@consiliency/agent-board-schema 1.3.0 → 1.5.0

package/tests/agent_board_enrollment_audit_content.test.sql

@@ -0,0 +1,139 @@
+-- MBFED SL-2 pgTAP (Lane B): enrollment-audit content + no-write-path-read invariant.
+--
+-- Proves enroll_federated_identity writes exactly ONE enrollment_federation_audit row
+-- whose human_identity_claim equals the supplied snapshot verbatim, that the audit
+-- table carries NO Portal session/MFA/availability/liveness column (it is a static
+-- enrollment-time claim snapshot), and that NO write-path RPC reads that table — the
+-- audit is never consulted as a live trust signal. Runs as postgres.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(11);
+
+create temp table _acfx (agent uuid, claim jsonb) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_agent uuid;
+  v_claim jsonb := jsonb_build_object('sub','portal|'||s,'name','Fed '||s,'groups',jsonb_build_array('eng','fed'));
+  -- A valid unique 43-char base64url key + its matching (RPC-recomputed) fingerprint.
+  v_pub text := rtrim(translate(encode(extensions.digest(convert_to('k-acfx-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp text;
+begin
+  v_fp := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://mock-portal-'||s||'.test', 'message-board', true, true, '{board:send}', '{board:x}', '{agent,human}');
+
+  select e.agent_id into v_agent
+    from agent_board.enroll_federated_identity(
+      'https://mock-portal-'||s||'.test', 'message-board', 'portal|'||s,
+      v_claim, 'acfx-'||s, v_pub, 'raw_ed25519_base64url', v_fp, true, null, 'human', '{board:send}', '{board:x}') e;
+
+  insert into _acfx values (v_agent, v_claim);
+end
+$$;
+
+-- Exactly one audit row, with the verbatim claim snapshot. -------------------------
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit where agent_id = (select agent from _acfx)),
+  1, 'enroll_federated_identity writes exactly one enrollment_federation_audit row');
+select is(
+  (select human_identity_claim from agent_board.enrollment_federation_audit where agent_id = (select agent from _acfx)),
+  (select claim from _acfx),
+  'human_identity_claim equals the supplied snapshot verbatim');
+select is(
+  (select granted_scopes from agent_board.enrollment_federation_audit where agent_id = (select agent from _acfx)),
+  '{board:send}'::text[],
+  'granted_scopes records the in-ceiling requested scopes');
+
+-- The audit is a STATIC snapshot: no Portal session/MFA/availability/liveness column.
+select hasnt_column('agent_board', 'enrollment_federation_audit', 'portal_session_id',
+  'audit has no portal_session_id column');
+select is(
+  (select count(*)::int
+     from information_schema.columns
+    where table_schema = 'agent_board'
+      and table_name = 'enrollment_federation_audit'
+      and (column_name ~* '(session|mfa|liveness|availability|reachab|online|heartbeat)')),
+  0, 'audit table carries no Portal session/MFA/liveness/availability column (static snapshot only)');
+
+-- The audit exists and stores the enrollment-time snapshot, not a live signal. ------
+select has_column('agent_board', 'enrollment_federation_audit', 'human_identity_claim', 'audit stores human_identity_claim');
+select has_column('agent_board', 'enrollment_federation_audit', 'enrolled_at', 'audit stores enrolled_at (enrollment-time)');
+
+-- No write-path RPC reads enrollment_federation_audit. Only the enroll RPC (which
+-- WRITES it) may reference the table; nothing on the send/session path reads it. ----
+select is(
+  (select count(*)::int from (
+     select pg_get_functiondef(p.oid) as def, p.proname
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        -- pg_get_functiondef() RAISES on aggregate ('a') / window ('w') procs
+        -- ("X is an aggregate function"); restrict to callable functions +
+        -- procedures (the RPC surface this invariant is about).
+        and p.prokind in ('f', 'p')
+        and p.proname <> 'enroll_federated_identity'
+   ) d
+   where lower(d.def) like '%enrollment_federation_audit%'),
+  0, 'no agent_board RPC other than enroll_federated_identity references enrollment_federation_audit');
+select is(
+  (select count(*)::int from (
+     select pg_get_functiondef(p.oid) as def
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board'
+        and p.prokind in ('f', 'p')  -- pg_get_functiondef raises on aggregate/window procs
+        and p.proname in (
+          'mint_fleet_agent_session', 'post_board_message', 'send_direct_message',
+          'send_multicast_message', 'create_tasking_delivery', 'revoke_agent')
+   ) d
+   where lower(d.def) like '%enrollment_federation_audit%'),
+  0, 'no send/session/revoke write-path RPC reads the enrollment audit table');
+
+-- #6 fix: the authenticated SELECT policy is scoped to the owning principal
+-- (agent_id = current_agent_id()), not `using (true)`. Two enrolled human
+-- principals; principal A must NOT see principal B's PII-bearing audit row.
+create temp table _rls (a_agent uuid, a_user uuid, b_agent uuid) on commit drop;
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text,1,8),'-','');
+  v_a_agent uuid; v_a_user uuid; v_b_agent uuid;
+  v_pub_a text := rtrim(translate(encode(extensions.digest(convert_to('k-rls-a-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_pub_b text := rtrim(translate(encode(extensions.digest(convert_to('k-rls-b-'||s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp_a text; v_fp_b text;
+begin
+  v_fp_a := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub_a,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp_b := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub_b,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://rls-portal-'||s||'.test','message-board',true,true,'{board:send}','{board:x}','{agent,human}');
+  select e.agent_id, e.auth_user_id into v_a_agent, v_a_user
+    from agent_board.enroll_federated_identity('https://rls-portal-'||s||'.test','message-board','portal|a-'||s,
+      jsonb_build_object('sub','portal|a-'||s,'name','A'), 'rls-a-'||s, v_pub_a,'raw_ed25519_base64url',v_fp_a,true,null,'human','{board:send}','{board:x}') e;
+  select e.agent_id into v_b_agent
+    from agent_board.enroll_federated_identity('https://rls-portal-'||s||'.test','message-board','portal|b-'||s,
+      jsonb_build_object('sub','portal|b-'||s,'name','B'), 'rls-b-'||s, v_pub_b,'raw_ed25519_base64url',v_fp_b,true,null,'human','{board:send}','{board:x}') e;
+  insert into _rls values (v_a_agent, v_a_user, v_b_agent);
+end
+$$;
+grant select on _rls to authenticated;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role','authenticated', true);
+select set_config('request.jwt.claim.sub', (select a_user from _rls)::text, true);
+
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e where e.agent_id = (select b_agent from _rls)),
+  0, 'agent A cannot read agent B''s enrollment audit row (RLS scoped to owning principal, not using(true))');
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e where e.agent_id = (select a_agent from _rls)),
+  1, 'agent A can read its own enrollment audit row');
+
+reset role;
+
+select finish();
+
+rollback;

