@consiliency/agent-board-schema 1.3.0 → 1.5.0

package/tests/agent_board_send_authz_config.test.sql

@@ -0,0 +1,84 @@
+-- MBSENDAUTHZ SL-0 pgTAP: shared send-authz enforcement config + telemetry.
+--
+-- Runs as the postgres db role. request.jwt.claim.role toggles _is_service_role():
+-- unset/'' => service_role true (default here); 'authenticated' => false.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(20);
+
+-- Structure: fleet_send_enforcement_flags ------------------------------------
+select has_table('agent_board', 'fleet_send_enforcement_flags', 'fleet_send_enforcement_flags table exists');
+select has_column('agent_board', 'fleet_send_enforcement_flags', 'scope_key', 'flags has scope_key');
+select col_is_pk('agent_board', 'fleet_send_enforcement_flags', 'scope_key', 'scope_key is the primary key');
+select has_column('agent_board', 'fleet_send_enforcement_flags', 'mode', 'flags has mode');
+select col_has_check('agent_board', 'fleet_send_enforcement_flags', 'mode', 'mode is check-constrained');
+select has_column('agent_board', 'fleet_send_enforcement_flags', 'updated_at', 'flags has updated_at');
+
+-- Default mode is fail_open_preserved (absent explicit mode).
+insert into agent_board.fleet_send_enforcement_flags(scope_key) values ('sl0-default-scope');
+select is(
+  (select mode from agent_board.fleet_send_enforcement_flags where scope_key = 'sl0-default-scope'),
+  'fail_open_preserved', 'flag mode defaults to fail_open_preserved');
+
+-- Invalid mode is rejected by the CHECK.
+select throws_ok(
+  $$insert into agent_board.fleet_send_enforcement_flags(scope_key, mode) values ('sl0-bad', 'block')$$,
+  '23514', null, 'flags mode CHECK rejects an unknown mode');
+
+-- _send_fleet_scope_mode: default on no row, resolved value on a row -----------
+select is(
+  agent_board._send_fleet_scope_mode('sl0-no-such-scope'),
+  'fail_open_preserved', '_send_fleet_scope_mode defaults to fail_open_preserved on no row');
+insert into agent_board.fleet_send_enforcement_flags(scope_key, mode) values ('sl0-observe-scope', 'observe');
+select is(
+  agent_board._send_fleet_scope_mode('sl0-observe-scope'),
+  'observe', '_send_fleet_scope_mode returns the stored mode when a row exists');
+
+-- Structure: nonfleet_sender_allowlist ---------------------------------------
+select has_table('agent_board', 'nonfleet_sender_allowlist', 'nonfleet_sender_allowlist table exists');
+select col_is_pk('agent_board', 'nonfleet_sender_allowlist', 'agent_id', 'allowlist agent_id is the primary key');
+
+-- Structure: send_authz_telemetry + recorder ---------------------------------
+select has_table('agent_board', 'send_authz_telemetry', 'send_authz_telemetry table exists');
+select col_has_check('agent_board', 'send_authz_telemetry', 'kind', 'telemetry kind is check-constrained');
+select col_has_check('agent_board', 'send_authz_telemetry', 'origin', 'telemetry origin is check-constrained');
+
+-- Recorder inserts a row and normalizes an out-of-vocab origin to 'unknown'.
+do $$
+declare v_id uuid;
+begin
+  v_id := agent_board._record_send_authz_telemetry(
+    'service_role_bypass', 'garbage-origin', null, null, 'send_direct_message', 'nonfleet', null, '{}'::jsonb);
+end $$;
+select is(
+  (select origin from agent_board.send_authz_telemetry where operation = 'send_direct_message' order by recorded_at desc limit 1),
+  'unknown', 'recorder normalizes an out-of-vocab origin to unknown');
+select is(
+  (select kind from agent_board.send_authz_telemetry where operation = 'send_direct_message' order by recorded_at desc limit 1),
+  'service_role_bypass', 'recorder persists kind');
+
+-- Recorder is service_role-only: under an authenticated caller it raises 42501.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select throws_ok(
+  $$select agent_board._record_send_authz_telemetry('service_role_bypass','ef',null,null,'send_direct_message','nonfleet',null,'{}'::jsonb)$$,
+  '42501', null, 'recorder rejects a non-service-role caller');
+select set_config('request.jwt.claim.role', '', true);
+
+-- Recorder execute privilege is revoked from authenticated.
