@consiliency/agent-board-schema 1.3.0 → 1.4.0

package/tests/agent_board_bundle_endpoint_compat.test.sql

@@ -22,15 +22,27 @@ select ok(has_function_privilege('service_role',
 -- before any install: not ready, schema version still reported
 select is((agent_board.get_bundle_compatibility() ->> 'ready'), 'false',
   'not ready before materializer records an install');
-select is((agent_board.get_bundle_compatibility() ->> 'schema_version'), '7',
-  'compatibility reports schema version 7');
+select is((agent_board.get_bundle_compatibility() ->> 'schema_version'), '8',
+  'compatibility reports schema version 8');
 
--- signed-write enforcement posture is active (canary revoked direct writes)
+-- Post-MBSESSION the 8 core sends are re-granted to authenticated, so the LIVE
+-- baseline posture is signed_write_enforced=false. Exercise BOTH branches in this
+-- rolled-back txn. Enforced branch: revoke EXECUTE from authenticated on ALL
+-- eight gated-write overloads (the probe checks by routine name, so any single
+-- remaining overload grant keeps enforcement false) -> reports active=true.
+revoke execute on function agent_board.send_direct_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.send_direct_message(uuid, uuid, jsonb, text, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.send_multicast_message(uuid, uuid, uuid[], text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.send_multicast_message(uuid, uuid, jsonb, text, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.post_board_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.post_board_message(uuid, uuid, text, text, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.create_tasking_delivery(uuid, uuid, text, text, uuid[], uuid, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.create_tasking_delivery(uuid, uuid, text, text, jsonb, text, text, text, text, text, jsonb) from authenticated;
 select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'true',
-  'signed-write enforcement is reported active');
+  'signed-write enforcement reports active when all gated write RPCs are revoked from authenticated');
 
--- probe covers ALL four gated RPCs: re-granting EXECUTE on one of the OTHER
--- three (not send_direct_message) must flip enforcement to false.
+-- Re-grant branch: re-granting EXECUTE on any one gated write RPC (as MBSESSION
+-- does at 20260718000800) flips enforcement back to false.
 grant execute on function agent_board.send_multicast_message(uuid, uuid, uuid[], text, text, text, text, text, jsonb) to authenticated;
 select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'false',
   'enforcement flips to false when any gated write RPC is re-granted to authenticated');

package/tests/agent_board_canary_signed_fleet_enforcement.test.sql

@@ -14,8 +14,8 @@ select function_privs_are(
   'send_direct_message',
   array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
   'authenticated',
-  array[]::text[],
-  'authenticated cannot bypass direct signed gateway'
+  array['EXECUTE'],
+  'authenticated may execute direct scoped send on the MBSESSION re-granted path'
 );
 
 select function_privs_are(
@@ -23,8 +23,8 @@ select function_privs_are(
   'send_multicast_message',
   array['uuid','uuid','uuid[]','text','text','text','text','text','jsonb'],
   'authenticated',
-  array[]::text[],
-  'authenticated cannot bypass multicast signed gateway'
+  array['EXECUTE'],
+  'authenticated may execute multicast scoped send on the MBSESSION re-granted path'
 );
 
 select function_privs_are(
@@ -32,8 +32,8 @@ select function_privs_are(
   'post_board_message',
   array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
   'authenticated',
-  array[]::text[],
-  'authenticated cannot bypass board signed gateway'
+  array['EXECUTE'],
+  'authenticated may execute board scoped send on the MBSESSION re-granted path'
 );
 
 select function_privs_are(
@@ -41,8 +41,8 @@ select function_privs_are(
   'create_tasking_delivery',
   array['uuid','uuid','text','text','uuid[]','uuid','text','text','text','jsonb'],
   'authenticated',
-  array[]::text[],
-  'authenticated cannot bypass tasking signed gateway'
+  array['EXECUTE'],
+  'authenticated may execute tasking scoped send on the MBSESSION re-granted path'
 );
 
