@consiliency/agent-board-schema 1.3.0 → 1.4.0

package/migrations/20260719001100_agent_board_enroll_federated_identity_pop.sql

@@ -0,0 +1,267 @@
+-- MBPORTALGATE SL-2 (IF-0-MBPORTALGATE-4): rework enroll_federated_identity to the
+-- real principal model — proof-of-possession at enrollment, one human -> N agents.
+--
+-- WHAT CHANGES vs the prior 8-arg RPC (20260718001500):
+--   * The Portal credential is a VERIFIED access-token JWT; the /enroll EF ALSO
+--     Ed25519-verifies a proof-of-possession signature over the token bytes and passes
+--     p_pop_verified=true (mirrors record_signing_key_proof_result's verify/record
+--     split). This RPC re-gates p_pop_verified and refuses false.
+--   * The subject (sub) establishes a HUMAN OWNER auth.users row idempotently per
+--     (issuer, sub), recorded as agents.owner_user_id. The AGENT is a SEPARATE agents
+--     row identified by the enrolled Ed25519 key — NEVER keyed on sub. Enrolling the
+--     same human (issuer, sub) with a second key creates a SECOND agent and does NOT
+--     mutate the first. Each agent gets its OWN auth_user_id (session-usable via its
+--     enrolled key, exactly like provision_agent), so revoking one agent revokes
+--     neither the human nor a sibling.
+--   * The enrolled public key lands in agent_signing_keys as status='active',
+--     proof_state='proven' (satisfies agent_signing_keys_active_requires_proof). The
+--     RPC RECOMPUTES the sha256:base64url fingerprint in-DB from p_agent_public_key and
+--     ASSERTS it equals p_agent_public_key_fingerprint (defense-in-depth against a
+--     direct service_role caller — the EF is the trusted computor, the RPC re-gates),
+--     and dedups on the agent_signing_keys.fingerprint UNIQUE index (duplicate -> raise).
+--
+-- Returned auth_user_id = the AGENT's own board principal (session-usable), NOT the
+-- human owner (the human is owner_user_id). This is the sanctioned impl choice
+-- IF-0-MBPORTALGATE-4 defers to pgTAP, pinned by the N-agents + revoke-isolation cases.
+--
+-- Fingerprint derivation is byte-identical to the delegation-enforcement child-key
+-- fingerprint (20260718001000): sha256 over the UTF-8 bytes of the base64url public-key
+-- STRING, base64url-encoded (unpadded), 'sha256:'-prefixed — so the EF's WebCrypto
+-- computation and this DB computation round-trip exactly.
+--
+-- service_role-only. Additive forward-only migration; writes no schema_version (stays 8).
+-- The prior 8-arg function is DROPped (return type widens 4->5 cols, so create-or-replace
+-- cannot be used) and replaced. No migration/EF/test FILE is deleted.
+
+drop function if exists agent_board.enroll_federated_identity(
+  text, text, text, jsonb, text, text, text[], text[]);
+
+create or replace function agent_board.enroll_federated_identity(
+  p_issuer text,
+  p_audience text,
+  p_subject text,
+  p_human_identity_claim jsonb,
+  p_slug text,
+  p_agent_public_key text,
+  p_agent_public_key_format text,
+  p_agent_public_key_fingerprint text,
+  p_pop_verified boolean,
+  p_actor_sub text default null,
+  p_agent_kind text default 'agent',
+  p_requested_scopes text[] default '{}',
+  p_requested_board_scopes text[] default '{}'
+)
+returns table(
+  agent_id uuid,
+  auth_user_id uuid,
+  provider_id text,
+  signing_key_id uuid,
+  granted_scopes text[]
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_slug text;
+  v_kind text;
+  v_provider agent_board.identity_providers%rowtype;
+  v_owner_user_id uuid;
+  v_auth_user_id uuid;
+  v_agent_handle text;
+  v_agent_id uuid;
+  v_signing_key_id uuid;
+  v_fingerprint text;
+  v_key_hex text;
+  v_requested_scopes text[] := coalesce(p_requested_scopes, '{}');
+  v_requested_board_scopes text[] := coalesce(p_requested_board_scopes, '{}');
+begin
+  -- service_role-only (defense in depth on top of the execute-grant revocation).
