@consiliency/agent-board-schema 1.3.0 → 1.5.0

package/tests/agent_board_revoke_agent_subtree.test.sql

@@ -0,0 +1,188 @@
+-- MBDELEG SL-1 pgTAP (IF-0-MBDELEG-3): DOWN-walking refresh-checked subtree cascade.
+--
+-- Proves the two linchpins and the survival contract:
+--   (a) REFRESH-BOUNDARY KILL: after a live child fleet_agent_session exists,
+--       revoke_agent_subtree(root) flips ONLY key+status+grant (NOT board membership),
+--       and a fresh mint_fleet_agent_session for that child RAISES within one <=15-min
+--       TTL (the re-mint fails; not old-token expiry).
+--   (b) INERT-LEDGER: a bare fleet_revocation_events row inserted directly (no key/status
+--       flip) does NOT stop mint_fleet_agent_session — the refresh path reads key/status,
+--       not the audit ledger.
+--   + revoke_agent_subtree kills the root + grant-derived descendants (keys + status +
+--     grants + audit rows), while a lineage-independent independent_auth principal (NULL
+--     parent, own active key+status, same owner) SURVIVES and still mints; and
+--     revoke_human_subtree(owner) is TOTAL — it also kills the independent principal.
+--
+-- Runs as postgres (service_role-equivalent).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(19);
+
+create temp table _rev_fx (
+  owner_id uuid, admin uuid, r uuid, r_key uuid,
+  c uuid, c_key uuid, i uuid, i_key uuid, z uuid, z_key uuid, bd uuid,
+  ch_c1 uuid, ch_c2 uuid, ch_i1 uuid, ch_i2 uuid, ch_i3 uuid, ch_z uuid
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  u_owner uuid; u_admin uuid; u_r uuid; u_i uuid; u_z uuid;
+  v_admin uuid := gen_random_uuid(); v_r uuid := gen_random_uuid();
+  v_i uuid := gen_random_uuid(); v_z uuid := gen_random_uuid();
+  v_bd uuid := gen_random_uuid();
+  v_rkey uuid := gen_random_uuid(); v_ikey uuid := gen_random_uuid(); v_zkey uuid := gen_random_uuid();
+  v_c uuid; v_ckey uuid;
+  ch_c1 uuid := gen_random_uuid(); ch_c2 uuid := gen_random_uuid();
+  ch_i1 uuid := gen_random_uuid(); ch_i2 uuid := gen_random_uuid(); ch_i3 uuid := gen_random_uuid();
+  ch_z uuid := gen_random_uuid();
+begin
+  u_owner := public.ensure_github_user('rev-own-'||s, 'rev-own-'||s||'@example.test', 'rev-own-'||s, 'OWN');
+  u_admin := public.ensure_github_user('rev-adm-'||s, 'rev-adm-'||s||'@example.test', 'rev-adm-'||s, 'ADM');
+  u_r := public.ensure_github_user('rev-r-'||s, 'rev-r-'||s||'@example.test', 'rev-r-'||s, 'R');
+  u_i := public.ensure_github_user('rev-i-'||s, 'rev-i-'||s||'@example.test', 'rev-i-'||s, 'I');
+  u_z := public.ensure_github_user('rev-z-'||s, 'rev-z-'||s||'@example.test', 'rev-z-'||s, 'Z');
+
+  -- Admin (revoker; distinct owner so it is not swept by revoke_human_subtree(owner)).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id)
+  values (v_admin, 'agent', 'rev-adm-'||s, 'ADM', 'active', u_admin);
+
+  -- Root R (owner = the human). Its own active key.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_r, 'agent', 'rev-r-'||s, 'R', 'active', u_r, u_owner);
+  insert into agent_board.delegation_policies(root_agent_id, mode, max_active_children, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_r, 'root_minted', 5, jsonb_build_array('scope:a'), interval '8 hours', true);
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (v_rkey, v_r, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(v_rkey::text,'-',''),43,'A'), 'active', 'proven');
+
+  -- Delegated child C under R (gets an ephemeral revocable key + a grant).
+  select child_agent_id, signing_key_id into v_c, v_ckey
+    from agent_board.mint_delegated_child(v_r, 'rev-c-'||s, jsonb_build_array('scope:a'),
+      rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '='));