+select function_privs_are(
+  'agent_board', '_record_send_authz_telemetry',
+  array['text', 'text', 'uuid', 'uuid', 'text', 'text', 'text', 'jsonb'],
+  'authenticated', array[]::text[],
+  'recorder execute is revoked from authenticated');
+
+-- _resolve_send_fleet_scope: a non-fleet actor maps to 'nonfleet' -------------
+select is(
+  agent_board._resolve_send_fleet_scope(gen_random_uuid()),
+  'nonfleet', '_resolve_send_fleet_scope maps a non-fleet (no active machine) actor to nonfleet');
+
+select finish();
+
+rollback;

package/tests/agent_board_send_authz_matrix.test.sql

@@ -0,0 +1,162 @@
+-- MBSENDAUTHZ SL-3 pgTAP: cross-cutting authorization matrix. Proves, in one
+-- suite, the board-role send gate (SL-1), the non-fleet default-deny + tight
+-- allowlist + per-scope flag toggle incl. the boardless path (SL-2/SL-0), and the
+-- grantee-bounded ceiling consumption in grant_board_role (SL-3 + MBAUTHZ helper).
+--
+-- Runs as the postgres db role; request.jwt.claim.role/.sub simulate callers.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(11);
+
+create temp table _mtx_fixture (
+  sb_board uuid,
+  sb_member uuid, sb_observer uuid,
+  sb_member_user uuid, sb_observer_user uuid,
+  thread_member uuid, thread_observer uuid,
+  nf_sender uuid, nf_allow uuid,
+  b1 uuid, g_owner uuid, g_admin uuid, g_grantee uuid,
+  b2 uuid, g2_owner uuid, g2_grantee uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_sb_member_user uuid;
+  v_sb_observer_user uuid;
+  v_sb_creator uuid := gen_random_uuid();
+  v_sb_member uuid := gen_random_uuid();
+  v_sb_observer uuid := gen_random_uuid();
+  v_sb_board uuid;
+  v_thread_member uuid := gen_random_uuid();
+  v_thread_observer uuid := gen_random_uuid();
+  v_nf_sender uuid := gen_random_uuid();
+  v_nf_allow uuid := gen_random_uuid();
+  v_b1 uuid; v_g_owner uuid := gen_random_uuid(); v_g_admin uuid := gen_random_uuid(); v_g_grantee uuid := gen_random_uuid();
+  v_b2 uuid; v_g2_owner uuid := gen_random_uuid(); v_g2_grantee uuid := gen_random_uuid();
+begin
+  v_sb_member_user := public.ensure_github_user('mtx-member-' || v_suffix, 'mtx-member-' || v_suffix || '@example.test', 'mtx-member-' || v_suffix, 'MTX Member');
+  v_sb_observer_user := public.ensure_github_user('mtx-observer-' || v_suffix, 'mtx-observer-' || v_suffix || '@example.test', 'mtx-observer-' || v_suffix, 'MTX Observer');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_sb_member, 'agent', 'mtx-member-' || v_suffix, 'MTX Member', 'active', v_sb_member_user, v_sb_member_user),
+    (v_sb_observer, 'agent', 'mtx-observer-' || v_suffix, 'MTX Observer', 'active', v_sb_observer_user, v_sb_observer_user);
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_sb_creator, 'agent', 'mtx-sbcreator-' || v_suffix, 'MTX Send Board Creator'),
+    (v_nf_sender, 'agent', 'mtx-nf-' || v_suffix, 'MTX NonFleet'),
+    (v_nf_allow, 'agent', 'mtx-nfa-' || v_suffix, 'MTX NonFleet Allow'),
+    (v_g_owner, 'agent', 'mtx-gowner-' || v_suffix, 'MTX Grant Owner'),
+    (v_g_admin, 'agent', 'mtx-gadmin-' || v_suffix, 'MTX Grant Admin'),
+    (v_g_grantee, 'agent', 'mtx-ggrantee-' || v_suffix, 'MTX Grant Grantee'),
+    (v_g2_owner, 'agent', 'mtx-g2owner-' || v_suffix, 'MTX Grant2 Owner'),
+    (v_g2_grantee, 'agent', 'mtx-g2grantee-' || v_suffix, 'MTX Grant2 Grantee');
+
+  -- Send board created by a dedicated creator (owner is seeded by create_board);
+  -- member/observer are genuine NON-creator members so their roles drive the gate.