+  if not agent_board._is_service_role() then
+    raise exception 'service_role required for enroll_federated_identity' using errcode = '42501';
+  end if;
+
+  -- A verified subject + human identity claim are always present from the EF.
+  if p_subject is null then
+    raise exception 'verified subject is required' using errcode = '22023';
+  end if;
+  if p_human_identity_claim is null then
+    raise exception 'human identity claim is required' using errcode = '22023';
+  end if;
+
+  -- (0) PoP gate — the EF Ed25519-verified the proof-of-possession over the token
+  -- bytes and passes true. Refuse false BEFORE any write (no agent/key/audit row).
+  if p_pop_verified is not true then
+    raise exception 'proof-of-possession was not verified; enrollment refused'
+      using errcode = '42501';
+  end if;
+
+  -- (1) Public-key shape gate. The enroll contract is raw Ed25519 (32 bytes -> 43
+  -- base64url chars). Reject the all-zero small-order placeholder.
+  if p_agent_public_key_format is distinct from 'raw_ed25519_base64url' then
+    raise exception 'agent public key format must be raw_ed25519_base64url' using errcode = '22023';
+  end if;
+  if p_agent_public_key is null or p_agent_public_key !~ '^[A-Za-z0-9_-]{43}$' then
+    raise exception 'malformed agent public key: expected a 43-char base64url raw Ed25519 key'
+      using errcode = '22023';
+  end if;
+  if p_agent_public_key = repeat('A', 43) then
+    raise exception 'agent public key is the all-zero small-order placeholder and is rejected'
+      using errcode = '22023';
+  end if;
+
+  -- (2) Recompute-and-assert the fingerprint in-DB (byte-identical to the EF/WebCrypto
+  -- and to the delegation-enforcement derivation). A tampered fingerprint -> raise.
+  v_fingerprint := 'sha256:' || rtrim(
+    translate(encode(extensions.digest(convert_to(p_agent_public_key, 'UTF8'), 'sha256'), 'base64'), '+/', '-_'),
+    '=');
+  if p_agent_public_key_fingerprint is distinct from v_fingerprint then
+    raise exception 'agent public key fingerprint mismatch (recompute != supplied)'
+      using errcode = '22023';
+  end if;
+
+  -- (3) act.sub is audit-only, but when present it must be a real value.
+  if p_actor_sub is not null and length(trim(p_actor_sub)) = 0 then
+    raise exception 'actor sub, when present, must be non-empty' using errcode = '22023';
+  end if;
+
+  v_slug := agent_board._normalize_provision_slug(p_slug);
+  v_kind := lower(coalesce(trim(p_agent_kind), ''));
+
+  -- (4) allowlist lookup by (issuer, audience); must exist + supported + policy-approved.
+  select *
+    into v_provider
+    from agent_board.identity_providers
+   where issuer = p_issuer
+     and audience = p_audience
+   limit 1;
+  if v_provider.id is null then
+    raise exception 'issuer/audience not in the identity-provider allowlist' using errcode = '42501';
+  end if;
+  if not v_provider.supported then
+    raise exception 'identity provider is not supported' using errcode = '42501';
+  end if;
+  if not v_provider.policy_approved then
+    raise exception 'identity provider is not policy-approved' using errcode = '42501';
+  end if;
+
+  -- (5) scope-ceiling + kind gate. 'system' is never federatable.
+  if v_kind = 'system' then
+    raise exception 'the system kind cannot be federated' using errcode = '42501';
+  end if;
+  if v_kind not in ('human', 'agent') then
+    raise exception 'agent kind must be human or agent' using errcode = '22023';
+  end if;
+  if array_length(v_provider.allowed_agent_kinds, 1) is not null
+     and not (v_kind = any (v_provider.allowed_agent_kinds)) then
+    raise exception 'agent kind % is outside the provider ceiling', v_kind using errcode = '42501';
+  end if;
+  if not (v_requested_scopes <@ v_provider.allowed_scopes) then
+    raise exception 'requested scopes exceed the provider allowed_scopes ceiling' using errcode = '42501';
+  end if;
+  if not (v_requested_board_scopes <@ v_provider.allowed_board_scopes) then
+    raise exception 'requested board scopes exceed the provider allowed_board_scopes ceiling' using errcode = '42501';
+  end if;
+
+  -- (6) dedup on the enrolled key: a fingerprint already enrolled cannot be re-bound.