package/tests/agent_board_fleet_agent_session_class.test.sql

@@ -0,0 +1,64 @@
+-- MBSESSION SL-1 pgTAP: nonfleet_sessions.identity_class admits fleet_agent_session
+-- (plus the 4 legacy classes), rejects an unknown class, and the TTL pin caps a
+-- fleet_agent_session to <= 900s while legacy classes keep the 3600 default.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(10);
+
+-- All five valid identity classes are admitted (TTL within the fleet pin bound).
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-eph', 'fac-eph', 'ephemeral_child', now() + interval '1 hour', 900)$$,
+  'ephemeral_child identity_class is admitted');
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-hw', 'fac-hw', 'hosted_workload', now() + interval '1 hour', 900)$$,
+  'hosted_workload identity_class is admitted');
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-rs', 'fac-rs', 'remote_sandbox', now() + interval '1 hour', 900)$$,
+  'remote_sandbox identity_class is admitted');
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-inv', 'fac-inv', 'invited_external', now() + interval '1 hour', 900)$$,
+  'invited_external identity_class is admitted');
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-fas', 'fac-fas', 'fleet_agent_session', now() + interval '15 minutes', 900)$$,
+  'fleet_agent_session identity_class is admitted (new 5th class)');
+
+-- A legacy class still keeps the 3600 default (fleet pin does not apply to it).
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at)
+      values ('fac-hw3600', 'fac-hw3600', 'hosted_workload', now() + interval '1 hour')$$,
+  'a legacy class row with the 3600 default is unaffected by the fleet TTL pin');
+
+-- An unknown identity_class is rejected by the re-added CHECK.
+select throws_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-bogus', 'fac-bogus', 'not_a_real_class', now() + interval '1 hour', 900)$$,
+  '23514', null,
+  'an unknown identity_class violates nonfleet_sessions_identity_class_check');
+
+-- fleet_agent_session at exactly 900s is allowed; above 900s violates the TTL pin.
+select lives_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-fas900', 'fac-fas900', 'fleet_agent_session', now() + interval '15 minutes', 900)$$,
+  'fleet_agent_session at the 900s boundary is admitted');
+select throws_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at, max_ttl_seconds)
+      values ('fac-fas901', 'fac-fas901', 'fleet_agent_session', now() + interval '15 minutes', 901)$$,
+  '23514', null,
+  'fleet_agent_session with max_ttl_seconds > 900 violates nonfleet_sessions_fleet_ttl_pin');
+select throws_ok(
+  $$insert into agent_board.nonfleet_sessions(id, session_id, identity_class, expires_at)
+      values ('fac-fas3600', 'fac-fas3600', 'fleet_agent_session', now() + interval '15 minutes')$$,
+  '23514', null,
+  'fleet_agent_session cannot inherit the 3600 max_ttl_seconds default');
+
+select finish();
+
+rollback;

