership_state', 'create_board',
+                -- the three asserted exemptions (create_board was the fourth until #280)...
+                '_upsert_board_membership_state',
                 '_fedsession_autojoin_default_board', 'bootstrap_board_owner_memberships',
                 -- ...and the two helpers, which ARE the gate rather than users of it
                 '_assert_actor_not_fleet_revoked', '_actor_fleet_revoked')
@@ -665,63 +682,12 @@ select is(
   'EXEMPTION A4: EVERY caller of _upsert_board_membership_state takes EXACTLY these parameters '
   '— not one declares a role, so "no caller can hand it one" is checked rather than argued');
 
--- ---------------------------------------------------------------------------
--- EXEMPTION B — create_board, the ONE authenticated-callable member of the class.
--- ---------------------------------------------------------------------------
-select is(
-  (select string_agg(pg_get_function_identity_arguments(p.oid), ' | ' order by p.oid)
-     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
-    where n.nspname = 'agent_board' and p.proname = 'create_board'),
-  'p_created_by_agent_id uuid, p_slug text, p_name text, p_description text, p_metadata jsonb, '
-  || 'p_visibility text',
-  'EXEMPTION B1: create_board takes EXACTLY these parameters — no role among them, and no '
-  'overload carrying one, so the owner seat it writes is a literal and not a caller choice');
-
-select ok(
-  agent_board_test.stripped_body('agent_board.create_board(uuid,text,text,text,jsonb,text)'::regprocedure, true)
-    like '%values (v_board.id, v_board.created_by_agent_id, ''joined'', ''owner'', v_board.created_by_agent_id)%',
-  'EXEMPTION B2: the seat it writes is the literal owner for the board OWN created_by_agent_id '
-  '— the resolved actor, seeding itself on a board it just inserted');
-
-select ok(
-  agent_board_test.stripped_body('agent_board.create_board(uuid,text,text,text,jsonb,text)'::regprocedure, true)
-    like '%board slug already in use%'
-  and strpos(agent_board_test.stripped_body('agent_board.create_board(uuid,text,text,text,jsonb,text)'::regprocedure, true),
-             'update agent_board.boards as b')
-    < strpos(agent_board_test.stripped_body('agent_board.create_board(uuid,text,text,text,jsonb,text)'::regprocedure, true),
-             'insert into agent_board.board_memberships'),
-  'EXEMPTION B3: the slug-COLLISION branch refuses a non-owner and updates the boards row '
-  'BEFORE the else-branch membership insert — the seat is on the fresh-board path only, so it '
-  'cannot elevate a membership on a pre-existing board');
-
--- ...and the residual, asserted as BEHAVIOUR so #280 closing flips a test rather than a comment.
-select pg_temp.claims('27600000-0000-0000-0000-000000000001');
-
-select lives_ok(
-  $$create temp table _cb as select * from agent_board.create_board(
-      '27610000-0000-4000-8000-000000000001','k276-residual-board','K276 Residual Board')$$,
-  'RESIDUAL (#280): a ledger-revoked agent CAN still create a board and be seeded its owner');
-
-select is(
-  (select bm.role from agent_board.board_memberships bm
-     join agent_board.boards b on b.id = bm.board_id
-    where b.slug = 'k276-residual-board'
-      and bm.agent_id = '27610000-0000-4000-8000-000000000001'),
-  'owner',
-  'RESIDUAL (#280): and the owner seat really landed — this is the manufacture-new-authority '
-  'gap #276 does NOT close, measured rather than described');
-
-select throws_like(
-  $$select * from agent_board.grant_board_role(
-      (select id from agent_board.boards where slug = 'k276-residual-board'),
-      '27610000-0000-4000-8000-000000000002','admin')$$,
-  '%fleet_revoked:%',
-  'but the gate still holds on the board it just created: it cannot GRANT there either, even '
-  'as that board owner with no ceiling row');
-
 -- ---------------------------------------------------------------------------
 -- EXEMPTIONS C and D — the two remaining service_role-only seeders. (What used to be
--- exemption C, _redeem_unbounded_invite_for_agent, is now GATED — see section 10.)