+  -- Pre-check for a clean error; the UNIQUE index is the hard guarantee.
+  if exists (select 1 from agent_board.agent_signing_keys k where k.fingerprint = v_fingerprint) then
+    raise exception 'this signing key is already enrolled (duplicate fingerprint)'
+      using errcode = '23505';
+  end if;
+
+  -- (7) HUMAN OWNER — established idempotently per (issuer, sub) so re-enrollment of the
+  -- same human converges to ONE owner auth.users row (recorded as owner_user_id).
+  v_owner_user_id := agent_board._ensure_agent_auth_user(
+    'fed-human-' || substr(encode(extensions.digest(convert_to(p_issuer || '|' || p_subject, 'UTF8'), 'sha256'), 'hex'), 1, 32));
+
+  -- (8) AGENT handle — unique per enrolled key. Use the slug; on collision (a human's
+  -- 2nd agent under the same slug, or an unrelated handle) disambiguate with a
+  -- deterministic per-key hex fragment so a distinct agent row is always created.
+  v_key_hex := encode(extensions.digest(convert_to(p_agent_public_key, 'UTF8'), 'sha256'), 'hex');
+  v_agent_handle := v_slug;
+  if exists (select 1 from agent_board.agents a where a.handle = v_agent_handle) then
+    v_agent_handle := v_slug || '-' || substr(v_key_hex, 1, 12);
+  end if;
+
+  -- (9) the agent's OWN board principal (session-usable via its enrolled key).
+  v_auth_user_id := agent_board._ensure_agent_auth_user(v_agent_handle);
+
+  -- (10) create the SEPARATE agent row (never keyed on sub; owner = the human).
+  insert into agent_board.agents(
+    agent_type,
+    kind,
+    handle,
+    display_name,
+    status,
+    auth_user_id,
+    owner_user_id,
+    metadata
+  )
+  values (
+    v_kind,
+    v_kind::agent_board.agent_kind,
+    v_agent_handle,
+    agent_board._default_provision_display_name(v_agent_handle),
+    'active',
+    v_auth_user_id,
+    v_owner_user_id,
+    jsonb_build_object(
+      'federation', jsonb_build_object(
+        'issuer', p_issuer,
+        'audience', p_audience,
+        'subject', p_subject,
+        'actorSub', p_actor_sub,
+        'providerId', v_provider.id,
+        'signingKeyFingerprint', v_fingerprint,
+        'requestedScopes', to_jsonb(v_requested_scopes),
+        'requestedBoardScopes', to_jsonb(v_requested_board_scopes),
+        'popVerified', true,
+        'enrolledAt', now()
+      )
+    )
+  )
+  returning id into v_agent_id;
+
+  -- (11) enroll the public key as active + proven (satisfies active_requires_proof).
+  insert into agent_board.agent_signing_keys(
+    id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint,
+    status, proof_state, metadata
+  )
+  values (
+    gen_random_uuid(), v_agent_id, 'portal-enroll', 1, p_agent_public_key,
+    p_agent_public_key_format, v_fingerprint,
+    'active', 'proven',
+    jsonb_build_object('enrolledVia', 'federated_identity', 'popVerified', true)
+  )
+  returning id into v_signing_key_id;
+
+  -- (12) one static claim-snapshot audit row (the verified claim contains act.sub).