+  select board_id into v_sb_board from agent_board.create_board(v_sb_creator, 'mtx-sb-' || v_suffix, 'MTX Send Board', 'matrix', '{}'::jsonb, 'private');
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_sb_board, v_sb_member, 'joined', v_sb_creator, 'member'),
+    (v_sb_board, v_sb_observer, 'joined', v_sb_creator, 'observer');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values
+    (v_thread_member, 'coordination', v_sb_member, 'MTX member thread'),
+    (v_thread_observer, 'coordination', v_sb_observer, 'MTX observer thread');
+
+  -- Grant board B1: no ceiling row (ceiling defaults to owner).
+  select board_id into v_b1 from agent_board.create_board(v_g_owner, 'mtx-b1-' || v_suffix, 'MTX Grant B1', 'ceiling', '{}'::jsonb, 'private');
+  -- v_g_owner's owner membership is seeded by create_board (ROOMOWN).
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_b1, v_g_admin, 'joined', v_g_owner, 'admin'),
+    (v_b1, v_g_grantee, 'joined', v_g_owner, 'observer');
+
+  -- Grant board B2: ceiling lowered to member.
+  select board_id into v_b2 from agent_board.create_board(v_g2_owner, 'mtx-b2-' || v_suffix, 'MTX Grant B2', 'ceiling', '{}'::jsonb, 'private');
+  -- v_g2_owner's owner membership is seeded by create_board (ROOMOWN).
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_b2, v_g2_grantee, 'joined', v_g2_owner, 'observer');
+  insert into agent_board.board_authority_ceilings(board_id, max_grantable_role) values (v_b2, 'member');
+
+  insert into _mtx_fixture values (
+    v_sb_board, v_sb_member, v_sb_observer, v_sb_member_user, v_sb_observer_user,
+    v_thread_member, v_thread_observer, v_nf_sender, v_nf_allow,
+    v_b1, v_g_owner, v_g_admin, v_g_grantee, v_b2, v_g2_owner, v_g2_grantee);
+end
+$$;
+
+-- A. Board-role send gate (authenticated path) -------------------------------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select sb_observer_user from _mtx_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 's', 'b')$q$,
+     thread_observer, sb_observer, sb_board) from _mtx_fixture),
+  '42501', 'board send requires a non-observer board role',
+  'matrix: observer authenticated actor denied on a board send');
+select set_config('request.jwt.claim.sub', (select sb_member_user from _mtx_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 's', 'b')$q$,
+     thread_member, sb_member, sb_board) from _mtx_fixture),
+  'matrix: member authenticated actor allowed on a board send');
+
+-- B/C. Non-fleet default-deny + tight allowlist + per-scope flag toggle -------
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+insert into agent_board.fleet_send_enforcement_flags(scope_key, mode) values ('nonfleet', 'deny');
+insert into agent_board.nonfleet_sender_allowlist(agent_id, reason) values ((select nf_allow from _mtx_fixture), 'matrix enumerated flow');
+
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy('send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select nf_sender from _mtx_fixture)::text))),
+  false, 'matrix: deny mode blocks an unenrolled non-fleet sender');
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy('send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select nf_allow from _mtx_fixture)::text))),
+  true, 'matrix: tight allowlist admits only the enumerated non-fleet sender');
+-- Boardless send_direct_message path is gated by the scope flag (scope before board).
+select is(
+  (select denial_class from agent_board.evaluate_signed_write_fleet_policy('send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select nf_sender from _mtx_fixture)::text))),
+  'nonfleet_sender_denied', 'matrix: flag gates the boardless send_direct_message path under deny');
+-- Toggle the scope off: the same sender now passes (fail_open_preserved).