 select ok(

package/tests/agent_board_delegation_enforcement.test.sql

@@ -0,0 +1,175 @@
+-- MBDELEG SL-1 pgTAP (IF-0-MBDELEG-2): bounded root-minted delegation spinoff.
+--
+-- Proves mint_delegated_child mints ONLY under the full bound set (mode=root_minted,
+-- policy unrevoked, root principal active, requested ⊆ allowed_scopes, true lineage
+-- root, max_active_children) and rejects each violation with no child/grant; that a
+-- minted child gets a revocable ephemeral signing key; and that renew_delegated_grant
+-- extends while the root is active but raises once the root is revoked/inactive (a
+-- grant cannot outlive the root's authority).
+--
+-- Runs as postgres (service_role-equivalent).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(18);
+
+create temp table _deleg_fx (
+  owner_id uuid, r1 uuid, r2 uuid, r3 uuid,
+  child_a uuid, child_b uuid, exp_a timestamptz,
+  slug_c text, ca_pubkey text
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  u_owner uuid; u_r1 uuid; u_r2 uuid; u_r3 uuid;
+  v_r1 uuid := gen_random_uuid(); v_r2 uuid := gen_random_uuid(); v_r3 uuid := gen_random_uuid();
+  v_pol1 uuid := gen_random_uuid(); v_pol2 uuid := gen_random_uuid(); v_pol3 uuid := gen_random_uuid();
+  v_ca uuid; v_cb uuid; v_exp_a timestamptz;
+  -- Real (random) 43-char base64url Ed25519 public keys, generated caller-side.
+  v_ca_pubkey text := rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+  v_cb_pubkey text := rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+begin
+  u_owner := public.ensure_github_user('deleg-own-'||s, 'deleg-own-'||s||'@example.test', 'deleg-own-'||s, 'OWN');
+  u_r1 := public.ensure_github_user('deleg-r1-'||s, 'deleg-r1-'||s||'@example.test', 'deleg-r1-'||s, 'R1');
+  u_r2 := public.ensure_github_user('deleg-r2-'||s, 'deleg-r2-'||s||'@example.test', 'deleg-r2-'||s, 'R2');
+  u_r3 := public.ensure_github_user('deleg-r3-'||s, 'deleg-r3-'||s||'@example.test', 'deleg-r3-'||s, 'R3');
+
+  -- Root R1: root_minted policy, allowed_scopes=[a,b], ceiling 8h, max 2 children.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_r1, 'agent', 'deleg-r1-'||s, 'R1', 'active', u_r1, u_owner);
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, max_depth, max_active_children, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_pol1, v_r1, 'root_minted', 1, 2, jsonb_build_array('scope:a', 'scope:b'), interval '8 hours', true);
+
+  -- Root R2: independent_auth policy (opts out of root-minted spinoff).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_r2, 'agent', 'deleg-r2-'||s, 'R2', 'active', u_r2, u_owner);
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes, child_ttl_ceiling)
+  values (v_pol2, v_r2, 'independent_auth', jsonb_build_array('scope:a'), interval '8 hours');
+
+  -- Root R3: root_minted, uncapped, require_child_signing_key -> used for the
+  -- malformed-public-key rejection (reaches the key-enrollment step).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_r3, 'agent', 'deleg-r3-'||s, 'R3', 'active', u_r3, u_owner);
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_pol3, v_r3, 'root_minted', jsonb_build_array('scope:a'), interval '8 hours', true);
+
+  -- Happy child-a (scope:a), enrolling the caller-supplied public key. Grant #1.
+  select child_agent_id, grant_expires_at into v_ca, v_exp_a
+    from agent_board.mint_delegated_child(v_r1, 'deleg-ca-'||s, jsonb_build_array('scope:a'), v_ca_pubkey);
+
+  -- Give child-a its own root_minted policy so the no-transitive (max_depth) guard is
+  -- exercised directly (parent_agent_id is not null), not merely the missing-policy path.
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes, child_ttl_ceiling)
+  values (gen_random_uuid(), v_ca, 'root_minted', jsonb_build_array('scope:a'), interval '8 hours');
+
+  -- ttl-cap child-b: request 30 days, must be capped at the 8h ceiling. Grant #2.
+  select child_agent_id into v_cb
+    from agent_board.mint_delegated_child(v_r1, 'deleg-cb-'||s, jsonb_build_array('scope:a'), v_cb_pubkey, interval '30 days');
+
+  insert into _deleg_fx values (u_owner, v_r1, v_r2, v_r3, v_ca, v_cb, v_exp_a, 'deleg-cc-'||s, v_ca_pubkey);
+end
+$$;
+
+-- Function existence.
+select has_function('agent_board', 'mint_delegated_child', array['uuid','text','jsonb','text','interval'], 'mint_delegated_child exists');
+select has_function('agent_board', 'renew_delegated_grant', array['uuid','interval'], 'renew_delegated_grant exists');
+
+-- Happy mint: grant row shape.
+select is(
+  (select count(*)::int from agent_board.delegation_grants g
+    where g.child_agent_id = (select child_a from _deleg_fx)
+      and g.root_agent_id = (select r1 from _deleg_fx)
+      and g.parent_agent_id = (select r1 from _deleg_fx)