package/tests/agent_board_fleet_policy_default_deny.test.sql

@@ -0,0 +1,149 @@
+-- MBSENDAUTHZ SL-2 pgTAP: the non-fleet fail-open in evaluate_signed_write_fleet_policy
+-- is now mode-gated per sender-fleet-scope (fail_open_preserved / observe / deny)
+-- with a tight non-fleet allowlist. Fleet-resolvable senders are unaffected.
+--
+-- Runs as the postgres db role in a service_role context (the function requires
+-- service role); request.jwt.claim.role is left '' so _is_service_role() is true.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(13);
+
+create temp table _fpd_fixture (
+  ff_sender uuid,
+  ob_sender uuid,
+  dn_sender uuid,
+  dn2_sender uuid,
+  al_sender uuid,
+  fleet_sender uuid,
+  owner_agent uuid
+) on commit drop;
+
+do $$
+declare
+  v_ff uuid := gen_random_uuid();
+  v_ob uuid := gen_random_uuid();
+  v_dn uuid := gen_random_uuid();
+  v_dn2 uuid := gen_random_uuid();
+  v_al uuid := gen_random_uuid();
+  v_fleet uuid := gen_random_uuid();
+  v_owner uuid := gen_random_uuid();
+  v_domain uuid;
+  v_machine uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_ff, 'agent', 'fpd-ff', 'FPD FailOpen'),
+    (v_ob, 'agent', 'fpd-ob', 'FPD Observe'),
+    (v_dn, 'agent', 'fpd-dn', 'FPD Deny'),
+    (v_dn2, 'agent', 'fpd-dn2', 'FPD Deny2'),
+    (v_al, 'agent', 'fpd-al', 'FPD Allowlisted'),
+    (v_fleet, 'agent', 'fpd-fleet', 'FPD Fleet'),
+    (v_owner, 'agent', 'fpd-owner', 'FPD Owner');
+
+  -- A fleet-resolvable sender: active trust domain + machine + agent mapping.
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at, metadata)
+  values ('fpd-tailnet', 'FPD Tailnet', 'tailnet', v_owner, 'active', now(), '{"invitationState":"owner_approved"}'::jsonb);
+  select id into v_domain from agent_board.fleet_trust_domains where slug = 'fpd-tailnet';
+  select machine_id into v_machine
+    from agent_board.register_fleet_machine(v_owner, v_domain, 'fpd-machine', 'sha256:fpd-machine', 'portal', '{"redacted":true}'::jsonb);
+  insert into agent_board.fleet_machine_agents(machine_id, agent_id, agent_role)
+  values (v_machine, v_fleet, 'phase_worker');
+
+  insert into _fpd_fixture values (v_ff, v_ob, v_dn, v_dn2, v_al, v_fleet, v_owner);
+end
+$$;
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- Signature ------------------------------------------------------------------
+select has_function('agent_board', 'evaluate_signed_write_fleet_policy', array['text', 'jsonb', 'jsonb'],
+  'evaluate_signed_write_fleet_policy(text,jsonb,jsonb) exists');
+
+-- Phase A: no flag row => fail_open_preserved (unchanged behavior) ------------
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select ff_sender from _fpd_fixture)::text, 'verification_status', 'verified'))),
+  true, 'no flag row: non-fleet sender passes (fail-open preserved)');
+
+select is(
+  (select count(*)::int from agent_board.send_authz_telemetry
+    where kind = 'would_be_deny' and actor_agent_id = (select ff_sender from _fpd_fixture)),
+  0, 'fail_open_preserved records no would_be_deny telemetry');
+
+-- Phase B: observe => allow AND record exactly one would_be_deny row ----------
+insert into agent_board.fleet_send_enforcement_flags(scope_key, mode) values ('nonfleet', 'observe');
+
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select ob_sender from _fpd_fixture)::text,