+  insert into agent_board.enrollment_federation_audit(
+    issuer, audience, subject, human_identity_claim, provider_id,
+    agent_id, auth_user_id, requested_scopes, granted_scopes
+  )
+  values (
+    p_issuer, p_audience, p_subject, p_human_identity_claim, v_provider.id,
+    v_agent_id, v_auth_user_id, v_requested_scopes, v_requested_scopes
+  );
+
+  return query
+  select v_agent_id, v_auth_user_id, v_provider.id, v_signing_key_id, v_requested_scopes;
+end;
+$$;
+
+comment on function agent_board.enroll_federated_identity(
+  text, text, text, jsonb, text, text, text, text, boolean, text, text, text[], text[]) is
+  'PoP-at-enrollment federated identity: re-gates p_pop_verified + allowlist/policy/scope, '
+  'recomputes-and-asserts the key fingerprint, establishes ONE human owner (owner_user_id) '
+  'idempotently per (issuer,sub), creates a SEPARATE key-identified agent (own auth_user_id) '
+  'per enrolled key, and enrolls the key active+proven. service_role-only; returns a '
+  'board-native agent + signing_key_id, never a Portal token.';
+
+revoke all on function agent_board.enroll_federated_identity(
+  text, text, text, jsonb, text, text, text, text, boolean, text, text, text[], text[])
+  from public, anon, authenticated;
+grant execute on function agent_board.enroll_federated_identity(
+  text, text, text, jsonb, text, text, text, text, boolean, text, text, text[], text[])
+  to service_role;

package/migrations/20260719001200_agent_board_enroll_federated_identity_raw_fingerprint.sql

@@ -0,0 +1,296 @@
+-- MBPORTAL PR #32 reconcile (B1 + B2): server-authoritative identity + canonical
+-- raw-byte fingerprint for enroll_federated_identity.
+--
+-- WHY (two blocking-class defects the mock hid, both falsifying "proven end-to-end"):
+--
+--   B1 — the enrolled agent could never mint a /session. The RPC stores the enrolled
+--   key as key_id='portal-enroll', key_version=1 and (on handle collision) rewrites the
+--   agent handle, but the prior return table surfaced NEITHER, so the client kept its
+--   locally-generated key_id + the raw input slug and /session (which resolves by the
+--   exact (agents.handle, key_id, key_version)) found no row. FIX: the server is
+--   authoritative for identity — the return table now ALSO yields key_id, key_version,
+--   and the post-normalization/disambiguation agent_handle, and the client mints
+--   /session with exactly those (keeping only its private key from the keystore).
+--
+--   B2 — the fingerprint (the sole uniqueness/dedup/revocation key) was computed over
+--   the base64url STRING, not the decoded key bytes. A 32-byte Ed25519 key's 43-char
+--   base64url encoding has 2 don't-care low bits, so up to 4 distinct strings decode to
+--   the SAME key, all pass the regex, all verify one PoP signature, yet hash to 4
+--   different fingerprints -> the UNIQUE index admits 4 rows: one keypair backing up to
+--   4 agents, and revoking one leaves the siblings alive. FIX: decode agent_public_key
+--   to 32 raw bytes, REJECT if a canonical re-encode != the input string (kills the
+--   4-strings-one-key aliasing and the non-canonical all-zero-placeholder bypass), and
+--   compute the fingerprint over the RAW 32 bytes. This matches the client child_keygen
+--   fingerprint (already raw-byte) and is mirrored in the /enroll EF.
+--
+-- Additive, forward-only. The return table WIDENS 5 -> 8 columns, so create-or-replace
+-- cannot be used: the released 13-arg function (20260719001100) is DROPped and recreated
+-- here. The released 001100 bytes are NOT edited. Args are unchanged (still 13); the
+-- grant/revoke signatures are identical. Writes no schema_version (stays 8).
