@consiliency/agent-board-schema 1.3.0 → 1.5.0

package/tests/agent_board_delegation_policies.test.sql

@@ -0,0 +1,120 @@
+-- MBAUTHZ SL-4 (Lane D) pgTAP: delegation_policies, board_authority_ceilings,
+-- and the _grant_within_ceiling helper.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(16);
+
+create temp table _deleg_fixture (
+  board uuid,
+  owner_agent uuid,
+  member_agent uuid,
+  policy uuid,
+  owner_user uuid,
+  member_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_owner_user uuid;
+  v_member_user uuid;
+  v_owner uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_board uuid;
+  v_policy uuid := gen_random_uuid();
+begin
+  v_owner_user := public.ensure_github_user('dg-owner-' || v_suffix, 'dg-owner-' || v_suffix || '@example.test', 'dg-owner-' || v_suffix, 'DG Owner');
+  v_member_user := public.ensure_github_user('dg-member-' || v_suffix, 'dg-member-' || v_suffix || '@example.test', 'dg-member-' || v_suffix, 'DG Member');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_owner, 'agent', 'dg-owner-' || v_suffix, 'DG Owner', 'active', v_owner_user, v_owner_user),
+    (v_member, 'agent', 'dg-member-' || v_suffix, 'DG Member', 'active', v_member_user, v_member_user);
+
+  select board_id into v_board
+    from agent_board.create_board(v_owner, 'dg-board-' || v_suffix, 'DG Board', 'delegation test', '{}'::jsonb, 'private');
+
+  -- The owner's owner membership is now seeded by create_board (ROOMOWN); only the
+  -- member membership needs an explicit insert.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_member, 'joined', v_owner, 'member');
+
+  -- Policy with only root_agent_id set -> defaults apply (child_ttl_ceiling 8h).
+  insert into agent_board.delegation_policies(id, root_agent_id) values (v_policy, v_owner);
+
+  insert into _deleg_fixture values (v_board, v_owner, v_member, v_policy, v_owner_user, v_member_user);
+end
+$$;
+grant select on _deleg_fixture to authenticated;
+
+-- delegation_policies shape -------------------------------------------------
+select has_table('agent_board', 'delegation_policies', 'delegation_policies table exists');
+select has_column('agent_board', 'delegation_policies', 'mode', 'delegation_policies has mode');
+select has_column('agent_board', 'delegation_policies', 'child_ttl_ceiling', 'delegation_policies has child_ttl_ceiling');
+select is(
+  (select child_ttl_ceiling > interval '15 minutes' from agent_board.delegation_policies dp join _deleg_fixture f on dp.id = f.policy),
+  true, 'child_ttl_ceiling default is hours-scale (> 15 minutes, not the 900s session clock)');
+select is(
+  (select child_ttl_ceiling = interval '8 hours' from agent_board.delegation_policies dp join _deleg_fixture f on dp.id = f.policy),
+  true, 'child_ttl_ceiling default is 8 hours');
+
+-- board_authority_ceilings shape --------------------------------------------
+select has_table('agent_board', 'board_authority_ceilings', 'board_authority_ceilings table exists');
+select col_is_pk('agent_board', 'board_authority_ceilings', 'board_id', 'board_id is the primary key');
+select fk_ok('agent_board', 'board_authority_ceilings', 'board_id', 'agent_board', 'boards', 'id',
+  'board_id references boards(id)');
+
+-- _grant_within_ceiling: no ceiling row (defaults to owner) -----------------
+select is(
+  (select agent_board._grant_within_ceiling(owner_agent, board, 'admin') from _deleg_fixture),
+  true, 'no ceiling: owner may grant admin (within grantor role)');
+select is(
+  (select agent_board._grant_within_ceiling(owner_agent, board, 'owner') from _deleg_fixture),
+  true, 'no ceiling row is treated as owner: owner may grant owner (unchanged)');
+
+-- Exceeding grantor role is rejected regardless of ceiling ------------------
+select is(
+  (select agent_board._grant_within_ceiling(member_agent, board, 'admin') from _deleg_fixture),
+  false, 'grant exceeding grantor role is rejected (member cannot grant admin)');
+
+-- Over-ceiling grant is rejected --------------------------------------------
+insert into agent_board.board_authority_ceilings(board_id, max_grantable_role)
+select board, 'member' from _deleg_fixture;
+select is(
+  (select agent_board._grant_within_ceiling(owner_agent, board, 'admin') from _deleg_fixture),
+  false, 'over-ceiling grant is rejected (owner cannot grant admin when ceiling is member)');
+
+-- #13 owner-settable ceiling: set_board_authority_ceiling is owner-gated. ---------
+select has_function('agent_board', 'set_board_authority_ceiling', array['uuid','text'],
+  'set_board_authority_ceiling exists');
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- A non-owner (member) is denied.