+-- exemption C, _redeem_unbounded_invite_for_agent, is now GATED — see section 10; what used to
+-- be exemption B, create_board, is now GATED too — see section 11, which is where its old
+-- RESIDUAL assertions were flipped. Its EXEMPTION B1/B2/B3 properties were deleted rather than
+-- kept: they are still true, but they existed to license an exemption that no longer exists.)
 -- ---------------------------------------------------------------------------
 select is(
   (select string_agg(p.proname || '=' ||
@@ -867,14 +833,14 @@ select is(
   'joined',
   'and that redemption really placed the revoked redeemer');
 
--- The residual companion: the board a revoked agent CAN still create is not a way back in.
-select throws_like(
-  $$select * from agent_board.create_invite_link(
-      (select id from agent_board.boards where slug = 'k276-residual-board'),
-      'admin','joined',5, now() + interval '2 days')$$,
-  '%fleet_revoked:%',
-  'RESIDUAL (#280) is contained: on the board it just created, a revoked agent still cannot '
-  'mint a link either — so the residual confers nothing on anyone else');
+-- #280 DELETED a fourth residual assertion that stood here: "on the board it just created, a
+-- revoked agent still cannot mint a link either". It was found by the SUITE, not by reading —
+-- it names no function, only the slug `k276-residual-board`, so a grep for `create_board` missed
+-- it and it went red as a null board id. Recorded because it is CLAUDE.md rule 1 in miniature:
+-- the class of things to change came from a list written by hand, and the one member phrased
+-- differently was the one that escaped. It is deleted rather than re-pointed: with the board it
+-- referenced gone, the claim it made is exactly the G3 MINT assertion above (a ledger-revoked
+-- owner cannot mint on a board it owns), driven there against board 1.
 
 
 -- The RESIDUAL BOUND rests on a lock that is already in this function: the token FOR UPDATE is
@@ -1006,5 +972,110 @@ select ok(
     !~ '\m(effective_at|reactivated_at)\M',
   'the gate has no supersession clause, matching the send path''s agent-subject predicate');
 
+-- ===========================================================================
+-- 11. #280 — create_board is GATED. These assertions are the FLIP of the RESIDUAL pair that
+--     lived in what was EXEMPTION B: this file previously asserted, as behaviour, that a
+--     ledger-revoked agent COULD create a board and be seeded its owner. #276's lane wrote it
+--     that way deliberately so that closing #280 would be a visible test change. This is that
+--     change.
+--
+--     THE ALLOW SIDE COMES FIRST AND MATTERS MORE THAN THE REFUSAL. create_board is the only
+--     gated site every ordinary user reaches, on the CLI's default post-enroll intent among
+--     other paths, so the expensive failure here is not "a revoked agent slipped through" but
+--     "nobody can create a board any more". JUDGEMENT 2 of the #276 header — a principal that
+--     was never in a fleet has no ledger row and passes by construction — is therefore asserted
+--     POSITIVELY, on BOTH routes (authenticated and the service_role create-on-behalf-of the
+--     gateway uses), by driving a real creation and reading the owner seat back. Never by the
+--     absence of a refusal.
+--
+--     Every refusal probe is followed by a STATE check, because a gate that raises AND writes is
+--     the failure throws_like alone cannot see. Here the state check is the operation's own
+--     outcome: no boards row for the slug (which is also why no membership can exist).
+-- ===========================================================================
+
+-- ALLOW, ROUTE 1: the NON-FLEET agent (agent 3 has no fleet_machine_agents row at all).