+
+drop function if exists agent_board.enroll_federated_identity(
+  text, text, text, jsonb, text, text, text, text, boolean, text, text, text[], text[]);
+
+create or replace function agent_board.enroll_federated_identity(
+  p_issuer text,
+  p_audience text,
+  p_subject text,
+  p_human_identity_claim jsonb,
+  p_slug text,
+  p_agent_public_key text,
+  p_agent_public_key_format text,
+  p_agent_public_key_fingerprint text,
+  p_pop_verified boolean,
+  p_actor_sub text default null,
+  p_agent_kind text default 'agent',
+  p_requested_scopes text[] default '{}',
+  p_requested_board_scopes text[] default '{}'
+)
+returns table(
+  agent_id uuid,
+  auth_user_id uuid,
+  provider_id text,
+  signing_key_id uuid,
+  granted_scopes text[],
+  key_id text,
+  key_version int,
+  agent_handle text
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_slug text;
+  v_kind text;
+  v_provider agent_board.identity_providers%rowtype;
+  v_owner_user_id uuid;
+  v_auth_user_id uuid;
+  v_agent_handle text;
+  v_agent_id uuid;
+  v_signing_key_id uuid;
+  v_fingerprint text;
+  v_key_hex text;
+  v_raw_key bytea;
+  v_reencoded text;
+  v_key_id text := 'portal-enroll';
+  v_key_version int := 1;
+  v_requested_scopes text[] := coalesce(p_requested_scopes, '{}');
+  v_requested_board_scopes text[] := coalesce(p_requested_board_scopes, '{}');
+begin
+  -- service_role-only (defense in depth on top of the execute-grant revocation).
+  if not agent_board._is_service_role() then
+    raise exception 'service_role required for enroll_federated_identity' using errcode = '42501';
+  end if;
+
+  -- A verified subject + human identity claim are always present from the EF.
+  if p_subject is null then
+    raise exception 'verified subject is required' using errcode = '22023';
+  end if;
+  if p_human_identity_claim is null then
+    raise exception 'human identity claim is required' using errcode = '22023';
+  end if;
+
+  -- (0) PoP gate — the EF Ed25519-verified the proof-of-possession over the token
+  -- bytes and passes true. Refuse false BEFORE any write (no agent/key/audit row).
+  if p_pop_verified is not true then
+    raise exception 'proof-of-possession was not verified; enrollment refused'
+      using errcode = '42501';
+  end if;
+
+  -- (1) Public-key shape gate. The enroll contract is raw Ed25519 (32 bytes -> 43
+  -- base64url chars).
+  if p_agent_public_key_format is distinct from 'raw_ed25519_base64url' then
+    raise exception 'agent public key format must be raw_ed25519_base64url' using errcode = '22023';
+  end if;
+  if p_agent_public_key is null or p_agent_public_key !~ '^[A-Za-z0-9_-]{43}$' then
+    raise exception 'malformed agent public key: expected a 43-char base64url raw Ed25519 key'
+      using errcode = '22023';
+  end if;
+
+  -- (1a) B2 — decode base64url -> raw 32 bytes and REJECT any non-canonical encoding.
+  -- A 32-byte key's 43-char base64url has 2 don't-care low bits, so up to 4 distinct
+  -- strings decode to the same key. Re-encoding the decoded bytes canonically and
+  -- requiring string equality collapses those aliases to ONE accepted encoding, so the
+  -- fingerprint (over raw bytes, below) is a true per-key identity — one keypair can
+  -- never enroll as multiple agents, and revocation isolation holds.
+  v_raw_key := decode(translate(p_agent_public_key, '-_', '+/') || '=', 'base64');
+  if octet_length(v_raw_key) <> 32 then
+    raise exception 'agent public key must decode to exactly 32 raw Ed25519 bytes'
+      using errcode = '22023';
+  end if;
+  v_reencoded := rtrim(translate(encode(v_raw_key, 'base64'), '+/', '-_'), '=');
+  if v_reencoded is distinct from p_agent_public_key then
+    raise exception 'agent public key is not canonical base64url (aliased encoding rejected)'
+      using errcode = '22023';
+  end if;
+
+  -- (1b) Reject the all-zero small-order placeholder over the RAW bytes (not a
+  -- string-exact match), so no alternate encoding can smuggle it past.
+  if v_raw_key = decode(repeat('00', 32), 'hex') then
+    raise exception 'agent public key is the all-zero small-order placeholder and is rejected'
+      using errcode = '22023';
+  end if;
+
+  -- (2) Recompute-and-assert the fingerprint in-DB over the RAW 32 bytes
+  -- (byte-identical to the EF/WebCrypto raw-byte derivation and the client child_keygen
+  -- keyRef). A tampered fingerprint -> raise.