+
+  -- Give C a joined board membership; the cascade must NOT touch it.
+  insert into agent_board.boards(id, slug, name, created_by_agent_id)
+  values (v_bd, 'rev-bd-'||s, 'Rev Board', v_admin);
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role)
+  values (v_bd, v_c, 'joined', 'member');
+
+  -- Give C a live legacy agent_credentials row; the cascade must revoke it (#3).
+  insert into agent_board.agent_credentials(agent_id, refresh_token_hash, hash_version, credential_label, expires_at)
+  values (v_c, extensions.digest('rev-c-cred-'||s, 'sha256'), 1, 'legacy', now() + interval '1 day');
+
+  -- Independent principal I: lineage-independent (NULL parent/root), own active key,
+  -- same human owner. Survives a root revoke; killed only by self or human revoke.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_i, 'agent', 'rev-i-'||s, 'I', 'active', u_i, u_owner);
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (v_ikey, v_i, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(v_ikey::text,'-',''),43,'A'), 'active', 'proven');
+
+  -- Z: independent bystander (distinct owner) used only for the inert-ledger proof.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_z, 'agent', 'rev-z-'||s, 'Z', 'active', u_z, u_z);
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values (v_zkey, v_z, 'primary', 1, repeat('A',43), 'raw_ed25519_base64url', 'sha256:'||rpad(replace(v_zkey::text,'-',''),43,'A'), 'active', 'proven');
+
+  -- Challenges (pending, unexpired), bound to (key, agent).
+  insert into agent_board.agent_signing_key_challenges(id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, proof_state, expires_at)
+  values
+    (ch_c1, v_ckey, v_c, ch_c1::text, 'agent-signing-key-proof.v1:'||ch_c1||':n', 'pending', now() + interval '10 minutes'),
+    (ch_c2, v_ckey, v_c, ch_c2::text, 'agent-signing-key-proof.v1:'||ch_c2||':n', 'pending', now() + interval '10 minutes'),
+    (ch_i1, v_ikey, v_i, ch_i1::text, 'agent-signing-key-proof.v1:'||ch_i1||':n', 'pending', now() + interval '10 minutes'),
+    (ch_i2, v_ikey, v_i, ch_i2::text, 'agent-signing-key-proof.v1:'||ch_i2||':n', 'pending', now() + interval '10 minutes'),
+    (ch_i3, v_ikey, v_i, ch_i3::text, 'agent-signing-key-proof.v1:'||ch_i3||':n', 'pending', now() + interval '10 minutes'),
+    (ch_z, v_zkey, v_z, ch_z::text, 'agent-signing-key-proof.v1:'||ch_z||':n', 'pending', now() + interval '10 minutes');
+
+  insert into _rev_fx values (
+    u_owner, v_admin, v_r, v_rkey, v_c, v_ckey, v_i, v_ikey, v_z, v_zkey, v_bd,
+    ch_c1, ch_c2, ch_i1, ch_i2, ch_i3, ch_z
+  );
+end
+$$;
+
+-- Function existence.
+select has_function('agent_board', 'revoke_agent_subtree', array['uuid','uuid','text'], 'revoke_agent_subtree exists');
+select has_function('agent_board', 'revoke_human_subtree', array['uuid','uuid','text'], 'revoke_human_subtree exists');
+
+-- Phase 1: live sessions mint pre-revoke.
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_c1, c_key, c) from _rev_fx),
+  'child C mints a live fleet_agent_session while its lineage is active');
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_i1, i_key, i) from _rev_fx),
+  'independent principal I mints a live session pre-revoke');
+
+-- INERT-LEDGER: a bare audit row alone does NOT stop Z's mint.
+insert into agent_board.fleet_revocation_events(subject_kind, subject_id, agent_id, revoked_by_agent_id, revocation_reason)
+select 'agent', z, z, admin, 'bare-ledger-inert-test' from _rev_fx;
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_z, z_key, z) from _rev_fx),
+  'inert-ledger: a bare fleet_revocation_events row does NOT stop mint (refresh reads key/status, not the ledger)');
