@consiliency/agent-board-schema 1.3.0 → 1.5.0

package/migrations/20260718001300_agent_board_identity_providers.sql

@@ -0,0 +1,70 @@
+-- MBFED SL-1 (Lane A): Portal OIDC identity-provider allowlist (enrollment-only).
+--
+-- Mirrors agent_board.workload_providers (20260710000401 + its RLS corrective
+-- 20260714000200) verbatim in shape and posture: a GLOBAL allowlist keyed by
+-- unique(issuer, audience), with policy_approved defaulting false and scope-ceiling
+-- arrays, RLS enabled with a deny-anon + authenticated-read-true policy pair, and
+-- grants select->authenticated + select,insert,update->service_role.
+--
+-- Federation ceilings (allowed_scopes / allowed_board_scopes / allowed_agent_kinds)
+-- bound what a federated enrollment may request; the 'system' kind is never
+-- federatable (enforced in the enroll RPC, 20260718001500). subject_claim names the
+-- verified OIDC claim the /enroll EF reads as the subject (default 'sub').
+--
+-- Seed policy (load-bearing): ship ONLY a clearly-marked TEST/mock issuer, seeded
+-- INERT (policy_approved = false). NO provider ships policy_approved = true; flipping
+-- the real Portal issuer to supported + policy_approved and wiring its real JWKS URL
+-- is the OPERATIONAL step captured in plans/MBP27-FED-READINESS.md, not a migration.
+-- Additive forward-only migration; writes no agent_board.schema_version (stays 8).
+
+create table if not exists agent_board.identity_providers (
+  id text primary key default gen_random_uuid()::text,
+  issuer text not null,
+  audience text not null,
+  supported boolean not null default true,
+  policy_approved boolean not null default false,
+  allowed_scopes text[] not null default '{}',
+  allowed_board_scopes text[] not null default '{}',
+  allowed_agent_kinds text[] not null default '{}',
+  subject_claim text not null default 'sub',
+  created_at timestamptz not null default now(),
+  unique (issuer, audience)
+);
+
+-- Idempotent column re-assertion (mirrors the workload_providers pattern so a
+-- pre-existing table converges to the frozen shape).
+alter table agent_board.identity_providers
+  add column if not exists supported boolean not null default true,
+  add column if not exists policy_approved boolean not null default false,
+  add column if not exists allowed_scopes text[] not null default '{}',
+  add column if not exists allowed_board_scopes text[] not null default '{}',
+  add column if not exists allowed_agent_kinds text[] not null default '{}',
+  add column if not exists subject_claim text not null default 'sub';
+
+comment on table agent_board.identity_providers is
+  'Enrollment-only allowlist of federated OIDC identity providers (mirrors workload_providers). policy_approved defaults false; no real Portal issuer ships approved. Read only at enrollment by enroll_federated_identity; never on the send/session write path.';
+
+-- Seed: a clearly-marked TEST/mock issuer only, INERT (policy_approved = false).
+-- The real Portal issuer is intentionally NOT seeded here (omitted); wiring it is
+-- operational. Ceilings are illustrative bounds for the mock; enrollment via this
+-- row still requires a deliberate policy_approved flip (operational).
+insert into agent_board.identity_providers
+  (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds, subject_claim)
+values
+  ('https://mock-portal.test', 'message-board', true, false,
+   '{board:send,board:read}', '{}', '{agent,human}', 'sub')
+on conflict (issuer, audience) do nothing;
+
+alter table agent_board.identity_providers enable row level security;
+
+drop policy if exists identity_providers_deny_anon on agent_board.identity_providers;
+create policy identity_providers_deny_anon on agent_board.identity_providers
+  as permissive for select to anon using (false);
+
+drop policy if exists identity_providers_authenticated_read on agent_board.identity_providers;
+create policy identity_providers_authenticated_read on agent_board.identity_providers
+  as permissive for select to authenticated using (true);
+
+revoke all on agent_board.identity_providers from public, anon, authenticated;
+grant select on agent_board.identity_providers to authenticated;
+grant select, insert, update on agent_board.identity_providers to service_role;

package/migrations/20260718001400_agent_board_enrollment_federation_audit.sql

@@ -0,0 +1,50 @@
+-- MBFED SL-1 (Lane A): enrollment federation audit (static claim snapshot).