+      and g.revoked_at is null),
+  1, 'happy mint inserted exactly one live grant (root=parent=R1) for child-a');
+
+-- Happy mint: child provisioned lineage-parented under the root, same owner, active.
+select is(
+  (select a.parent_agent_id = (select r1 from _deleg_fx)
+       and a.root_agent_id = (select r1 from _deleg_fx)
+       and a.owner_user_id = (select owner_id from _deleg_fx)
+       and a.status = 'active'
+     from agent_board.agents a where a.id = (select child_a from _deleg_fx)),
+  true, 'minted child is parented under the root, shares owner_user_id, and is active');
+
+-- Happy mint: revocable ephemeral signing key enrolled for the child.
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k
+    where k.agent_id = (select child_a from _deleg_fx)
+      and k.key_id = 'delegated-ephemeral'
+      and k.status = 'active' and k.revoked_at is null),
+  1, 'minted child got exactly one active revocable ephemeral signing key');
+
+-- #5: the enrolled key is the EXACT caller-supplied public key (no placeholder).
+select is(
+  (select public_key from agent_board.agent_signing_keys k
+    where k.agent_id = (select child_a from _deleg_fx) and k.key_id = 'delegated-ephemeral'),
+  (select ca_pubkey from _deleg_fx),
+  'minted child enrolls the caller-supplied Ed25519 public key verbatim (no placeholder/zero key)');
+
+-- #5: a malformed/short public key is rejected at the key-enrollment step (R3 has
+-- capacity + require_child_signing_key, so all prior gates pass).
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), %L)$q$,
+     r3, 'deleg-bad-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), repeat('A',20)) from _deleg_fx),
+  '22023', null, 'mint rejects a malformed/short child public key (#5)');
+
+-- Scope-exceed: scope:c is not a subset of allowed [a,b].
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:c'))$q$,
+     r1, 'deleg-cx-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _deleg_fx),
+  '42501', null, 'mint rejects a requested scope outside allowed_scopes (scope-exceed)');
+
+-- Scope-exceed minted nothing: no grant beyond the two live ones for R1.
+select is(
+  (select count(*)::int from agent_board.delegation_grants g
+    where g.root_agent_id = (select r1 from _deleg_fx) and g.revoked_at is null),
+  2, 'the two successful mints are the only live grants (scope-exceed created none)');
+
+-- ttl-cap: child-b grant_expires_at is capped at the 8h ceiling (not 30 days).
+select ok(
+  (select g.grant_expires_at <= now() + interval '8 hours' + interval '1 minute'
+     from agent_board.delegation_grants g where g.child_agent_id = (select child_b from _deleg_fx)),
+  'a 30-day TTL request is capped at the 8h child_ttl_ceiling (outlive-by-ttl blocked)');
+
+-- independent_auth: mode is not root_minted => reject.
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'))$q$,
+     r2, 'deleg-cy-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _deleg_fx),
+  '42501', null, 'mint rejects an independent_auth root (self-provisioning, not root-minted)');
+
+-- No-transitive (max_depth=1): a root_minted child (parent_agent_id not null) cannot mint.
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'))$q$,
+     child_a, 'deleg-gc-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _deleg_fx),
+  '42501', null, 'mint rejects a transitive attempt from a delegated child (max_depth=1)');
+
+-- Over-fan-out: R1 already has 2 live grants (max_active_children=2) => reject the 3rd.
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'))$q$,
+     r1, slug_c) from _deleg_fx),
+  '42501', null, 'mint rejects the (N+1)th child when max_active_children=N (over-fan-out)');
+
+-- Renew works while the root is active + unrevoked (child works for hours).
+select lives_ok(
+  (select format($q$select agent_board.renew_delegated_grant(%L::uuid)$q$, child_a) from _deleg_fx),
+  'renew_delegated_grant extends the grant while the root is active');
+select ok(
+  (select g.last_renewed_at is not null and g.grant_expires_at > now()
+     from agent_board.delegation_grants g where g.child_agent_id = (select child_a from _deleg_fx)),
+  'renew stamped last_renewed_at and pushed grant_expires_at into the future');
+
+-- Revoke the root's authority: suspend R1, then renew must raise (grant cannot outlive root).
+select lives_ok(
+  (select format($q$update agent_board.agents set status = 'suspended' where id = %L::uuid$q$, r1) from _deleg_fx),
+  'suspend the root R1');
+select throws_ok(
+  (select format($q$select agent_board.renew_delegated_grant(%L::uuid)$q$, child_a) from _deleg_fx),
+  '42501', null, 'renew raises once the root is inactive (grant cannot outlive root authority)');
+
+select finish();
+
+rollback;