+
+-- Phase 2: DOWN-walking cascade from the root R.
+create temp table _rev_counts (revoked_agent_count int, revoked_key_count int) on commit drop;
+insert into _rev_counts
+select * from agent_board.revoke_agent_subtree((select r from _rev_fx), (select admin from _rev_fx), 'root revocation');
+
+select is((select revoked_agent_count from _rev_counts), 2, 'revoke_agent_subtree revoked 2 agents (root R + grant-derived child C)');
+select is((select revoked_key_count from _rev_counts), 2, 'revoke_agent_subtree revoked 2 signing keys (R primary + C ephemeral)');
+
+select is(
+  (select k.status from agent_board.agent_signing_keys k where k.id = (select c_key from _rev_fx)),
+  'revoked', 'child C signing key flipped to revoked');
+select is(
+  (select a.status from agent_board.agents a where a.id = (select c from _rev_fx)),
+  'revoked', 'child C agents.status flipped to revoked');
+select ok(
+  (select g.revoked_at is not null from agent_board.delegation_grants g where g.child_agent_id = (select c from _rev_fx)),
+  'child C delegation grant marked revoked');
+
+-- #3 fix: the cascade also revokes the descendant's legacy agent_credentials.
+select is(
+  (select count(*)::int from agent_board.agent_credentials ac
+     where ac.agent_id = (select c from _rev_fx) and ac.revoked_at is null),
+  0, 'cascade revoked child C''s agent_credentials (no live legacy credential remains)');
+
+-- NOT board membership: C's joined membership is untouched by the cascade.
+select is(
+  (select bm.membership_state from agent_board.board_memberships bm
+    where bm.agent_id = (select c from _rev_fx) and bm.board_id = (select bd from _rev_fx)),
+  'joined', 'cascade did NOT touch board membership (still joined)');
+
+-- Audit rows appended for C (agent + signing_key).
+select ok(
+  (select count(*) filter (where subject_kind = 'agent') >= 1
+      and count(*) filter (where subject_kind = 'signing_key') >= 1
+     from agent_board.fleet_revocation_events e where e.agent_id = (select c from _rev_fx)),
+  'cascade appended audit fleet_revocation_events rows for C (agent + signing_key)');
+
+-- REFRESH-BOUNDARY KILL [linchpin]: a fresh re-mint for C now RAISES (not old-token expiry).
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_c2, c_key, c) from _rev_fx),
+  '42501', null, 'refresh-boundary kill: a fresh re-mint for C AFTER revoke_agent_subtree raises');
+
+-- independent_auth SURVIVAL: I is untouched by revoke_agent_subtree(root) and still mints.
+select lives_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_i2, i_key, i) from _rev_fx),
+  'independent principal I survives revoke_agent_subtree(root) and still mints');
+select is(
+  (select k.status from agent_board.agent_signing_keys k where k.id = (select i_key from _rev_fx)),
+  'active', 'independent principal I signing key remains active after root revoke');
+
+-- Phase 3: TOTAL human revocation kills I as well.
+select lives_ok(
+  (select format($q$select agent_board.revoke_human_subtree(%L::uuid, %L::uuid, 'human revocation')$q$, owner_id, admin) from _rev_fx),
+  'revoke_human_subtree runs for the human owner');
+select throws_ok(
+  (select format($q$select agent_board.mint_fleet_agent_session(%1$L::uuid, %1$L::text, %2$L::uuid, %3$L::uuid)$q$, ch_i3, i_key, i) from _rev_fx),
+  '42501', null, 'after revoke_human_subtree, independent principal I can no longer mint (total human revocation)');
+select is(
+  (select a.status from agent_board.agents a where a.id = (select i from _rev_fx)),
+  'revoked', 'revoke_human_subtree flipped the independent principal I to revoked');
+
+select finish();
+
+rollback;