+update agent_board.fleet_send_enforcement_flags set mode = 'fail_open_preserved' where scope_key = 'nonfleet';
+select is(
+  (select allowed from agent_board.evaluate_signed_write_fleet_policy('send_direct_message', '{}'::jsonb,
+    jsonb_build_object('agent_id', (select nf_sender from _mtx_fixture)::text))),
+  true, 'matrix: flag toggle to fail_open_preserved re-admits the same non-fleet sender');
+
+-- D. Grantee-bounded ceiling consumption via grant_board_role -----------------
+-- B1 has no ceiling row (ceiling defaults to owner).
+select lives_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'member', %L::uuid)$q$,
+     b1, g_grantee, g_admin) from _mtx_fixture),
+  'matrix: within-ceiling grant (admin grants member) is admitted');
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'owner', %L::uuid)$q$,
+     b1, g_grantee, g_admin) from _mtx_fixture),
+  '42501', 'grant exceeds grantor role or board authority ceiling',
+  'matrix: a grant exceeding the grantor role is rejected (grantee-bounded)');
+select lives_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin', %L::uuid)$q$,
+     b1, g_grantee, g_owner) from _mtx_fixture),
+  'matrix: no-ceiling-row board treats ceiling as owner (owner grants admin admitted)');
+-- B2 ceiling is member: owner may not grant admin (over-ceiling).
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin', %L::uuid)$q$,
+     b2, g2_grantee, g2_owner) from _mtx_fixture),
+  '42501', 'grant exceeds grantor role or board authority ceiling',
+  'matrix: an over-ceiling grant is rejected even for an owner grantor');
+
+-- E. Live: grant_board_role is now granted EXECUTE to authenticated (ROOMOWN) ---
+select function_privs_are(
+  'agent_board', 'grant_board_role', array['uuid', 'uuid', 'text', 'uuid'],
+  'authenticated', array['EXECUTE'], 'matrix: grant_board_role execute is granted to authenticated (self-service authority live)');
+
+select finish();
+
+rollback;

package/tests/agent_board_send_role_gate.test.sql

@@ -0,0 +1,181 @@
+-- MBSENDAUTHZ SL-1 pgTAP: _current_agent_can_send_to_board, the board-role send
+-- gate on the board-target sends, boardless-send invariance, and service_role
+-- bypass telemetry with the frozen origin discriminator.
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- (''/service_role => true, 'authenticated' => false), request.jwt.claim.sub picks
+-- the acting agent.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(16);
+
+create temp table _srg_fixture (
+  board uuid,
+  member_agent uuid,
+  observer_agent uuid,
+  nonmember_agent uuid,
+  recipient_agent uuid,
+  member_user uuid,
+  observer_user uuid,
+  nonmember_user uuid,
+  thread_member uuid,
+  thread_observer uuid,
+  thread_dm uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_member_user uuid;
+  v_observer_user uuid;
+  v_nonmember_user uuid;
+  v_creator uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_observer uuid := gen_random_uuid();
+  v_nonmember uuid := gen_random_uuid();
+  v_recipient uuid := gen_random_uuid();
+  v_board uuid;
+  v_thread_member uuid := gen_random_uuid();
+  v_thread_observer uuid := gen_random_uuid();
+  v_thread_dm uuid := gen_random_uuid();
+begin
+  v_member_user := public.ensure_github_user('srg-member-' || v_suffix, 'srg-member-' || v_suffix || '@example.test', 'srg-member-' || v_suffix, 'SRG Member');
+  v_observer_user := public.ensure_github_user('srg-observer-' || v_suffix, 'srg-observer-' || v_suffix || '@example.test', 'srg-observer-' || v_suffix, 'SRG Observer');
+  v_nonmember_user := public.ensure_github_user('srg-nonmember-' || v_suffix, 'srg-nonmember-' || v_suffix || '@example.test', 'srg-nonmember-' || v_suffix, 'SRG Nonmember');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_member, 'agent', 'srg-member-' || v_suffix, 'SRG Member', 'active', v_member_user, v_member_user),
+    (v_observer, 'agent', 'srg-observer-' || v_suffix, 'SRG Observer', 'active', v_observer_user, v_observer_user),
+    (v_nonmember, 'agent', 'srg-nonmember-' || v_suffix, 'SRG Nonmember', 'active', v_nonmember_user, v_nonmember_user),
+    (v_recipient, 'agent', 'srg-recipient-' || v_suffix, 'SRG Recipient', 'active', null, null),
+    (v_creator, 'agent', 'srg-creator-' || v_suffix, 'SRG Creator', 'active', null, null);
+
+  -- Dedicated creator (owner seeded by create_board); member/observer are genuine
+  -- NON-creator members so their roles drive the send gate.