+--
+-- Records the federated human identity claim as a verbatim, enrollment-time
+-- snapshot. This table is written ONLY by enroll_federated_identity (20260718001500)
+-- and is NEVER read by any send/session write-path RPC. By design there is NO Portal
+-- session / MFA / availability / liveness column: nothing on the write path depends
+-- on the Portal being reachable after enrollment. The audit is an append record of
+-- what was verified at enrollment, not a live trust signal.
+--
+-- RLS + revoke-all-from-public/anon + select->authenticated + select,insert->service_role.
+-- Additive forward-only migration; writes no agent_board.schema_version (stays 8).
+
+create table if not exists agent_board.enrollment_federation_audit (
+  id text primary key default gen_random_uuid()::text,
+  issuer text,
+  audience text,
+  subject text,
+  human_identity_claim jsonb not null,
+  provider_id text references agent_board.identity_providers(id),
+  agent_id uuid references agent_board.agents(id),
+  auth_user_id uuid,
+  requested_scopes text[],
+  granted_scopes text[],
+  enrolled_at timestamptz not null default now()
+);
+
+comment on table agent_board.enrollment_federation_audit is
+  'Append-only snapshot of the verified federated human identity claim at enrollment. Written only by enroll_federated_identity; read by no write-path RPC. No Portal session/MFA/liveness column exists by design.';
+
+create index if not exists idx_agent_board_enrollment_federation_audit_agent_id
+  on agent_board.enrollment_federation_audit(agent_id)
+  where agent_id is not null;
+
+alter table agent_board.enrollment_federation_audit enable row level security;
+
+drop policy if exists enrollment_federation_audit_deny_anon on agent_board.enrollment_federation_audit;
+create policy enrollment_federation_audit_deny_anon on agent_board.enrollment_federation_audit
+  as permissive for select to anon using (false);
+
+-- Scope the authenticated read to the OWNING principal (mirrors delegation_grants):
+-- the row carries human OIDC PII, and agent session tokens carry role 'authenticated',
+-- so `using (true)` would let any agent read every enrollee's identity. An agent may
+-- read only its own enrollment audit row.
+drop policy if exists enrollment_federation_audit_authenticated_read on agent_board.enrollment_federation_audit;
+create policy enrollment_federation_audit_authenticated_read on agent_board.enrollment_federation_audit
+  as permissive for select to authenticated using (agent_id = agent_board.current_agent_id());
+
+revoke all on agent_board.enrollment_federation_audit from public, anon, authenticated;
+grant select on agent_board.enrollment_federation_audit to authenticated;
+grant select, insert on agent_board.enrollment_federation_audit to service_role;

package/migrations/20260718001500_agent_board_enroll_federated_identity.sql

@@ -0,0 +1,220 @@
+-- MBFED SL-1 (Lane A): enroll_federated_identity — the fat enrollment RPC.
+--
+-- The /enroll Edge Function (supabase/functions/enroll) verifies the Portal OIDC
+-- RS256 signature and extracts the VERIFIED subject + human identity claim, then
+-- calls this RPC under a service_role client. ALL trust decisions live here (defense
+-- in depth — the DB re-gates even though the EF already verified):
+--   (i)   look up identity_providers by (issuer, audience);
+--   (ii)  reject unless the row exists AND supported AND policy_approved;
+--   (iii) reject unless kind <> 'system', kind in allowed_agent_kinds (when non-empty),
+--         requested_scopes ⊆ allowed_scopes, requested_board_scopes ⊆ allowed_board_scopes;
+--   (iv)  establish auth.users via agent_board._ensure_agent_auth_user(slug) — NOT
+--         provision_agent (whose _require_platform_admin_user_id gate the federated
+--         flow does not satisfy) — and upsert the agent the same way provision_agent does;
+--   (v)   insert one enrollment_federation_audit row (static claim snapshot).