package/tests/agent_board_roomown.test.sql

@@ -0,0 +1,233 @@
+-- ROOMOWN pgTAP: room ownership (create_board owner-seed + owner-only slug-collision
+-- + bootstrap repair) and self-service authority (grant_board_role activated for
+-- authenticated owners/admins with a privilege-escalation-safe grantor binding).
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- (''/service_role => true, 'authenticated' => false) and request.jwt.claim.sub picks
+-- the acting agent. Fixture style mirrors agent_board_board_role.test.sql.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(21);
+
+create temp table _roomown_fixture (
+  board uuid,
+  board_slug text,
+  board2 uuid,
+  board2_owner uuid,
+  alice uuid,
+  bob uuid,
+  member_agent uuid,
+  grantee uuid,
+  nomember uuid,
+  suspended uuid,
+  alice_user uuid,
+  bob_user uuid,
+  member_user uuid,
+  suspended_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_alice_user uuid;
+  v_bob_user uuid;
+  v_member_user uuid;
+  v_suspended_user uuid;
+  v_alice uuid := gen_random_uuid();
+  v_bob uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_grantee uuid := gen_random_uuid();
+  v_nomember uuid := gen_random_uuid();
+  v_suspended uuid := gen_random_uuid();
+  v_b2owner uuid := gen_random_uuid();
+  v_board uuid;
+  v_slug text := 'roomown-board-' || v_suffix;
+  v_board2 uuid := gen_random_uuid();
+begin
+  v_alice_user := public.ensure_github_user('ro-alice-' || v_suffix, 'ro-alice-' || v_suffix || '@example.test', 'ro-alice-' || v_suffix, 'RO Alice');
+  v_bob_user := public.ensure_github_user('ro-bob-' || v_suffix, 'ro-bob-' || v_suffix || '@example.test', 'ro-bob-' || v_suffix, 'RO Bob');
+  v_member_user := public.ensure_github_user('ro-member-' || v_suffix, 'ro-member-' || v_suffix || '@example.test', 'ro-member-' || v_suffix, 'RO Member');
+  v_suspended_user := public.ensure_github_user('ro-susp-' || v_suffix, 'ro-susp-' || v_suffix || '@example.test', 'ro-susp-' || v_suffix, 'RO Suspended');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_alice, 'agent', 'ro-alice-' || v_suffix, 'RO Alice', 'active', v_alice_user, v_alice_user),
+    (v_bob, 'agent', 'ro-bob-' || v_suffix, 'RO Bob', 'active', v_bob_user, v_bob_user),
+    (v_member, 'agent', 'ro-member-' || v_suffix, 'RO Member', 'active', v_member_user, v_member_user),
+    -- Suspended agent WITH a valid auth user: current_agent_id() filters status='active'
+    -- so it resolves to null while auth.uid() still maps (the A1 escalation vector).
+    (v_suspended, 'agent', 'ro-susp-' || v_suffix, 'RO Suspended', 'suspended', v_suspended_user, v_suspended_user),
+    (v_grantee, 'agent', 'ro-grantee-' || v_suffix, 'RO Grantee', 'active', null, null),
+    (v_nomember, 'agent', 'ro-nomember-' || v_suffix, 'RO NoMember', 'active', null, null),
+    (v_b2owner, 'agent', 'ro-b2owner-' || v_suffix, 'RO B2 Owner', 'active', null, null);
+
+  -- Alice creates board B (service_role null-actor here -> supplied arg is honored):
+  -- create_board seeds Alice's joined owner membership.
+  select board_id into v_board
+    from agent_board.create_board(v_alice, v_slug, 'ROOMOWN Board', 'roomown test', '{}'::jsonb, 'private');
+
+  -- Genuine NON-creator members: a member (rank member) + a grant target (observer).
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_member, 'joined', v_alice, 'member'),
+    (v_board, v_grantee, 'joined', v_alice, 'observer');
+
+  -- Board B2: an owner-LESS board (direct insert, no membership) for the bootstrap sweep.
+  insert into agent_board.boards(id, slug, name, description, created_by_agent_id, visibility)
+  values (v_board2, 'roomown-board2-' || v_suffix, 'ROOMOWN Board2', 'owner-less', v_b2owner, 'private');
+
+  insert into _roomown_fixture values
+    (v_board, v_slug, v_board2, v_b2owner, v_alice, v_bob, v_member, v_grantee, v_nomember, v_suspended,
+     v_alice_user, v_bob_user, v_member_user, v_suspended_user);