+select set_config('request.jwt.claim.sub', (select member_user from _deleg_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.set_board_authority_ceiling(%L::uuid, 'admin')$q$, board) from _deleg_fixture),
+  '42501', null, 'a non-owner is denied set_board_authority_ceiling');
+
+-- The board owner may set it (changing the pre-existing 'member' ceiling to 'admin').
+select set_config('request.jwt.claim.sub', (select owner_user from _deleg_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.set_board_authority_ceiling(%L::uuid, 'admin')$q$, board) from _deleg_fixture),
+  'the board owner can set the authority ceiling');
+
+reset role;
+
+-- Verify the stored ceiling as the table owner (the SELECT RLS policy helper
+-- _current_agent_has_board_access is not executable by the authenticated role).
+select is(
+  (select max_grantable_role from agent_board.board_authority_ceilings c where c.board_id = (select board from _deleg_fixture)),
+  'admin', 'the owner-set ceiling was upserted to admin');
+
+select finish();
+
+rollback;

package/tests/agent_board_enroll_federated_identity.test.sql

@@ -0,0 +1,217 @@
+-- MBPORTALGATE SL-2 pgTAP: the reworked enroll_federated_identity principal model.
+--
+-- Proves: the 13-arg signature; one enroll MINTS a human owner + a SEPARATE
+-- key-identified agent (own auth_user_id) + an active+proven signing key + one audit
+-- row; ONE human (issuer, sub) enrolling a 2nd distinct key creates a SECOND agent
+-- (first unmutated) sharing ONE owner_user_id but with a DISTINCT auth_user_id
+-- (independently session-mintable); revoking one agent leaves neither the human owner
+-- nor a sibling revoked; and the provider/scope/kind rejection matrix still raises.
+-- The PoP-binding suite (fingerprint recompute/tamper/dedup, PoP gate, actor_sub) lives
+-- in agent_board_enroll_pop_binding.test.sql. Runs as postgres (service_role-equiv).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(28);
+
+-- New 13-arg signature exists (the old 8-arg was dropped by 20260719001100). --------
+select has_function(
+  'agent_board', 'enroll_federated_identity',
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]'],
+  'enroll_federated_identity exists with the reworked 13-arg PoP signature');
+select hasnt_function(
+  'agent_board', 'enroll_federated_identity',
+  array['text','text','text','jsonb','text','text','text[]','text[]'],
+  'the prior 8-arg enroll_federated_identity was dropped');
+
+-- Fixtures: an APPROVED provider + two real Ed25519 keys with round-trip fingerprints.
+create temp table _p (
+  iss text, aud text, sub text, slug text, claim jsonb,
+  pub1 text, fp1 text, pub2 text, fp2 text
+) on commit drop;
+create temp table _r (
+  label text, agent_id uuid, auth_user_id uuid, provider_id text,
+  signing_key_id uuid, granted text[], owner_user_id uuid
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_agent_id uuid; v_auth uuid; v_prov text; v_key uuid; v_granted text[];
+begin
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values
+    ('https://fed-ok-'||s||'.test', 'message-board', true, true, '{board:send}', '{board:x}', '{agent,human}');
+
+  insert into _p values (
+    'https://fed-ok-'||s||'.test', 'message-board', 'portal|'||s, 'fed-agent-'||s,
+    jsonb_build_object('sub', 'portal|'||s, 'act', jsonb_build_object('sub', 'act|'||s), 'name', 'Fed '||s),
+    'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
+    'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA'
+  );
+
+  -- Enroll A (key 1).