+                       'signed_write', jsonb_build_object('origin', 'host')))),
+  true, 'observe mode: non-fleet sender still passes');
+
+select is(
+  (select count(*)::int from agent_board.send_authz_telemetry
+    where kind = 'would_be_deny' and actor_agent_id = (select ob_sender from _fpd_fixture)),
+  1, 'observe mode records exactly one would_be_deny telemetry row');
+
+-- Phase C: deny => deny non-allowlisted, admit allowlisted (tight) -----------
+update agent_board.fleet_send_enforcement_flags set mode = 'deny' where scope_key = 'nonfleet';
+insert into agent_board.nonfleet_sender_allowlist(agent_id, reason)
+values ((select al_sender from _fpd_fixture), 'sl2 test: enumerated legitimate flow');
+
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select dn_sender from _fpd_fixture)::text))),
+  false, 'deny mode: non-allowlisted non-fleet sender is denied');
+
+select is(
+  (select denial_class from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select dn_sender from _fpd_fixture)::text))),
+  'nonfleet_sender_denied', 'deny mode: denial_class is nonfleet_sender_denied');
+
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select al_sender from _fpd_fixture)::text))),
+  true, 'deny mode: allowlisted non-fleet sender is admitted');
+
+-- Tight allowlist: a different, non-enumerated non-fleet sender stays denied.
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select dn2_sender from _fpd_fixture)::text))),
+  false, 'deny mode: allowlist is tight — a non-enumerated sender is still denied');
+
+-- Boardless send_direct_message path is gated (scope resolves before any board).
+select is(
+  (select denial_class from agent_board.evaluate_signed_write_fleet_policy(
+    'send_direct_message', jsonb_build_object('p_recipient_agent_id', gen_random_uuid()::text),
+    jsonb_build_object('agent_id', (select dn_sender from _fpd_fixture)::text))),
+  'nonfleet_sender_denied', 'deny mode gates the boardless send_direct_message path (scope before board)');
+
+-- Fleet-resolvable sender is unaffected by the non-fleet deny flag.
+-- An unhandled operation returns allowed=true for a fleet sender (v_machine_id
+-- not null), proving it never enters the non-fleet branch.
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy(
+    'noop_operation', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select fleet_sender from _fpd_fixture)::text, 'verification_status', 'verified'))),
+  true, 'fleet-resolvable sender is unaffected by the non-fleet deny flag');
+
+-- Grants preserved -----------------------------------------------------------
+select function_privs_are(
+  'agent_board', 'evaluate_signed_write_fleet_policy', array['text', 'jsonb', 'jsonb'],
+  'authenticated', array[]::text[], 'evaluate_signed_write_fleet_policy execute is revoked from authenticated');
+select function_privs_are(
+  'agent_board', 'evaluate_signed_write_fleet_policy', array['text', 'jsonb', 'jsonb'],
+  'service_role', array['EXECUTE'], 'evaluate_signed_write_fleet_policy execute is granted to service_role');
+
+select finish();
+
+rollback;

package/tests/agent_board_fleet_registry.test.sql

@@ -40,8 +40,8 @@ select fk_ok('agent_board', 'fleet_machine_agents', 'signing_key_id', 'agent_boa
 select fk_ok('agent_board', 'fleet_receive_policies', 'recipient_agent_id', 'agent_board', 'agents', 'id', 'receive policies reference recipient agents');
 