+  select board_id into v_board
+    from agent_board.create_board(v_creator, 'srg-board-' || v_suffix, 'SRG Board', 'send role gate test', '{}'::jsonb, 'private');
+
+  -- member: role member; observer: role observer. Both active.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_member, 'joined', v_creator, 'member'),
+    (v_board, v_observer, 'joined', v_creator, 'observer');
+
+  -- Threads each sending actor can access (inherit mode; creator has access).
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values
+    (v_thread_member, 'coordination', v_member, 'SRG member thread'),
+    (v_thread_observer, 'coordination', v_observer, 'SRG observer thread'),
+    (v_thread_dm, 'coordination', v_member, 'SRG dm thread');
+
+  insert into _srg_fixture values
+    (v_board, v_member, v_observer, v_nonmember, v_recipient,
+     v_member_user, v_observer_user, v_nonmember_user,
+     v_thread_member, v_thread_observer, v_thread_dm);
+end
+$$;
+
+-- 1. _current_agent_can_send_to_board -----------------------------------------
+select has_function('agent_board', '_current_agent_can_send_to_board', array['uuid'], '_current_agent_can_send_to_board exists');
+
+select set_config('request.jwt.claim.role', 'service_role', true);
+select is(
+  agent_board._current_agent_can_send_to_board((select board from _srg_fixture)),
+  true, 'service_role may always send to board');
+
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select member_user from _srg_fixture)::text, true);
+select is(
+  agent_board._current_agent_can_send_to_board((select board from _srg_fixture)),
+  true, 'active member (role member) may send to board');
+
+select set_config('request.jwt.claim.sub', (select observer_user from _srg_fixture)::text, true);
+select is(
+  agent_board._current_agent_can_send_to_board((select board from _srg_fixture)),
+  false, 'observer board member may not send to board');
+
+select set_config('request.jwt.claim.sub', (select nonmember_user from _srg_fixture)::text, true);
+select is(
+  agent_board._current_agent_can_send_to_board((select board from _srg_fixture)),
+  false, 'non-member may not send to board');
+
+-- 2. Board-target sends enforce the role gate on the authenticated path -------
+select set_config('request.jwt.claim.sub', (select observer_user from _srg_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     thread_observer, observer_agent, board) from _srg_fixture),
+  '42501', 'board send requires a non-observer board role',
+  'post_board_message rejects an observer board member');
+
+select set_config('request.jwt.claim.sub', (select member_user from _srg_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     thread_member, member_agent, board) from _srg_fixture),
+  'post_board_message admits a member board member');
+
+select set_config('request.jwt.claim.sub', (select observer_user from _srg_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.create_tasking_delivery(%L::uuid, %L::uuid, 'title', null, null, %L::uuid)$q$,
+     thread_observer, observer_agent, board) from _srg_fixture),
+  '42501', 'board send requires a non-observer board role',
+  'create_tasking_delivery (board target) rejects an observer board member');
+
+select set_config('request.jwt.claim.sub', (select member_user from _srg_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.create_tasking_delivery(%L::uuid, %L::uuid, 'title', null, null, %L::uuid)$q$,
+     thread_member, member_agent, board) from _srg_fixture),
+  'create_tasking_delivery (board target) admits a member board member');
+
+-- 3. Boardless direct send is unaffected by the role gate ---------------------
+-- The observer holds only an observer board role, but a board-less DM never
+-- consults the board role gate.