+  select e.agent_id, e.auth_user_id, e.provider_id, e.signing_key_id, e.granted_scopes
+    into v_agent_id, v_auth, v_prov, v_key, v_granted
+    from _p p, agent_board.enroll_federated_identity(
+      p.iss, p.aud, p.sub, p.claim, p.slug, p.pub1, 'raw_ed25519_base64url', p.fp1,
+      true, 'act|'||s, 'agent', '{board:send}', '{board:x}') e;
+  insert into _r
+    select 'A', v_agent_id, v_auth, v_prov, v_key, v_granted, a.owner_user_id
+      from agent_board.agents a where a.id = v_agent_id;
+
+  -- Enroll B: SAME human (issuer, sub) + SAME slug, DIFFERENT key -> a 2nd agent.
+  select e.agent_id, e.auth_user_id, e.provider_id, e.signing_key_id, e.granted_scopes
+    into v_agent_id, v_auth, v_prov, v_key, v_granted
+    from _p p, agent_board.enroll_federated_identity(
+      p.iss, p.aud, p.sub, p.claim, p.slug, p.pub2, 'raw_ed25519_base64url', p.fp2,
+      true, 'act|'||s, 'agent', '{board:send}', '{board:x}') e;
+  insert into _r
+    select 'B', v_agent_id, v_auth, v_prov, v_key, v_granted, a.owner_user_id
+      from agent_board.agents a where a.id = v_agent_id;
+end
+$$;
+
+-- One enroll mints a distinct agent + human owner + own principal --------------------
+select is((select count(*)::int from _r where label='A'), 1, 'enroll A returned exactly one row');
+select is(
+  (select a.status from agent_board.agents a join _r r on r.agent_id=a.id where r.label='A'),
+  'active', 'agent A is active');
+select isnt(
+  (select owner_user_id from _r where label='A'),
+  (select auth_user_id from _r where label='A'),
+  'agent A owner_user_id (human) is DISTINCT from its own auth_user_id (agent principal)');
+select is(
+  (select count(*)::int from auth.users u where u.id = (select owner_user_id from _r where label='A')),
+  1, 'the human owner auth.users row exists');
+select is(
+  (select count(*)::int from auth.users u where u.id = (select auth_user_id from _r where label='A')),
+  1, 'the agent principal auth.users row exists (session-usable via its key)');
+
+-- The enrolled key is active + proven and round-trips the fingerprint ---------------
+select is(
+  (select k.status||'/'||k.proof_state from agent_board.agent_signing_keys k
+    where k.id = (select signing_key_id from _r where label='A')),
+  'active/proven', 'agent A signing key is active + proven (satisfies active_requires_proof)');
+select is(
+  (select k.fingerprint from agent_board.agent_signing_keys k
+    where k.id = (select signing_key_id from _r where label='A')),
+  'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+  'the DB-recomputed fingerprint round-trips the independently-computed client fingerprint');
+select is(
+  (select k.agent_id from agent_board.agent_signing_keys k
+    where k.id = (select signing_key_id from _r where label='A')),
+  (select agent_id from _r where label='A'),
+  'the returned signing_key_id belongs to the returned agent');
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e where e.agent_id = (select agent_id from _r where label='A')),
+  1, 'enroll A wrote exactly one enrollment_federation_audit row');
+
+-- One human -> N agents: the 2nd enroll creates a 2nd agent, first unmutated ---------
+select isnt(
+  (select agent_id from _r where label='B'),
+  (select agent_id from _r where label='A'),
+  'enroll B created a SECOND, distinct agent (never keyed on sub)');
+select is(
+  (select owner_user_id from _r where label='B'),
+  (select owner_user_id from _r where label='A'),
+  'both agents of the same human share ONE owner_user_id (idempotent human owner)');
+select isnt(
+  (select auth_user_id from _r where label='B'),
+  (select auth_user_id from _r where label='A'),
+  'each agent has a DISTINCT auth_user_id (each independently session-mintable)');
+select is(
+  (select count(distinct a.id)::int from agent_board.agents a
+    where a.owner_user_id = (select owner_user_id from _r where label='A')),
+  2, 'the human owner now has exactly two agents');
+select is(
+  (select a.status from agent_board.agents a where a.id = (select agent_id from _r where label='A')),
+  'active', 'the FIRST agent is unmutated (still active) after the 2nd enroll');
+select is(
+  (select k.fingerprint from agent_board.agent_signing_keys k where k.agent_id = (select agent_id from _r where label='A')),
+  'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+  'the first agent still holds ONLY its original key (not mutated to the 2nd key)');
+select isnt(