+end
+$$;
+
+-- 1. create_board seeds the creator's joined owner membership --------------------
+select is(
+  (select count(*)::int from agent_board.board_memberships bm
+     join _roomown_fixture f on bm.board_id = f.board and bm.agent_id = f.alice
+    where bm.membership_state = 'joined' and bm.role = 'owner'),
+  1, 'create_board seeds exactly one joined owner membership for the creator');
+
+-- A5.1 create_board actor-guard: authenticated Bob cannot create as Alice ---------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select bob_user from _roomown_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.create_board(%L::uuid, %L, 'Bob As Alice', null, '{}'::jsonb, 'private')$q$,
+     alice, 'roomown-bobasalice-' || replace(board::text, '-', '')) from _roomown_fixture),
+  '42501', 'p_created_by_agent_id must match current_agent_id()',
+  'actor-guard: authenticated Bob cannot create_board as Alice');
+
+-- A5.2 slug-collision guard: non-owner Bob colliding on Alice's slug -> 42501 -----
+select throws_ok(
+  (select format($q$select agent_board.create_board(%L::uuid, %L, 'HIJACK', null, '{}'::jsonb, 'open')$q$,
+     bob, board_slug) from _roomown_fixture),
+  '42501', 'board slug already in use',
+  'slug-collision: non-owner colliding on an existing slug is rejected');
+select is(
+  (select name from agent_board.boards b join _roomown_fixture f on b.id = f.board),
+  'ROOMOWN Board', 'slug-collision: the existing board name is unchanged (no hijack mutation)');
+select is(
+  (select count(*)::int from agent_board.board_memberships bm
+     join _roomown_fixture f on bm.board_id = f.board and bm.agent_id = f.bob),
+  0, 'slug-collision: the non-owner gains no membership on the existing board');
+
+-- 2. owner-seed idempotent: re-create by the owner does not add an owner row -------
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.create_board(%L::uuid, %L, 'ROOMOWN Board', 'roomown test', '{}'::jsonb, 'private')$q$,
+     alice, board_slug) from _roomown_fixture),
+  'owner re-create on the same slug is admitted (owner-only update path)');
+select is(
+  (select count(*)::int from agent_board.board_memberships bm
+     join _roomown_fixture f on bm.board_id = f.board and bm.agent_id = f.alice
+    where bm.membership_state in ('joined', 'subscribed')),
+  1, 'owner-seed is idempotent: re-create does not duplicate the owner membership');
+
+-- 3. bootstrap repairs an owner-less board's created_by membership ----------------
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  $$select agent_board.bootstrap_board_owner_memberships()$$,
+  'bootstrap_board_owner_memberships runs for service_role');
+select is(
+  (select count(*)::int from agent_board.board_memberships bm
+     join _roomown_fixture f on bm.board_id = f.board2 and bm.agent_id = f.board2_owner
+    where bm.membership_state = 'joined' and bm.role = 'owner'),
+  1, 'bootstrap seeds a joined owner membership for the owner-less board''s created_by');
+
+-- 4. bootstrap is service_role-only ----------------------------------------------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+select throws_ok(
+  $$select agent_board.bootstrap_board_owner_memberships()$$,
+  '42501', 'bootstrap_board_owner_memberships is service_role-only',
+  'bootstrap rejects an authenticated (mapped) caller');
+
+-- 5. owner grants admin (within ceiling, no ceiling row = owner) ------------------
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin')$q$, board, grantee) from _roomown_fixture),
+  'owner grants admin (grantor bound to current_agent_id, no explicit arg)');
+select is(
+  (select role from agent_board.board_memberships bm join _roomown_fixture f on bm.board_id = f.board and bm.agent_id = f.grantee),
+  'admin', 'the grantee role is upserted to admin');
+
+-- 6. a member cannot grant above its own rank ------------------------------------