+select pg_temp.claims('27600000-0000-0000-0000-000000000003');
+
+select lives_ok(
+  $$create temp table _cb280a as select * from agent_board.create_board(
+      '27610000-0000-4000-8000-000000000003','k280-allow-board','K280 Allow Board')$$,
+  'ALLOW (#280): a NON-FLEET agent still creates a board — the capability this gate must not '
+  'regress, driven rather than inferred from the absence of a refusal');
+
+select is(
+  (select bm.role from agent_board.board_memberships bm
+     join agent_board.boards b on b.id = bm.board_id
+    where b.slug = 'k280-allow-board'
+      and bm.agent_id = '27610000-0000-4000-8000-000000000003'),
+  'owner',
+  'and its owner seat really landed, so the allow side is the whole operation and not just the '
+  'absence of a raise');
+
+-- ALLOW, ROUTE 2: service_role acting on behalf of a non-revoked principal — the gateway path.
+select pg_temp.service();
+
+select lives_ok(
+  $$create temp table _cb280b as select * from agent_board.create_board(
+      '27610000-0000-4000-8000-000000000003','k280-allow-board-svc','K280 Allow Board Svc')$$,
+  'ALLOW (#280): and service_role create-on-behalf-of a non-revoked agent still works');
+
+select is(
+  (select bm.role from agent_board.board_memberships bm
+     join agent_board.boards b on b.id = bm.board_id
+    where b.slug = 'k280-allow-board-svc'
+      and bm.agent_id = '27610000-0000-4000-8000-000000000003'),
+  'owner',
+  'and that owner seat landed too — the gate binds the PRINCIPAL, so a clean principal is '
+  'unaffected on either route');
+
+-- REFUSED, ROUTE 1: the ledger-revoked agent 1 (revoked in section 4; agents.status still
+-- 'active', which is this migration's precondition and what makes the refusal the LEDGER's).
+select pg_temp.claims('27600000-0000-0000-0000-000000000001');
+
+select throws_like(
+  $$select * from agent_board.create_board(
+      '27610000-0000-4000-8000-000000000001','k280-refused-board','K280 Refused Board')$$,
+  '%fleet_revoked:%create_board%',
+  '#280: a ledger-revoked agent can no longer create a board (this is the flipped RESIDUAL)');
+
+select is(
+  (select count(*)::int from agent_board.boards where slug = 'k280-refused-board'),
+  0,
+  'and the refused creation left NO board behind — the raise rolled back the boards insert, so '
+  'the owner seat and the owner_seed event cannot exist either');
+
+-- REFUSED, the SLUG-COLLISION branch. Agent 1 holds an ACTIVE owner membership on board 1, so
+-- it passes the owner check and would previously have renamed/reopened it. This is the scope
+-- consequence the migration header records explicitly: the gate covers BOTH branches.
+select throws_like(
+  $$select * from agent_board.create_board(
+      '27610000-0000-4000-8000-000000000001','k276-board-1','K276 Board 1 RENAMED')$$,
+  '%fleet_revoked:%create_board%',
+  '#280: and the slug-COLLISION branch is refused too — a revoked owner cannot reopen or '
+  'rename an existing board it still owns');
+
+select is(
+  (select b.name from agent_board.boards b where b.slug = 'k276-board-1'),
+  'K276 Board 1',
+  'and that board is UNCHANGED: the raise rolled the collision-branch UPDATE back, which is a '
+  'state check the message alone could not make');
+
+-- REFUSED, ROUTE 2: service_role supplying a REVOKED p_created_by_agent_id. The check binds the
+-- principal the write is attributed to, not the connection role — a gateway acting for a
+-- revoked agent is the case #276 was filed about, restated here for the one function #276 left.
+select pg_temp.service();
+
+select throws_like(
+  $$select * from agent_board.create_board(
+      '27610000-0000-4000-8000-000000000001','k280-refused-svc','K280 Refused Svc')$$,
+  '%fleet_revoked:%create_board%',
+  '#280: service_role create-on-behalf-of a REVOKED agent is refused — the gate binds the '
+  'principal, never the connection role');
+
+select is(
+  (select count(*)::int from agent_board.boards where slug = 'k280-refused-svc'),
+  0,
+  'and that one left no board behind either');
+
 select finish();
 rollback;