package/tests/agent_board_delegation_policies.test.sql

@@ -0,0 +1,119 @@
+-- MBAUTHZ SL-4 (Lane D) pgTAP: delegation_policies, board_authority_ceilings,
+-- and the _grant_within_ceiling helper.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(16);
+
+create temp table _deleg_fixture (
+  board uuid,
+  owner_agent uuid,
+  member_agent uuid,
+  policy uuid,
+  owner_user uuid,
+  member_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_owner_user uuid;
+  v_member_user uuid;
+  v_owner uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_board uuid;
+  v_policy uuid := gen_random_uuid();
+begin
+  v_owner_user := public.ensure_github_user('dg-owner-' || v_suffix, 'dg-owner-' || v_suffix || '@example.test', 'dg-owner-' || v_suffix, 'DG Owner');
+  v_member_user := public.ensure_github_user('dg-member-' || v_suffix, 'dg-member-' || v_suffix || '@example.test', 'dg-member-' || v_suffix, 'DG Member');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_owner, 'agent', 'dg-owner-' || v_suffix, 'DG Owner', 'active', v_owner_user, v_owner_user),
+    (v_member, 'agent', 'dg-member-' || v_suffix, 'DG Member', 'active', v_member_user, v_member_user);
+
+  select board_id into v_board
+    from agent_board.create_board(v_owner, 'dg-board-' || v_suffix, 'DG Board', 'delegation test', '{}'::jsonb, 'private');
+
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_owner, 'joined', v_owner, 'owner'),
+    (v_board, v_member, 'joined', v_owner, 'member');
+
+  -- Policy with only root_agent_id set -> defaults apply (child_ttl_ceiling 8h).
+  insert into agent_board.delegation_policies(id, root_agent_id) values (v_policy, v_owner);
+
+  insert into _deleg_fixture values (v_board, v_owner, v_member, v_policy, v_owner_user, v_member_user);
+end
+$$;
+grant select on _deleg_fixture to authenticated;
+
+-- delegation_policies shape -------------------------------------------------
+select has_table('agent_board', 'delegation_policies', 'delegation_policies table exists');
+select has_column('agent_board', 'delegation_policies', 'mode', 'delegation_policies has mode');
+select has_column('agent_board', 'delegation_policies', 'child_ttl_ceiling', 'delegation_policies has child_ttl_ceiling');
+select is(
+  (select child_ttl_ceiling > interval '15 minutes' from agent_board.delegation_policies dp join _deleg_fixture f on dp.id = f.policy),
+  true, 'child_ttl_ceiling default is hours-scale (> 15 minutes, not the 900s session clock)');
+select is(
+  (select child_ttl_ceiling = interval '8 hours' from agent_board.delegation_policies dp join _deleg_fixture f on dp.id = f.policy),
+  true, 'child_ttl_ceiling default is 8 hours');
+
+-- board_authority_ceilings shape --------------------------------------------
+select has_table('agent_board', 'board_authority_ceilings', 'board_authority_ceilings table exists');
+select col_is_pk('agent_board', 'board_authority_ceilings', 'board_id', 'board_id is the primary key');
+select fk_ok('agent_board', 'board_authority_ceilings', 'board_id', 'agent_board', 'boards', 'id',
+  'board_id references boards(id)');
+
+-- _grant_within_ceiling: no ceiling row (defaults to owner) -----------------
+select is(
+  (select agent_board._grant_within_ceiling(owner_agent, board, 'admin') from _deleg_fixture),
+  true, 'no ceiling: owner may grant admin (within grantor role)');
+select is(
+  (select agent_board._grant_within_ceiling(owner_agent, board, 'owner') from _deleg_fixture),
+  true, 'no ceiling row is treated as owner: owner may grant owner (unchanged)');
+
+-- Exceeding grantor role is rejected regardless of ceiling ------------------
+select is(
+  (select agent_board._grant_within_ceiling(member_agent, board, 'admin') from _deleg_fixture),
+  false, 'grant exceeding grantor role is rejected (member cannot grant admin)');
+
+-- Over-ceiling grant is rejected --------------------------------------------
+insert into agent_board.board_authority_ceilings(board_id, max_grantable_role)
+select board, 'member' from _deleg_fixture;
+select is(
+  (select agent_board._grant_within_ceiling(owner_agent, board, 'admin') from _deleg_fixture),
+  false, 'over-ceiling grant is rejected (owner cannot grant admin when ceiling is member)');
+
+-- #13 owner-settable ceiling: set_board_authority_ceiling is owner-gated. ---------
+select has_function('agent_board', 'set_board_authority_ceiling', array['uuid','text'],
+  'set_board_authority_ceiling exists');
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- A non-owner (member) is denied.
+select set_config('request.jwt.claim.sub', (select member_user from _deleg_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.set_board_authority_ceiling(%L::uuid, 'admin')$q$, board) from _deleg_fixture),
+  '42501', null, 'a non-owner is denied set_board_authority_ceiling');
+
+-- The board owner may set it (changing the pre-existing 'member' ceiling to 'admin').
+select set_config('request.jwt.claim.sub', (select owner_user from _deleg_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.set_board_authority_ceiling(%L::uuid, 'admin')$q$, board) from _deleg_fixture),
+  'the board owner can set the authority ceiling');
+
+reset role;
+
+-- Verify the stored ceiling as the table owner (the SELECT RLS policy helper
+-- _current_agent_has_board_access is not executable by the authenticated role).
+select is(
+  (select max_grantable_role from agent_board.board_authority_ceilings c where c.board_id = (select board from _deleg_fixture)),
+  'admin', 'the owner-set ceiling was upserted to admin');
+
+select finish();
+
+rollback;