+  v_fingerprint := 'sha256:' || rtrim(
+    translate(encode(extensions.digest(v_raw_key, 'sha256'), 'base64'), '+/', '-_'),
+    '=');
+  if p_agent_public_key_fingerprint is distinct from v_fingerprint then
+    raise exception 'agent public key fingerprint mismatch (recompute != supplied)'
+      using errcode = '22023';
+  end if;
+
+  -- (3) act.sub is audit-only, but when present it must be a real value.
+  if p_actor_sub is not null and length(trim(p_actor_sub)) = 0 then
+    raise exception 'actor sub, when present, must be non-empty' using errcode = '22023';
+  end if;
+
+  v_slug := agent_board._normalize_provision_slug(p_slug);
+  v_kind := lower(coalesce(trim(p_agent_kind), ''));
+
+  -- (4) allowlist lookup by (issuer, audience); must exist + supported + policy-approved.
+  select *
+    into v_provider
+    from agent_board.identity_providers
+   where issuer = p_issuer
+     and audience = p_audience
+   limit 1;
+  if v_provider.id is null then
+    raise exception 'issuer/audience not in the identity-provider allowlist' using errcode = '42501';
+  end if;
+  if not v_provider.supported then
+    raise exception 'identity provider is not supported' using errcode = '42501';
+  end if;
+  if not v_provider.policy_approved then
+    raise exception 'identity provider is not policy-approved' using errcode = '42501';
+  end if;
+
+  -- (5) scope-ceiling + kind gate. 'system' is never federatable.
+  if v_kind = 'system' then
+    raise exception 'the system kind cannot be federated' using errcode = '42501';
+  end if;
+  if v_kind not in ('human', 'agent') then
+    raise exception 'agent kind must be human or agent' using errcode = '22023';
+  end if;
+  if array_length(v_provider.allowed_agent_kinds, 1) is not null
+     and not (v_kind = any (v_provider.allowed_agent_kinds)) then
+    raise exception 'agent kind % is outside the provider ceiling', v_kind using errcode = '42501';
+  end if;
+  if not (v_requested_scopes <@ v_provider.allowed_scopes) then
+    raise exception 'requested scopes exceed the provider allowed_scopes ceiling' using errcode = '42501';
+  end if;
+  if not (v_requested_board_scopes <@ v_provider.allowed_board_scopes) then
+    raise exception 'requested board scopes exceed the provider allowed_board_scopes ceiling' using errcode = '42501';
+  end if;
+
+  -- (6) dedup on the enrolled key: a fingerprint already enrolled cannot be re-bound.
+  -- Pre-check for a clean error; the UNIQUE index is the hard guarantee.
+  if exists (select 1 from agent_board.agent_signing_keys k where k.fingerprint = v_fingerprint) then
+    raise exception 'this signing key is already enrolled (duplicate fingerprint)'
+      using errcode = '23505';
+  end if;
+
+  -- (7) HUMAN OWNER — established idempotently per (issuer, sub) so re-enrollment of the
+  -- same human converges to ONE owner auth.users row (recorded as owner_user_id).
+  v_owner_user_id := agent_board._ensure_agent_auth_user(
+    'fed-human-' || substr(encode(extensions.digest(convert_to(p_issuer || '|' || p_subject, 'UTF8'), 'sha256'), 'hex'), 1, 32));
+
+  -- (8) AGENT handle — unique per enrolled key. Use the slug; on collision (a human's
+  -- 2nd agent under the same slug, or an unrelated handle) disambiguate with a
+  -- deterministic per-key hex fragment so a distinct agent row is always created. The
+  -- resulting handle is RETURNED so the client can mint /session against it.
+  v_key_hex := encode(extensions.digest(v_raw_key, 'sha256'), 'hex');
+  v_agent_handle := v_slug;
+  if exists (select 1 from agent_board.agents a where a.handle = v_agent_handle) then
+    v_agent_handle := v_slug || '-' || substr(v_key_hex, 1, 12);
+  end if;
+
+  -- (9) the agent's OWN board principal (session-usable via its enrolled key).