+--
+-- Establishes auth.users AT ENROLLMENT ONLY and returns a board-native agent — never a
+-- Portal token. No Portal issuer/JWKS/URL is referenced here. service_role-only.
+-- Additive forward-only migration; writes no agent_board.schema_version (stays 8).
+
+create or replace function agent_board.enroll_federated_identity(
+  p_issuer text,
+  p_audience text,
+  p_subject text,
+  p_human_identity_claim jsonb,
+  p_slug text,
+  p_agent_kind text default 'agent',
+  p_requested_scopes text[] default '{}',
+  p_requested_board_scopes text[] default '{}'
+)
+returns table(
+  agent_id uuid,
+  auth_user_id uuid,
+  provider_id text,
+  granted_scopes text[]
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_slug text;
+  v_kind text;
+  v_provider agent_board.identity_providers%rowtype;
+  v_auth_user_id uuid;
+  v_agent agent_board.agents%rowtype;
+  v_requested_scopes text[] := coalesce(p_requested_scopes, '{}');
+  v_requested_board_scopes text[] := coalesce(p_requested_board_scopes, '{}');
+begin
+  -- service_role-only (defense in depth on top of the execute-grant revocation).
+  if not agent_board._is_service_role() then
+    raise exception 'service_role required for enroll_federated_identity' using errcode = '42501';
+  end if;
+
+  -- The EF always passes a cryptographically VERIFIED subject; a null subject here
+  -- would let the (issuer, subject) lookup below degenerate into a null-match and is
+  -- never legitimate. Reject it explicitly (defense in depth).
+  if p_subject is null then
+    raise exception 'verified subject is required' using errcode = '22023';
+  end if;
+
+  if p_human_identity_claim is null then
+    raise exception 'human identity claim is required' using errcode = '22023';
+  end if;
+
+  v_slug := agent_board._normalize_provision_slug(p_slug);
+  v_kind := lower(coalesce(trim(p_agent_kind), ''));
+
+  -- (i) allowlist lookup by (issuer, audience).
+  select *
+    into v_provider
+    from agent_board.identity_providers
+   where issuer = p_issuer
+     and audience = p_audience
+   limit 1;
+
+  -- (ii) provider must exist, be supported, and be policy-approved.
+  if v_provider.id is null then
+    raise exception 'issuer/audience not in the identity-provider allowlist' using errcode = '42501';
+  end if;
+  if not v_provider.supported then
+    raise exception 'identity provider is not supported' using errcode = '42501';
+  end if;
+  if not v_provider.policy_approved then
+    raise exception 'identity provider is not policy-approved' using errcode = '42501';
+  end if;
+
+  -- (iii) scope-ceiling + kind gate. 'system' is never federatable.
+  if v_kind = 'system' then
+    raise exception 'the system kind cannot be federated' using errcode = '42501';
+  end if;
+  if v_kind not in ('human', 'agent') then
+    raise exception 'agent kind must be human or agent' using errcode = '22023';
+  end if;
+  if array_length(v_provider.allowed_agent_kinds, 1) is not null
+     and not (v_kind = any (v_provider.allowed_agent_kinds)) then
+    raise exception 'agent kind % is outside the provider ceiling', v_kind using errcode = '42501';
+  end if;
+  if not (v_requested_scopes <@ v_provider.allowed_scopes) then
+    raise exception 'requested scopes exceed the provider allowed_scopes ceiling' using errcode = '42501';
+  end if;
+  if not (v_requested_board_scopes <@ v_provider.allowed_board_scopes) then
+    raise exception 'requested board scopes exceed the provider allowed_board_scopes ceiling' using errcode = '42501';
+  end if;
+
+  -- (iv) establish auth.users (idempotent) and upsert the agent keyed on the
+  -- cryptographically VERIFIED federation identity (issuer + p_subject), NOT the
+  -- client-supplied slug. This closes the confused-deputy / revoked-resurrection
+  -- hole: an approved-provider token can only ever land on the agent that ALREADY
+  -- belongs to that verified subject, and it can never re-activate a revoked handle
+  -- nor clobber an unrelated handle.