+select set_config('request.jwt.claim.sub', (select member_user from _roomown_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin')$q$, board, grantee) from _roomown_fixture),
+  '42501', 'grant exceeds grantor role or board authority ceiling',
+  'a member grantor cannot grant admin (grantee-bounded ceiling)');
+
+-- 7. grantor binding: a member passing p_grantor=<owner> is still rejected (A1) ---
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin', %L::uuid)$q$, board, grantee, alice) from _roomown_fixture),
+  '42501', 'p_grantor_agent_id must match current_agent_id()',
+  'grantor binding: an authenticated member cannot impersonate the owner via p_grantor_agent_id');
+
+-- 8. board ceiling caps an owner grant -------------------------------------------
+insert into agent_board.board_authority_ceilings(board_id, max_grantable_role)
+select board, 'member' from _roomown_fixture;
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin')$q$, board, grantee) from _roomown_fixture),
+  '42501', 'grant exceeds grantor role or board authority ceiling',
+  'the board ceiling caps an over-ceiling grant even for an owner grantor');
+
+-- A5.3 grantee-membership required -> P0002 --------------------------------------
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'member')$q$, board, nomember) from _roomown_fixture),
+  'P0002', 'grantee has no membership on this board',
+  'grant to an agent with no membership raises P0002');
+
+-- A5.4 service_role regression: explicit p_grantor honored on the null actor ------
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'member', %L::uuid)$q$, board, grantee, alice) from _roomown_fixture),
+  'service_role: an explicit p_grantor_agent_id is honored (null actor via _is_service_role)');
+
+-- A5.5 null-actor escalation BLOCKED (proves A1) ---------------------------------
+-- An authenticated sub mapped to a SUSPENDED agent (current_agent_id() null) passing
+-- p_grantor=<owner> must be rejected at actor resolution, NOT self-escalated.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select suspended_user from _roomown_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'owner', %L::uuid)$q$, board, grantee, alice) from _roomown_fixture),
+  '42501', 'current agent principal not resolved',
+  'null-actor escalation is blocked: a suspended principal cannot grant via a supplied owner id');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- 9. grant_board_role EXECUTE is granted to authenticated (live) -----------------
+select function_privs_are(
+  'agent_board', 'grant_board_role', array['uuid', 'uuid', 'text', 'uuid'],
+  'authenticated', array['EXECUTE'], 'grant_board_role execute is granted to authenticated (self-service authority live)');
+
+-- A5.6 demoted creator cannot mutate via slug-collision (current-owner authz, NOT created_by) --
+-- Panel finding: the slug-collision UPDATE path must key on CURRENT owner membership, not the
+-- immutable created_by. Alice (still owner after the grant tests) self-demotes to member, then
+-- her re-create on the same slug must be rejected and mutate nothing.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+-- self-demote to member (member <= min(owner, ceiling)); bare statement, not an assertion
+select agent_board.grant_board_role(board, alice, 'member') from _roomown_fixture;
+select throws_ok(
+  (select format($q$select agent_board.create_board(%L::uuid, %L, 'REOPEN', null, '{}'::jsonb, 'open')$q$,
+     alice, board_slug) from _roomown_fixture),
+  '42501', 'board slug already in use',
+  'demoted creator (no current owner membership) cannot mutate the board via slug-collision');
+select is(
+  (select visibility from agent_board.boards b join _roomown_fixture f on b.id = f.board),
+  'private', 'demoted-creator slug-collision leaves visibility unchanged (no private->open flip)');
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select finish();
+
+rollback;