+  v_auth_user_id := agent_board._ensure_agent_auth_user(v_agent_handle);
+
+  -- (10) create the SEPARATE agent row (never keyed on sub; owner = the human).
+  insert into agent_board.agents(
+    agent_type,
+    kind,
+    handle,
+    display_name,
+    status,
+    auth_user_id,
+    owner_user_id,
+    metadata
+  )
+  values (
+    v_kind,
+    v_kind::agent_board.agent_kind,
+    v_agent_handle,
+    agent_board._default_provision_display_name(v_agent_handle),
+    'active',
+    v_auth_user_id,
+    v_owner_user_id,
+    jsonb_build_object(
+      'federation', jsonb_build_object(
+        'issuer', p_issuer,
+        'audience', p_audience,
+        'subject', p_subject,
+        'actorSub', p_actor_sub,
+        'providerId', v_provider.id,
+        'signingKeyFingerprint', v_fingerprint,
+        'requestedScopes', to_jsonb(v_requested_scopes),
+        'requestedBoardScopes', to_jsonb(v_requested_board_scopes),
+        'popVerified', true,
+        'enrolledAt', now()
+      )
+    )
+  )
+  returning id into v_agent_id;
+
+  -- (11) enroll the public key as active + proven (satisfies active_requires_proof).
+  insert into agent_board.agent_signing_keys(
+    id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint,
+    status, proof_state, metadata
+  )
+  values (
+    gen_random_uuid(), v_agent_id, v_key_id, v_key_version, p_agent_public_key,
+    p_agent_public_key_format, v_fingerprint,
+    'active', 'proven',
+    jsonb_build_object('enrolledVia', 'federated_identity', 'popVerified', true)
+  )
+  returning id into v_signing_key_id;
+
+  -- (12) one static claim-snapshot audit row (the verified claim contains act.sub).
+  insert into agent_board.enrollment_federation_audit(
+    issuer, audience, subject, human_identity_claim, provider_id,
+    agent_id, auth_user_id, requested_scopes, granted_scopes
+  )
+  values (
+    p_issuer, p_audience, p_subject, p_human_identity_claim, v_provider.id,
+    v_agent_id, v_auth_user_id, v_requested_scopes, v_requested_scopes
+  );
+
+  -- Server-authoritative identity: the client mints /session with the RETURNED
+  -- key_id/key_version/agent_handle (its private key stays in the keystore).
+  return query
+  select v_agent_id, v_auth_user_id, v_provider.id, v_signing_key_id, v_requested_scopes,
+         v_key_id, v_key_version, v_agent_handle;
+end;
+$$;
+
+comment on function agent_board.enroll_federated_identity(
+  text, text, text, jsonb, text, text, text, text, boolean, text, text, text[], text[]) is
+  'PoP-at-enrollment federated identity: re-gates p_pop_verified + allowlist/policy/scope, '
+  'decodes the key to raw bytes + rejects non-canonical/all-zero encodings, recomputes-'
+  'and-asserts the sha256:base64url fingerprint over the RAW 32 bytes, establishes ONE '
+  'human owner (owner_user_id) idempotently per (issuer,sub), creates a SEPARATE '
+  'key-identified agent (own auth_user_id) per enrolled key, enrolls the key active+proven, '
+  'and RETURNS the server-assigned key_id/key_version/agent_handle so the client mints '
+  '/session against the authoritative identity. service_role-only; never returns a Portal token.';
+
+revoke all on function agent_board.enroll_federated_identity(
+  text, text, text, jsonb, text, text, text, text, boolean, text, text, text[], text[])
+  from public, anon, authenticated;
+grant execute on function agent_board.enroll_federated_identity(
+  text, text, text, jsonb, text, text, text, text, boolean, text, text, text[], text[])
+  to service_role;

package/migrations/20260719001300_agent_board_enroll_rate_events_reaper_rls.sql

@@ -0,0 +1,62 @@
+-- MBPORTAL PR #32 reconcile (S1 + S2): bound + isolate agent_board.enroll_rate_events.