 select ok(
-  exists (select 1 from agent_board.schema_version where version = 7),
-  'schema_version advanced to fleet store version 7'
+  exists (select 1 from agent_board.schema_version where version >= 7),
+  'schema_version advanced to at least fleet store version 7'
 );
 
 select ok(

package/tests/agent_board_identity_providers.test.sql

@@ -0,0 +1,104 @@
+-- MBFED SL-1 / MBPORTALGATE SL-1 pgTAP: identity_providers mirrors workload_providers
+-- (shape + RLS + grants), the real Portal contract row is seeded INERT with the frozen
+-- resource-audience + actor_claim, and enroll_federated_identity is service_role-only
+-- (revoked from authenticated). Runs as postgres.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(21);
+
+-- Shape ------------------------------------------------------------------------
+select has_table('agent_board', 'identity_providers', 'identity_providers table exists');
+select col_is_pk('agent_board', 'identity_providers', 'id', 'id is the primary key');
+select col_is_unique('agent_board', 'identity_providers', array['issuer', 'audience'],
+  'unique(issuer, audience) mirrors workload_providers');
+select has_column('agent_board', 'identity_providers', 'policy_approved', 'has policy_approved');
+select col_default_is('agent_board', 'identity_providers', 'policy_approved', 'false',
+  'policy_approved defaults false (no provider auto-approved)');
+
+-- MBPORTALGATE: actor_claim column (forward-only, default 'act.sub') ------------
+select has_column('agent_board', 'identity_providers', 'actor_claim',
+  'MBPORTALGATE adds the actor_claim column (forward-only)');
+select col_default_is('agent_board', 'identity_providers', 'actor_claim', 'act.sub',
+  'actor_claim defaults to act.sub (audit-only delegated-actor claim)');
+
+-- RLS (deny-anon + authenticated-read-true, exactly like workload_providers) ----
+select ok(
+  (select relrowsecurity from pg_class c join pg_namespace n on n.oid=c.relnamespace
+    where n.nspname='agent_board' and c.relname='identity_providers'),
+  'identity_providers has RLS enabled');
+select is(
+  (select count(*)::int from pg_policy pol join pg_class c on c.oid=pol.polrelid
+     join pg_namespace n on n.oid=c.relnamespace
+    where n.nspname='agent_board' and c.relname='identity_providers'
+      and pol.polname='identity_providers_deny_anon'),
+  1, 'identity_providers_deny_anon policy exists');
+select is(
+  (select pg_get_expr(polqual, polrelid) from pg_policy pol join pg_class c on c.oid=pol.polrelid
+     join pg_namespace n on n.oid=c.relnamespace
+    where n.nspname='agent_board' and c.relname='identity_providers'
+      and pol.polname='identity_providers_authenticated_read'),
+  'true', 'authenticated read predicate is true (global registry, fleet-readable)');
+
+-- Grants: select->authenticated, select/insert/update->service_role ------------
+select ok(
+  has_table_privilege('authenticated', 'agent_board.identity_providers', 'SELECT'),
+  'authenticated has SELECT on identity_providers');
+select ok(
+  not has_table_privilege('authenticated', 'agent_board.identity_providers', 'INSERT'),
+  'authenticated has NO INSERT on identity_providers (mirrors workload_providers)');
+select ok(
+  has_table_privilege('service_role', 'agent_board.identity_providers', 'INSERT'),
+  'service_role has INSERT on identity_providers');
+select ok(
+  has_table_privilege('service_role', 'agent_board.identity_providers', 'UPDATE'),
+  'service_role has UPDATE on identity_providers');
+
+-- Seed policy: the shipped seed carries NO policy_approved=true row -------------
+select is(
+  (select count(*)::int from agent_board.identity_providers where policy_approved),
+  0, 'no seeded identity provider ships policy_approved=true (approval is operational)');
+
+-- MBPORTALGATE: the REAL Portal row is present and INERT -----------------------
+-- Frozen resource-audience constant, asserted byte-identical (IF-0-MBPORTALGATE-1/2).
+select is(
+  (select count(*)::int from agent_board.identity_providers
+    where issuer = 'https://portal.consiliency.io'
+      and audience = 'https://message-board.consiliency.io'
+      and supported
+      and not policy_approved
+      and subject_claim = 'sub'
+      and actor_claim = 'act.sub'),
+  1, 'real Portal row present, INERT (policy_approved=false), frozen subject/actor_claim');
+select is(
+  (select audience from agent_board.identity_providers
+    where issuer = 'https://portal.consiliency.io'),
+  'https://message-board.consiliency.io',
+  'real Portal audience is byte-identical to the frozen resource constant (RFC 8707)');
+select is(
+  (select policy_approved from agent_board.identity_providers
+    where issuer = 'https://portal.consiliency.io'
+      and audience = 'https://message-board.consiliency.io'),
+  false, 'real Portal row ships INERT (policy_approved=false) — approval is operational');
+
+-- The pre-existing mock row is untouched (still present, still inert) -----------
+select is(
+  (select count(*)::int from agent_board.identity_providers
+    where issuer = 'https://mock-portal.test'
+      and audience = 'message-board'
+      and supported
+      and not policy_approved),
+  1, 'the mock issuer row is untouched (present, supported, inert)');
+
+-- enroll_federated_identity is service_role-only (reworked 13-arg signature) ----
+select function_privs_are(
+  'agent_board', 'enroll_federated_identity',
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]'],
+  'authenticated', array[]::text[],
+  'reworked enroll_federated_identity execute is revoked from authenticated');
+
+select finish();
+
+rollback;