package/tests/agent_board_enroll_federated_identity.test.sql

@@ -0,0 +1,217 @@
+-- MBPORTALGATE SL-2 pgTAP: the reworked enroll_federated_identity principal model.
+--
+-- Proves: the 13-arg signature; one enroll MINTS a human owner + a SEPARATE
+-- key-identified agent (own auth_user_id) + an active+proven signing key + one audit
+-- row; ONE human (issuer, sub) enrolling a 2nd distinct key creates a SECOND agent
+-- (first unmutated) sharing ONE owner_user_id but with a DISTINCT auth_user_id
+-- (independently session-mintable); revoking one agent leaves neither the human owner
+-- nor a sibling revoked; and the provider/scope/kind rejection matrix still raises.
+-- The PoP-binding suite (fingerprint recompute/tamper/dedup, PoP gate, actor_sub) lives
+-- in agent_board_enroll_pop_binding.test.sql. Runs as postgres (service_role-equiv).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(28);
+
+-- New 13-arg signature exists (the old 8-arg was dropped by 20260719001100). --------
+select has_function(
+  'agent_board', 'enroll_federated_identity',
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]'],
+  'enroll_federated_identity exists with the reworked 13-arg PoP signature');
+select hasnt_function(
+  'agent_board', 'enroll_federated_identity',
+  array['text','text','text','jsonb','text','text','text[]','text[]'],
+  'the prior 8-arg enroll_federated_identity was dropped');
+
+-- Fixtures: an APPROVED provider + two real Ed25519 keys with round-trip fingerprints.
+create temp table _p (
+  iss text, aud text, sub text, slug text, claim jsonb,
+  pub1 text, fp1 text, pub2 text, fp2 text
+) on commit drop;
+create temp table _r (
+  label text, agent_id uuid, auth_user_id uuid, provider_id text,
+  signing_key_id uuid, granted text[], owner_user_id uuid
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_agent_id uuid; v_auth uuid; v_prov text; v_key uuid; v_granted text[];
+begin
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values
+    ('https://fed-ok-'||s||'.test', 'message-board', true, true, '{board:send}', '{board:x}', '{agent,human}');
+
+  insert into _p values (
+    'https://fed-ok-'||s||'.test', 'message-board', 'portal|'||s, 'fed-agent-'||s,
+    jsonb_build_object('sub', 'portal|'||s, 'act', jsonb_build_object('sub', 'act|'||s), 'name', 'Fed '||s),
+    'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
+    'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA'
+  );
+
+  -- Enroll A (key 1).
+  select e.agent_id, e.auth_user_id, e.provider_id, e.signing_key_id, e.granted_scopes
+    into v_agent_id, v_auth, v_prov, v_key, v_granted
+    from _p p, agent_board.enroll_federated_identity(
+      p.iss, p.aud, p.sub, p.claim, p.slug, p.pub1, 'raw_ed25519_base64url', p.fp1,
+      true, 'act|'||s, 'agent', '{board:send}', '{board:x}') e;
+  insert into _r
+    select 'A', v_agent_id, v_auth, v_prov, v_key, v_granted, a.owner_user_id
+      from agent_board.agents a where a.id = v_agent_id;
+
+  -- Enroll B: SAME human (issuer, sub) + SAME slug, DIFFERENT key -> a 2nd agent.
+  select e.agent_id, e.auth_user_id, e.provider_id, e.signing_key_id, e.granted_scopes
+    into v_agent_id, v_auth, v_prov, v_key, v_granted
+    from _p p, agent_board.enroll_federated_identity(
+      p.iss, p.aud, p.sub, p.claim, p.slug, p.pub2, 'raw_ed25519_base64url', p.fp2,
+      true, 'act|'||s, 'agent', '{board:send}', '{board:x}') e;
+  insert into _r
+    select 'B', v_agent_id, v_auth, v_prov, v_key, v_granted, a.owner_user_id
+      from agent_board.agents a where a.id = v_agent_id;
+end
+$$;
+
+-- One enroll mints a distinct agent + human owner + own principal --------------------
+select is((select count(*)::int from _r where label='A'), 1, 'enroll A returned exactly one row');