+select set_config('request.jwt.claim.sub', (select observer_user from _srg_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.send_direct_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body')$q$,
+     thread_observer, observer_agent, recipient_agent) from _srg_fixture),
+  'send_direct_message on a board-less thread is unaffected by the board role gate (observer sender admitted)');
+
+-- 4. service_role bypass telemetry: exactly one row, origin from p_metadata ----
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($q$select agent_board.post_board_message(%L::uuid, %L::uuid, %L::uuid, 'sub', 'body', 'comment', 'medium', null, %L::jsonb)$q$,
+     thread_member, member_agent, board,
+     jsonb_build_object('signed_write', jsonb_build_object('origin', 'ef'))) from _srg_fixture),
+  'service_role post_board_message succeeds (guarded bypass)');
+
+select is(
+  (select count(*)::int from agent_board.send_authz_telemetry
+    where kind = 'service_role_bypass'
+      and operation = 'post_board_message'
+      and actor_agent_id = (select member_agent from _srg_fixture)),
+  1, 'exactly one service_role_bypass telemetry row is recorded for the send');
+
+select is(
+  (select origin from agent_board.send_authz_telemetry
+    where kind = 'service_role_bypass' and operation = 'post_board_message'
+      and actor_agent_id = (select member_agent from _srg_fixture)
+    order by recorded_at desc limit 1),
+  'ef', 'bypass telemetry origin is resolved from p_metadata signed_write origin');
+
+select set_config('request.jwt.claim.role', '', true);
+
+-- 5. Enforcement live (MBSESSION): the 8 core sends are re-granted to
+-- authenticated; the board-role gate asserted above still governs who may send.
+select function_privs_are(
+  'agent_board', 'post_board_message', array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'post_board_message execute is granted to authenticated (scoped send live)');
+select function_privs_are(
+  'agent_board', 'create_tasking_delivery', array['uuid','uuid','text','text','uuid[]','uuid','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'create_tasking_delivery execute is granted to authenticated (scoped send live)');
+select function_privs_are(
+  'agent_board', 'send_direct_message', array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
+  'authenticated', array['EXECUTE'], 'send_direct_message execute is granted to authenticated (scoped send live)');
+
+select finish();
+
+rollback;

package/tests/agent_board_signing_challenge_pending_cap.test.sql

@@ -0,0 +1,87 @@
+-- MBHARDEN SL-1 pgTAP: issue_signing_key_challenge enforces a per-key cap of
+-- N=16 concurrently-pending challenges; <=16 issue as before, the 17th is
+-- rejected, and expired/consumed challenges do not count toward the cap.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(4);
+
+select has_function(
+  'agent_board', 'issue_signing_key_challenge', array['uuid', 'text', 'interval'],
+  'issue_signing_key_challenge exists');
+
+-- Block 1: 16 pending challenges are allowed; the 17th is rejected by the cap.
+do $$
+declare
+  v_agent uuid := '00000000-0000-0000-0000-0000000000c1';
+  v_i int;
+  v_c record;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values (v_agent, 'agent', 'pcap-agent', 'PCAP Agent');
+  insert into agent_board.agent_signing_keys(
+    agent_id, key_id, key_version, public_key, public_key_format, fingerprint)
+  values (
+    v_agent, 'primary', 1, repeat('A', 43), 'raw_ed25519_base64url',
+    'sha256:' || repeat('Z', 43));
+
+  set local role service_role;
+
+  for v_i in 1..16 loop
+    select * into v_c
+      from agent_board.issue_signing_key_challenge(v_agent, 'primary', interval '5 minutes');
+    if v_c.challenge_id is null then
+      raise exception 'pending challenge % was not issued below the cap', v_i;
+    end if;
+  end loop;
+
+  begin
+    perform *
+      from agent_board.issue_signing_key_challenge(v_agent, 'primary', interval '5 minutes');
+    raise exception 'the 17th pending challenge was NOT rejected by the cap';
+  exception
+    when others then
+      if sqlerrm !~ 'challenge_pending_cap' then
+        raise;
+      end if;
+  end;
+end
+$$;
+reset role;
+
+select pass('16 pending challenges issue below the cap');
+select pass('the 17th concurrently-pending challenge is rejected (challenge_pending_cap)');
+
+-- Expire one pending challenge (as owner), then a new challenge succeeds: expired
+-- rows do not count toward the cap.