package/tests/agent_board_inbox_rpcs.test.sql

@@ -130,7 +130,7 @@ select ok(
 
 select ok(
   (
-    select count(distinct routine_name) = 12
+    select count(distinct routine_name) = 16
       from information_schema.routine_privileges
      where specific_schema = 'agent_board'
        and routine_name in (
@@ -154,11 +154,11 @@ select ok(
        and grantee = 'authenticated'
        and privilege_type = 'EXECUTE'
   )
-  and not has_function_privilege('authenticated', 'agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'EXECUTE')
-  and not has_function_privilege('authenticated', 'agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)', 'EXECUTE')
-  and not has_function_privilege('authenticated', 'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'EXECUTE')
-  and not has_function_privilege('authenticated', 'agent_board.create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)', 'EXECUTE'),
-  'authenticated keeps non-delivery inbox RPCs while signed delivery RPC overloads stay gateway-only'
+  and has_function_privilege('authenticated', 'agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'EXECUTE')
+  and has_function_privilege('authenticated', 'agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)', 'EXECUTE')
+  and has_function_privilege('authenticated', 'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'EXECUTE')
+  and has_function_privilege('authenticated', 'agent_board.create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)', 'EXECUTE'),
+  'authenticated keeps non-delivery inbox RPCs and holds the MBSESSION re-granted scoped-send RPCs'
 );
 
 select ok(
@@ -371,7 +371,7 @@ begin
       '{}'::jsonb
     );
   v_board_message := v_result.message_id;
-  perform is(v_result.delivered_recipient_count, 2, 'board delivery reaches joined and subscribed members only');
+  perform is(v_result.delivered_recipient_count, 3, 'board delivery reaches joined and subscribed members only (incl. the seeded owner-creator)');
   perform is(
     (select count(*)::integer from agent_board.delivery_recipients where source_message_id = v_board_message and recipient_agent_id = v_left_member),
     0,
@@ -402,15 +402,15 @@ begin
       '{}'::jsonb
     );
   v_task := v_result.task_id;
-  perform is(v_result.delivered_recipient_count, 3, 'tasking counts explicit and board fan-out attempts');
+  perform is(v_result.delivered_recipient_count, 4, 'tasking counts explicit and board fan-out attempts (incl. the seeded owner-creator)');
   perform is(
     (select count(*)::integer from agent_board.delivery_recipients where source_task_id = v_task),
-    2,
+    3,
     'tasking suppresses duplicate recipient rows across explicit and board fan-out'
   );
   perform is(
     (select count(*)::integer from agent_board.inbox_items where source_task_id = v_task),
-    2,
+    3,
     'tasking writes one inbox row per unique recipient'
   );