+  (select a.handle from agent_board.agents a where a.id = (select agent_id from _r where label='B')),
+  (select a.handle from agent_board.agents a where a.id = (select agent_id from _r where label='A')),
+  'the 2nd agent under the same slug got a distinct (disambiguated) handle');
+
+-- Revoke isolation: revoking agent A leaves neither the human nor sibling B revoked --
+do $$
+begin
+  update agent_board.agents set status='revoked', updated_at=now()
+    where id = (select agent_id from _r where label='A');
+  update agent_board.agent_signing_keys set status='revoked', revoked_at=now()
+    where agent_id = (select agent_id from _r where label='A');
+end
+$$;
+select is(
+  (select a.status from agent_board.agents a where a.id = (select agent_id from _r where label='B')),
+  'active', 'revoking agent A leaves sibling agent B active (independent principals)');
+select is(
+  (select k.status from agent_board.agent_signing_keys k where k.agent_id = (select agent_id from _r where label='B')),
+  'active', 'sibling B''s signing key stays active (B remains session-mintable)');
+select is(
+  (select count(*)::int from auth.users u where u.id = (select owner_user_id from _r where label='A')),
+  1, 'revoking agent A does NOT revoke the shared human owner');
+
+-- Provider / scope / kind rejection matrix still raises ------------------------------
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity('https://nope.test',%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     aud, sub, claim::text, 'x-'||slug, pub1, fp1) from _p),
+  '42501', null, 'unknown (issuer,audience) is rejected');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,NULL,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, claim::text, 'y-'||slug, pub1, fp1) from _p),
+  '22023', null, 'a null verified subject is rejected');
+-- requested scope outside the provider allowed_scopes ceiling
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:admin}','{}')$q$,
+     iss, aud, sub, claim::text, 'z-'||slug, pub1, fp1) from _p),
+  '42501', null, 'a requested scope outside allowed_scopes is rejected');
+-- the 'system' kind is never federatable
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'system','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'w-'||slug, pub1, fp1) from _p),
+  '42501', null, 'the system kind cannot be federated');
+
+-- B1: the RPC RETURNS the server-assigned key_id/key_version/agent_handle so the client
+-- mints /session against the AUTHORITATIVE identity (the missing binding that otherwise
+-- left every enrolled agent unable to authenticate). /session resolves by exactly
+-- (agents.handle, key_id, key_version), so all three must be the server's values.
+create temp table _b1 (agent uuid, key_id text, key_version int, handle text) on commit drop;
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text,1,8),'-','');
+  v_pub text := rtrim(translate(encode(extensions.digest(convert_to('b1-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp text := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  v_kid text; v_kver int; v_handle text; v_agent uuid;
+begin
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://fed-b1-'||s||'.test','message-board',true,true,'{board:send}','{}','{agent}');
+  select e.agent_id, e.key_id, e.key_version, e.agent_handle
+    into v_agent, v_kid, v_kver, v_handle
+    from agent_board.enroll_federated_identity(
+      'https://fed-b1-'||s||'.test','message-board','portal|'||s,
+      jsonb_build_object('sub','portal|'||s), 'b1-'||s, v_pub,'raw_ed25519_base64url', v_fp,
+      true, null, 'agent', '{board:send}', '{}') e;
+  insert into _b1 values (v_agent, v_kid, v_kver, v_handle);
+end $$;
+select is(
+  (select key_id from _b1),
+  (select k.key_id from agent_board.agent_signing_keys k where k.agent_id = (select agent from _b1)),
+  'the returned key_id equals the enrolled signing key''s key_id (session-resolvable)');
+select is((select key_version from _b1), 1, 'the returned key_version is the enrolled key_version (1)');
+select is(
+  (select handle from _b1),
+  (select a.handle from agent_board.agents a where a.id = (select agent from _b1)),
+  'the returned agent_handle equals agents.handle (the /session resolver key)');
+
+select finish();
+
+rollback;

package/tests/agent_board_enroll_pop_binding.test.sql

@@ -0,0 +1,131 @@
+-- MBPORTALGATE SL-2 pgTAP: the PoP-binding suite for enroll_federated_identity.