+  select *
+    into v_agent
+    from agent_board.agents a
+   where a.metadata -> 'federation' ->> 'issuer' = p_issuer
+     and a.metadata -> 'federation' ->> 'subject' = p_subject
+   limit 1
+   for update;
+
+  if v_agent.id is not null then
+    -- An agent already belongs to this verified (issuer, subject).
+    -- REFUSE reactivation of ANY non-active principal: enrollment must never reverse a
+    -- revocation cascade NOR reactivate an operator-suspended handle. The legacy
+    -- operator RPC revoke_agent (20260512000000) sets status='suspended', so guarding
+    -- only 'revoked' would let a suspended federated agent be silently reactivated via
+    -- /enroll. Refuse anything that is not already 'active' (revoked, suspended,
+    -- inactive, …); reactivation is an operator-only action.
+    if v_agent.status <> 'active' then
+      raise exception 'federated identity is % and cannot be reactivated by enrollment', v_agent.status
+        using errcode = '42501';
+    end if;
+
+    v_auth_user_id := coalesce(v_agent.auth_user_id, agent_board._ensure_agent_auth_user(v_agent.handle));
+
+    update agent_board.agents a
+       set agent_type = v_kind,
+           kind = v_kind::agent_board.agent_kind,
+           status = 'active',
+           auth_user_id = v_auth_user_id,
+           metadata = coalesce(a.metadata, '{}'::jsonb)
+             || jsonb_build_object(
+               'federation', jsonb_build_object(
+                 'issuer', p_issuer,
+                 'audience', p_audience,
+                 'subject', p_subject,
+                 'providerId', v_provider.id,
+                 'requestedScopes', to_jsonb(v_requested_scopes),
+                 'requestedBoardScopes', to_jsonb(v_requested_board_scopes),
+                 'enrolledAt', now()
+               )
+             ),
+           updated_at = now()
+     where a.id = v_agent.id
+     returning * into v_agent;
+  else
+    -- No agent is bound to this verified identity yet. Because the lookup above
+    -- already excluded the matching (issuer, subject), ANY agent that already holds
+    -- the requested slug is a DIFFERENT identity — refuse to clobber it (handle
+    -- takeover / confused-deputy guard).
+    if exists (select 1 from agent_board.agents a2 where a2.handle = v_slug) then
+      raise exception 'slug % is already bound to a different identity and cannot be clobbered by enrollment', v_slug
+        using errcode = '42501';
+    end if;
+
+    v_auth_user_id := agent_board._ensure_agent_auth_user(v_slug);
+
+    insert into agent_board.agents(
+      agent_type,
+      kind,
+      handle,
+      display_name,
+      status,
+      auth_user_id,
+      owner_user_id,
+      metadata
+    )
+    values (
+      v_kind,
+      v_kind::agent_board.agent_kind,
+      v_slug,
+      agent_board._default_provision_display_name(v_slug),
+      'active',
+      v_auth_user_id,
+      null,
+      jsonb_build_object(
+        'federation', jsonb_build_object(
+          'issuer', p_issuer,
+          'audience', p_audience,
+          'subject', p_subject,
+          'providerId', v_provider.id,
+          'requestedScopes', to_jsonb(v_requested_scopes),
+          'requestedBoardScopes', to_jsonb(v_requested_board_scopes),
+          'enrolledAt', now()
+        )
+      )
+    )
+    returning * into v_agent;
+  end if;
+
+  -- (v) one static claim-snapshot audit row (no Portal liveness signal).