+select is(
+  (select a.status from agent_board.agents a join _r r on r.agent_id=a.id where r.label='A'),
+  'active', 'agent A is active');
+select isnt(
+  (select owner_user_id from _r where label='A'),
+  (select auth_user_id from _r where label='A'),
+  'agent A owner_user_id (human) is DISTINCT from its own auth_user_id (agent principal)');
+select is(
+  (select count(*)::int from auth.users u where u.id = (select owner_user_id from _r where label='A')),
+  1, 'the human owner auth.users row exists');
+select is(
+  (select count(*)::int from auth.users u where u.id = (select auth_user_id from _r where label='A')),
+  1, 'the agent principal auth.users row exists (session-usable via its key)');
+
+-- The enrolled key is active + proven and round-trips the fingerprint ---------------
+select is(
+  (select k.status||'/'||k.proof_state from agent_board.agent_signing_keys k
+    where k.id = (select signing_key_id from _r where label='A')),
+  'active/proven', 'agent A signing key is active + proven (satisfies active_requires_proof)');
+select is(
+  (select k.fingerprint from agent_board.agent_signing_keys k
+    where k.id = (select signing_key_id from _r where label='A')),
+  'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+  'the DB-recomputed fingerprint round-trips the independently-computed client fingerprint');
+select is(
+  (select k.agent_id from agent_board.agent_signing_keys k
+    where k.id = (select signing_key_id from _r where label='A')),
+  (select agent_id from _r where label='A'),
+  'the returned signing_key_id belongs to the returned agent');
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e where e.agent_id = (select agent_id from _r where label='A')),
+  1, 'enroll A wrote exactly one enrollment_federation_audit row');
+
+-- One human -> N agents: the 2nd enroll creates a 2nd agent, first unmutated ---------
+select isnt(
+  (select agent_id from _r where label='B'),
+  (select agent_id from _r where label='A'),
+  'enroll B created a SECOND, distinct agent (never keyed on sub)');
+select is(
+  (select owner_user_id from _r where label='B'),
+  (select owner_user_id from _r where label='A'),
+  'both agents of the same human share ONE owner_user_id (idempotent human owner)');
+select isnt(
+  (select auth_user_id from _r where label='B'),
+  (select auth_user_id from _r where label='A'),
+  'each agent has a DISTINCT auth_user_id (each independently session-mintable)');
+select is(
+  (select count(distinct a.id)::int from agent_board.agents a
+    where a.owner_user_id = (select owner_user_id from _r where label='A')),
+  2, 'the human owner now has exactly two agents');
+select is(
+  (select a.status from agent_board.agents a where a.id = (select agent_id from _r where label='A')),
+  'active', 'the FIRST agent is unmutated (still active) after the 2nd enroll');
+select is(
+  (select k.fingerprint from agent_board.agent_signing_keys k where k.agent_id = (select agent_id from _r where label='A')),
+  'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+  'the first agent still holds ONLY its original key (not mutated to the 2nd key)');
+select isnt(
+  (select a.handle from agent_board.agents a where a.id = (select agent_id from _r where label='B')),
+  (select a.handle from agent_board.agents a where a.id = (select agent_id from _r where label='A')),
+  'the 2nd agent under the same slug got a distinct (disambiguated) handle');
+
+-- Revoke isolation: revoking agent A leaves neither the human nor sibling B revoked --
+do $$
+begin
+  update agent_board.agents set status='revoked', updated_at=now()
+    where id = (select agent_id from _r where label='A');