+--
+-- Proves the proof-of-possession + fingerprint contract the /enroll EF depends on:
+--   * the DB-recomputed sha256:base64url fingerprint is BYTE-IDENTICAL to the value an
+--     independent client (WebCrypto) computes over the same base64url key STRING
+--     (client<->DB round-trip);
+--   * p_pop_verified must be true (false / null -> raise, no writes);
+--   * the RPC recomputes-and-asserts the fingerprint (a tampered fingerprint -> raise);
+--   * a duplicate fingerprint (a key already enrolled) -> raise, dedup on the UNIQUE index;
+--   * malformed / placeholder / wrong-format keys -> raise;
+--   * p_actor_sub is audit-only: present-non-empty succeeds + is captured; empty -> raise.
+-- Runs as postgres (service_role-equivalent for _is_service_role()).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(18);
+
+-- Client<->DB fingerprint round-trip (B2 raw-byte scheme): the DB derivation over the
+-- DECODED 32 key bytes must equal the constant an independent tool (Node crypto,
+-- matching WebCrypto + the client child_keygen keyRef) computed over the same raw bytes.
+select is(
+  'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate('eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0','-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'='),
+  'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+  'the DB raw-byte fingerprint derivation round-trips the independently-computed client value (key 1)');
+select is(
+  'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate('yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk','-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'='),
+  'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+  'the DB raw-byte fingerprint derivation round-trips the independently-computed client value (key 2)');
+
+create temp table _p (
+  iss text, aud text, sub text, claim jsonb,
+  pub1 text, fp1 text, pub2 text, fp2 text
+) on commit drop;
+do $$
+declare s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+begin
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://fed-pop-'||s||'.test', 'message-board', true, true, '{board:send}', '{}', '{agent,human}');
+  insert into _p values (
+    'https://fed-pop-'||s||'.test', 'message-board', 'portal|'||s,
+    jsonb_build_object('sub','portal|'||s,'act',jsonb_build_object('sub','act|'||s)),
+    'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk', 'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA');
+end
+$$;
+
+-- Happy path with a present, non-empty actor_sub -> succeeds and is audited (key 1).
+select lives_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,%L,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-ok', pub1, fp1, 'act|present') from _p),
+  'enroll with a present non-empty actor_sub and verified PoP succeeds');
+select is(
+  (select e.human_identity_claim->'act'->>'sub' from agent_board.enrollment_federation_audit e
+     join agent_board.agents a on a.id=e.agent_id where a.handle='pop-ok'),
+  (select claim->'act'->>'sub' from _p),
+  'the act.sub is captured (audit-only) in the enrollment claim snapshot');
+
+-- Duplicate fingerprint: re-enrolling key 1 raises (dedup on the UNIQUE index).
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-dup', pub1, fp1) from _p),
+  '23505', null, 'a duplicate fingerprint (key already enrolled) is rejected');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k where k.fingerprint = (select fp1 from _p)),
+  1, 'the duplicate attempt did not enroll a second key with the same fingerprint');
+
+-- B2: a NON-CANONICAL base64url encoding of an already-enrolled key (same 32 raw bytes,
+-- 2 don't-care low bits flipped) is rejected as non-canonical (22023) BEFORE the dedup
+-- check — so one private key can NEVER back multiple agents (the 4-strings-one-key
+-- aliasing attack that broke revocation isolation).
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-alias1', 'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f1', fp1) from _p),
+  '22023', null, 'a non-canonical base64url alias of an enrolled key is rejected (aliasing attack blocked)');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-alias2', 'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f2', fp1) from _p),
+  '22023', null, 'a second non-canonical alias of the same key is also rejected');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k where k.fingerprint = (select fp1 from _p)),
+  1, 'the aliasing attempts enrolled NO extra key/agent (one private key -> exactly one agent)');
+
+-- PoP gate: p_pop_verified false / null -> raise, and NO agent is written.