+update agent_board.agent_signing_key_challenges
+   set expires_at = now() - interval '1 minute'
+ where id = (
+   select id from agent_board.agent_signing_key_challenges
+    where agent_id = '00000000-0000-0000-0000-0000000000c1'
+      and proof_state = 'pending'
+    order by created_at
+    limit 1);
+
+do $$
+declare
+  v_agent uuid := '00000000-0000-0000-0000-0000000000c1';
+  v_c record;
+begin
+  set local role service_role;
+  select * into v_c
+    from agent_board.issue_signing_key_challenge(v_agent, 'primary', interval '5 minutes');
+  if v_c.challenge_id is null then
+    raise exception 'a new challenge was rejected even though an expired row freed a slot';
+  end if;
+end
+$$;
+reset role;
+
+select pass('an expired pending challenge frees a slot under the cap');
+
+select finish();
+
+rollback;

package/tests/agent_board_signing_challenge_reaper.test.sql

@@ -0,0 +1,74 @@
+-- MBHARDEN SL-1 pgTAP: reap_expired_signing_key_challenges deletes only rows
+-- whose expires_at is older than the grace argument, leaves unexpired rows, returns
+-- the affected count, and is revoked from authenticated.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(9);
+
+select has_function(
+  'agent_board', 'reap_expired_signing_key_challenges', array['interval'],
+  'reap_expired_signing_key_challenges(interval) exists');
+
+-- Seed: one agent + key, then three challenges at old (>7d) / recent (<7d) / future
+-- expires_at. All are pending (proof_state='pending', consumed_at null) — valid per
+-- the consumed-shape check regardless of expires_at.
+do $$
+declare
+  v_agent uuid := gen_random_uuid();
+  v_key uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values (v_agent, 'agent', 'reap-chal-agent', 'REAP CHAL Agent');
+  insert into agent_board.agent_signing_keys(
+    agent_id, key_id, key_version, public_key, public_key_format, fingerprint)
+  values (
+    v_agent, 'primary', 1, repeat('A', 43), 'raw_ed25519_base64url',
+    'sha256:' || repeat('Z', 43))
+  returning id into v_key;
+
+  insert into agent_board.agent_signing_key_challenges(
+    signing_key_id, agent_id, challenge_nonce, challenge_bytes, expires_at)
+  values
+    (v_key, v_agent, 'nonce-old', 'bytes-old', now() - interval '30 days'),
+    (v_key, v_agent, 'nonce-recent', 'bytes-recent', now() - interval '1 hour'),
+    (v_key, v_agent, 'nonce-future', 'bytes-future', now() + interval '10 minutes');
+end
+$$;
+
+-- Default 7-day grace: removes only the 30-day-old row.
+select is(
+  agent_board.reap_expired_signing_key_challenges(),
+  1::bigint, 'default (7 day) reap removes exactly the one row expired > 7 days ago');
+select ok(
+  not exists (select 1 from agent_board.agent_signing_key_challenges where challenge_nonce = 'nonce-old'),
+  'the 30-day-old challenge was deleted');
+select ok(
+  exists (select 1 from agent_board.agent_signing_key_challenges where challenge_nonce = 'nonce-recent'),
+  'the 1-hour-old challenge survives the 7-day grace');
+select ok(
+  exists (select 1 from agent_board.agent_signing_key_challenges where challenge_nonce = 'nonce-future'),
+  'the not-yet-expired challenge survives the 7-day grace');
+
+-- Zero grace: removes any past-expires_at row (the recent one) but not the future one.
+select is(
+  agent_board.reap_expired_signing_key_challenges(interval '0 seconds'),
+  1::bigint, 'zero-grace reap removes exactly the remaining past-expires_at row');
+select ok(
+  not exists (select 1 from agent_board.agent_signing_key_challenges where challenge_nonce = 'nonce-recent'),
+  'the 1-hour-old challenge is deleted under zero grace');
+select ok(
+  exists (select 1 from agent_board.agent_signing_key_challenges where challenge_nonce = 'nonce-future'),
+  'a not-yet-expired challenge is never reaped');
+
+-- Privilege: execute revoked from authenticated.
+select function_privs_are(
+  'agent_board', 'reap_expired_signing_key_challenges', array['interval'],
+  'authenticated', array[]::text[],
+  'reap_expired_signing_key_challenges execute is revoked from authenticated');
+
+select finish();
+
+rollback;