+  update agent_board.agent_signing_keys set status='revoked', revoked_at=now()
+    where agent_id = (select agent_id from _r where label='A');
+end
+$$;
+select is(
+  (select a.status from agent_board.agents a where a.id = (select agent_id from _r where label='B')),
+  'active', 'revoking agent A leaves sibling agent B active (independent principals)');
+select is(
+  (select k.status from agent_board.agent_signing_keys k where k.agent_id = (select agent_id from _r where label='B')),
+  'active', 'sibling B''s signing key stays active (B remains session-mintable)');
+select is(
+  (select count(*)::int from auth.users u where u.id = (select owner_user_id from _r where label='A')),
+  1, 'revoking agent A does NOT revoke the shared human owner');
+
+-- Provider / scope / kind rejection matrix still raises ------------------------------
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity('https://nope.test',%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     aud, sub, claim::text, 'x-'||slug, pub1, fp1) from _p),
+  '42501', null, 'unknown (issuer,audience) is rejected');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,NULL,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, claim::text, 'y-'||slug, pub1, fp1) from _p),
+  '22023', null, 'a null verified subject is rejected');
+-- requested scope outside the provider allowed_scopes ceiling
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:admin}','{}')$q$,
+     iss, aud, sub, claim::text, 'z-'||slug, pub1, fp1) from _p),
+  '42501', null, 'a requested scope outside allowed_scopes is rejected');
+-- the 'system' kind is never federatable
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'system','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'w-'||slug, pub1, fp1) from _p),
+  '42501', null, 'the system kind cannot be federated');
+
+-- B1: the RPC RETURNS the server-assigned key_id/key_version/agent_handle so the client
+-- mints /session against the AUTHORITATIVE identity (the missing binding that otherwise
+-- left every enrolled agent unable to authenticate). /session resolves by exactly
+-- (agents.handle, key_id, key_version), so all three must be the server's values.
+create temp table _b1 (agent uuid, key_id text, key_version int, handle text) on commit drop;
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text,1,8),'-','');
+  v_pub text := rtrim(translate(encode(extensions.digest(convert_to('b1-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp text := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  v_kid text; v_kver int; v_handle text; v_agent uuid;
+begin
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://fed-b1-'||s||'.test','message-board',true,true,'{board:send}','{}','{agent}');
+  select e.agent_id, e.key_id, e.key_version, e.agent_handle
+    into v_agent, v_kid, v_kver, v_handle
+    from agent_board.enroll_federated_identity(
+      'https://fed-b1-'||s||'.test','message-board','portal|'||s,
+      jsonb_build_object('sub','portal|'||s), 'b1-'||s, v_pub,'raw_ed25519_base64url', v_fp,
+      true, null, 'agent', '{board:send}', '{}') e;
+  insert into _b1 values (v_agent, v_kid, v_kver, v_handle);
+end $$;
+select is(
+  (select key_id from _b1),
+  (select k.key_id from agent_board.agent_signing_keys k where k.agent_id = (select agent from _b1)),
+  'the returned key_id equals the enrolled signing key''s key_id (session-resolvable)');
+select is((select key_version from _b1), 1, 'the returned key_version is the enrolled key_version (1)');
+select is(
+  (select handle from _b1),
+  (select a.handle from agent_board.agents a where a.id = (select agent from _b1)),
+  'the returned agent_handle equals agents.handle (the /session resolver key)');
+
+select finish();
+
+rollback;