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,false,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-false', pub2, fp2) from _p),
+  '42501', null, 'p_pop_verified=false is refused');
+select is(
+  (select count(*)::int from agent_board.agents a where a.handle = 'pop-false'),
+  0, 'a refused (pop=false) enrollment wrote no agent (no partial write)');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,NULL,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-null', pub2, fp2) from _p),
+  '42501', null, 'p_pop_verified=null is refused');
+
+-- Fingerprint tamper: supplied fingerprint != in-DB recompute -> raise, no write.
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-tamper', pub2, 'sha256:'||repeat('B',43)) from _p),
+  '22023', null, 'a tampered fingerprint (!= in-DB derive of the key) is rejected');
+select is(
+  (select count(*)::int from agent_board.agents a where a.handle = 'pop-tamper'),
+  0, 'a tampered-fingerprint enrollment wrote no agent');
+
+-- Malformed / placeholder / wrong-format keys -> raise.
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,'not-a-valid-43char-key','raw_ed25519_base64url','sha256:'||%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-malformed', repeat('C',43)) from _p),
+  '22023', null, 'a malformed (non-43-base64url) public key is rejected');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-zero', repeat('A',43),
+     'sha256:'||rtrim(translate(encode(extensions.digest(convert_to(repeat('A',43),'UTF8'),'sha256'),'base64'),'+/','-_'),'=')) from _p),
+  '22023', null, 'the all-zero small-order placeholder key is rejected');
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'spki_pem',%L,true,null,'agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-fmt', pub2, fp2) from _p),
+  '22023', null, 'a non-raw_ed25519_base64url public_key_format is rejected');
+
+-- actor_sub present-but-empty -> raise (present means a real delegated actor).
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,'','agent','{board:send}','{}')$q$,
+     iss, aud, sub, claim::text, 'pop-emptyact', pub2, fp2) from _p),
+  '22023', null, 'a present-but-empty actor_sub is rejected');
+
+select finish();
+
+rollback;

package/tests/agent_board_enroll_rate_cap.test.sql

@@ -0,0 +1,53 @@
+-- MBHARDEN SL-1 pgTAP: check_and_bump_enroll_rate allows <=limit calls per source
+-- per rolling window and rejects past the limit; sources are independent; the
+-- reject path records nothing; and execute is revoked from anon/authenticated.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(10);
+
+select has_function(
+  'agent_board', 'check_and_bump_enroll_rate', array['text', 'integer', 'interval'],
+  'check_and_bump_enroll_rate(text, integer, interval) exists');
+select has_table(
+  'agent_board', 'enroll_rate_events', 'enroll_rate_events counter table exists');
+
+-- Source A: limit 3 in a 1-minute window. First three allowed, fourth rejected.
+select is(
+  agent_board.check_and_bump_enroll_rate('src-a', 3, interval '1 minute'),
+  true, '1st call for src-a is allowed');
+select is(
+  agent_board.check_and_bump_enroll_rate('src-a', 3, interval '1 minute'),
+  true, '2nd call for src-a is allowed');
+select is(
+  agent_board.check_and_bump_enroll_rate('src-a', 3, interval '1 minute'),
+  true, '3rd call for src-a is allowed (at the limit)');
+select is(
+  agent_board.check_and_bump_enroll_rate('src-a', 3, interval '1 minute'),
+  false, '4th call for src-a is rejected (over the cap)');
+
+-- A different source is bounded independently.
+select is(
+  agent_board.check_and_bump_enroll_rate('src-b', 3, interval '1 minute'),
+  true, 'a different source is counted independently');
+
+-- The reject path records nothing: src-a still has exactly its 3 allowed events.
+select is(
+  (select count(*)::int from agent_board.enroll_rate_events where source = 'src-a'),
+  3, 'the over-cap reject recorded no event (only the 3 allowed remain)');
+
+-- Privilege: execute revoked from anon and authenticated.
+select function_privs_are(
+  'agent_board', 'check_and_bump_enroll_rate', array['text', 'integer', 'interval'],
+  'anon', array[]::text[],
+  'check_and_bump_enroll_rate execute is revoked from anon');
+select function_privs_are(
+  'agent_board', 'check_and_bump_enroll_rate', array['text', 'integer', 'interval'],
+  'authenticated', array[]::text[],
+  'check_and_bump_enroll_rate execute is revoked from authenticated');
+
+select finish();
+
+rollback;