+--
+--   S1 — the /enroll rate-cap table (20260719000300) had NO reaper: every under-cap
+--   request INSERTs a row and nothing ever deletes it, so the table grows unbounded
+--   (the challenge path got a reaper; this one did not). FIX: ship
+--   reap_expired_enroll_rate_events(interval), mirroring
+--   reap_expired_signing_key_challenges — security definer, service_role-only,
+--   deletes-and-counts rows older than p_older_than (default 1 hour; comfortably past
+--   any sane rolling window). Scheduling (pg_cron / external cadence) is a deferred
+--   operational owner, exactly like the challenge reaper; the callable function is
+--   in-scope. (The XFF-hop half of S1 is fixed in the /enroll EF, which owns index.ts.)
+--
+--   S2 — enroll_rate_events was created WITHOUT row level security. It grants to
+--   service_role only (unreachable by client JWTs today), but an RLS-disabled table
+--   leaves no defense if a future blanket grant is added. FIX (matching the
+--   workload_providers corrective, 20260714000200): enable RLS + revoke from
+--   anon/authenticated + explicit deny policies, so a client JWT can never read the
+--   per-source rate ledger even under a future grant. service_role bypasses RLS, so the
+--   /enroll cap path is unaffected.
+--
+-- Additive, forward-only. Idempotent. Writes no schema_version (stays 8).
+
+-- S1 — reaper.
+create or replace function agent_board.reap_expired_enroll_rate_events(
+  p_older_than interval default interval '1 hour'
+)
+returns bigint
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_count bigint;
+begin
+  with deleted as (
+    delete from agent_board.enroll_rate_events e
+     where e.created_at < now() - coalesce(p_older_than, interval '1 hour')
+    returning 1
+  )
+  select count(*) into v_count from deleted;
+  return v_count;
+end;
+$$;
+
+comment on function agent_board.reap_expired_enroll_rate_events(interval) is
+  'Deletes agent_board.enroll_rate_events rows older than p_older_than (default 1 hour); returns the affected count. service_role-only. Scheduling (pg_cron / external cadence) is a deferred operational owner.';
+
+revoke all on function agent_board.reap_expired_enroll_rate_events(interval) from public, anon, authenticated;
+grant execute on function agent_board.reap_expired_enroll_rate_events(interval) to service_role;
+
+-- S2 — RLS + client isolation (defense-in-depth vs a future blanket grant).
+alter table agent_board.enroll_rate_events enable row level security;
+
+revoke all on agent_board.enroll_rate_events from anon, authenticated;
+
+drop policy if exists enroll_rate_events_deny_anon on agent_board.enroll_rate_events;
+create policy enroll_rate_events_deny_anon on agent_board.enroll_rate_events
+  as permissive for select to anon using (false);
+
+drop policy if exists enroll_rate_events_deny_authenticated on agent_board.enroll_rate_events;
+create policy enroll_rate_events_deny_authenticated on agent_board.enroll_rate_events
+  as permissive for select to authenticated using (false);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",
@@ -25,6 +25,12 @@
     "LICENSE",
     "NOTICE"
   ],
+  "scripts": {
+    "build:manifest": "node ../../scripts/build-schema-manifest.mjs",
+    "check:manifest": "node ../../scripts/build-schema-manifest.mjs --check",
+    "test": "vitest run",
+    "pack:smoke": "node ../../scripts/schema-packed-consumer-smoke.mjs"
+  },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
@@ -32,11 +38,5 @@
   "engines": {
     "node": ">=18"
   },
-  "license": "Apache-2.0",
-  "scripts": {
-    "build:manifest": "node ../../scripts/build-schema-manifest.mjs",
-    "check:manifest": "node ../../scripts/build-schema-manifest.mjs --check",
-    "test": "vitest run",
-    "pack:smoke": "node ../../scripts/schema-packed-consumer-smoke.mjs"
-  }
-}
+  "license": "Apache-2.0"
+}