package/tests/agent_board_schema_version.test.sql

@@ -10,8 +10,8 @@ SELECT is(
 
 SELECT is(
   (SELECT version FROM agent_board.schema_version),
-  7,
-  'schema_version.version is 7'
+  8,
+  'schema_version.version is 8'
 );
 
 SELECT throws_ok(

package/tests/agent_board_schema_version_rpc.test.sql

@@ -31,7 +31,7 @@ set local role authenticated;
 
 select is(
   (select version from agent_board.get_schema_version()),
-  7,
+  8,
   'authenticated agents receive the metadata-only schema version'
 );
 

package/tests/agent_board_scoped_send_regrant.test.sql

@@ -0,0 +1,142 @@
+-- MBSESSION SL-1 pgTAP: the 8 core send RPCs are re-granted to authenticated, the
+-- authenticated path derives the actor from current_agent_id() (rejecting a mismatched
+-- p_author_agent_id), real membership is evaluated with _is_service_role() false, a
+-- membership-revoked-mid-session send fails, and no send RPC references Portal
+-- issuer/JWKS (a write succeeds with no Portal dependency present).
+--
+-- Runs as postgres; request.jwt.claim.role toggles _is_service_role()
+-- ('authenticated' => false) and request.jwt.claim.sub picks the acting agent.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(15);
+
+create temp table _regrant_fixture (
+  board uuid,
+  member_agent uuid,
+  other_agent uuid,
+  recipient_agent uuid,
+  member_user uuid,
+  thread_member uuid,
+  thread_dm uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_member_user uuid;
+  v_other_user uuid;
+  v_creator uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_other uuid := gen_random_uuid();
+  v_recipient uuid := gen_random_uuid();
+  v_board uuid;
+  v_thread_member uuid := gen_random_uuid();
+  v_thread_dm uuid := gen_random_uuid();
+begin
+  v_member_user := public.ensure_github_user('rg-member-' || v_suffix, 'rg-member-' || v_suffix || '@example.test', 'rg-member-' || v_suffix, 'RG Member');
+  v_other_user := public.ensure_github_user('rg-other-' || v_suffix, 'rg-other-' || v_suffix || '@example.test', 'rg-other-' || v_suffix, 'RG Other');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_member, 'agent', 'rg-member-' || v_suffix, 'RG Member', 'active', v_member_user, v_member_user),
+    (v_other, 'agent', 'rg-other-' || v_suffix, 'RG Other', 'active', v_other_user, v_other_user),
+    (v_recipient, 'agent', 'rg-recipient-' || v_suffix, 'RG Recipient', 'active', null, null),
+    (v_creator, 'agent', 'rg-creator-' || v_suffix, 'RG Creator', 'active', null, null);
+
+  -- Dedicated creator (owner seeded by create_board); v_member is a genuine
+  -- NON-creator member so the member send path is exercised as role 'member'.
+  select board_id into v_board
+    from agent_board.create_board(v_creator, 'rg-board-' || v_suffix, 'RG Board', 'regrant test', '{}'::jsonb, 'private');
+
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values (v_board, v_member, 'joined', v_creator, 'member');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values
+    (v_thread_member, 'coordination', v_member, 'RG member thread'),
+    (v_thread_dm, 'coordination', v_member, 'RG dm thread');
+
+  insert into _regrant_fixture values
+    (v_board, v_member, v_other, v_recipient, v_member_user, v_thread_member, v_thread_dm);
+end
+$$;
+
+-- 1. The 8 core send-RPC overloads are re-granted execute to authenticated. --------
+select function_privs_are(
+  'agent_board', 'send_direct_message', array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'send_direct_message(uuid recipient) re-granted to authenticated');
+select function_privs_are(
+  'agent_board', 'send_direct_message', array['uuid','uuid','jsonb','text','text','text','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'send_direct_message(jsonb descriptor) re-granted to authenticated');
+select function_privs_are(
+  'agent_board', 'send_multicast_message', array['uuid','uuid','uuid[]','text','text','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'send_multicast_message(uuid[] recipients) re-granted to authenticated');
+select function_privs_are(
+  'agent_board', 'send_multicast_message', array['uuid','uuid','jsonb','text','text','text','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'send_multicast_message(jsonb descriptors) re-granted to authenticated');
+select function_privs_are(
+  'agent_board', 'post_board_message', array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'post_board_message(uuid board) re-granted to authenticated');
+select function_privs_are(
+  'agent_board', 'post_board_message', array['uuid','uuid','text','text','text','text','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'post_board_message(text board_slug) re-granted to authenticated');
+select function_privs_are(
+  'agent_board', 'create_tasking_delivery', array['uuid','uuid','text','text','uuid[]','uuid','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'create_tasking_delivery(uuid[] recipients) re-granted to authenticated');
+select function_privs_are(
+  'agent_board', 'create_tasking_delivery', array['uuid','uuid','text','text','jsonb','text','text','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'create_tasking_delivery(jsonb descriptors) re-granted to authenticated');
+
+-- 2. Authenticated path: _is_service_role() is false, real membership evaluated. ----
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select member_user from _regrant_fixture)::text, true);
+select is(agent_board._is_service_role(), false, 'authenticated path: _is_service_role() is false');
+
+select lives_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     thread_member, member_agent, board) from _regrant_fixture),
+  'a non-observer board member send succeeds with real membership evaluated (Portal-offline write, no Portal dependency present)');
+
+-- 3. A caller-supplied actor that mismatches current_agent_id() is rejected. --------
+select throws_ok(
+  (select format($q$select agent_board.send_direct_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     thread_dm, other_agent, recipient_agent) from _regrant_fixture),
+  '42501', null,
+  'send with p_author_agent_id <> current_agent_id() is rejected by _resolved_actor_agent_id');
+
+-- 4. A board-less direct send by the member also succeeds (no Portal dependency). ---
+select lives_ok(
+  (select format($q$select agent_board.send_direct_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     thread_dm, member_agent, recipient_agent) from _regrant_fixture),
+  'a board-less direct send succeeds on the authenticated path (Portal-offline behavioral)');
+
+-- 5. Membership revoked mid-session: the same member board send now fails. ----------
+update agent_board.board_memberships
+   set membership_state = 'left', left_at = now()
+ where board_id = (select board from _regrant_fixture)
+   and agent_id = (select member_agent from _regrant_fixture);
+select throws_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     thread_member, member_agent, board) from _regrant_fixture),
+  '42501', null,
+  'a membership-revoked-mid-session board send is rejected by the role gate');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- 6. Portal-offline static: no send RPC body references a Portal issuer / JWKS. -----
+select ok(
+  position('portal' in lower(pg_get_functiondef(
+    'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure))) = 0,
+  'post_board_message references no Portal issuer/URL');
+select ok(
+  position('jwks' in lower(pg_get_functiondef(
+    'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure))) = 0,
+  'post_board_message references no JWKS');
+
+select finish();
+
+rollback;