+  insert into agent_board.enrollment_federation_audit(
+    issuer, audience, subject, human_identity_claim, provider_id,
+    agent_id, auth_user_id, requested_scopes, granted_scopes
+  )
+  values (
+    p_issuer, p_audience, p_subject, p_human_identity_claim, v_provider.id,
+    v_agent.id, v_auth_user_id, v_requested_scopes, v_requested_scopes
+  );
+
+  return query
+  select v_agent.id, v_auth_user_id, v_provider.id, v_requested_scopes;
+end;
+$$;
+
+comment on function agent_board.enroll_federated_identity(text, text, text, jsonb, text, text, text[], text[]) is
+  'Enrollment-only federated identity establishment: allowlist + policy_approved + scope-ceiling gate, auth.users via _ensure_agent_auth_user, agent upsert, and one enrollment_federation_audit row. service_role-only; returns a board-native agent, never a Portal token.';
+
+revoke all on function agent_board.enroll_federated_identity(text, text, text, jsonb, text, text, text[], text[])
+  from public, anon, authenticated;
+grant execute on function agent_board.enroll_federated_identity(text, text, text, jsonb, text, text, text[], text[])
+  to service_role;

package/migrations/20260719000100_agent_board_signing_challenge_pending_cap.sql

@@ -0,0 +1,124 @@
+-- MBHARDEN SL-1 (IF-0-MBHARDEN-1a): per-key pending-challenge cap on
+-- issue_signing_key_challenge.
+--
+-- Forward-only `create or replace`. Reproduces the 20260628000001 body verbatim
+-- and adds ONE new pre-insert guard: a hard cap of N=16 concurrently-pending
+-- (proof_state='pending', consumed_at is null, expires_at > now()) challenges per
+-- signing_key_id. The existing `for update` lock on the agent_signing_keys row
+-- serializes concurrent issuers for the same key, so the count is race-free. No
+-- existing success path changes: <=16 pending challenges still issue exactly as
+-- before; only the 17th concurrent pending challenge for one key is rejected.
+-- `create or replace` preserves the grants from 20260628000001; they are re-issued
+-- below for an explicit, self-contained frozen (authenticated, service_role) surface.
+create or replace function agent_board.issue_signing_key_challenge(
+  p_agent_id uuid,
+  p_key_id text,
+  p_expires_in interval default interval '5 minutes'
+)
+returns table (
+  challenge_id uuid,
+  agent_id uuid,
+  key_id text,
+  key_version integer,
+  fingerprint text,
+  challenge text,
+  expires_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_actor uuid;
+  v_key agent_board.agent_signing_keys%rowtype;
+  v_challenge_id uuid := gen_random_uuid();
+  v_nonce text := encode(extensions.gen_random_bytes(24), 'base64');
+  v_expires_at timestamptz;
+  v_pending integer;
+  -- Frozen pending-challenge cap per signing key (IF-0-MBHARDEN-1a). N=16.
+  c_pending_cap constant integer := 16;
+begin
+  if p_expires_in is null or p_expires_in <= interval '0 seconds' or p_expires_in > interval '15 minutes' then
+    raise exception 'challenge expiry must be between 0 and 15 minutes' using errcode = '22023';
+  end if;
+
+  v_actor := agent_board._resolved_actor_agent_id(p_agent_id, 'p_agent_id');
+
+  select *
+    into v_key
+    from agent_board.agent_signing_keys ask
+   where ask.agent_id = v_actor
+     and ask.key_id = p_key_id
+   for update;
+
+  if not found then
+    raise exception 'signing key not found' using errcode = 'P0002';
+  end if;
+  if v_key.status in ('revoked', 'compromised') then
+    raise exception 'key_revoked: signing key is revoked' using errcode = '22023';
+  end if;
+  if v_key.expires_at is not null and v_key.expires_at <= now() then
+    update agent_board.agent_signing_keys
+       set status = 'expired',
+           proof_state = 'expired',
+           updated_at = now()
+     where id = v_key.id;
+    raise exception 'key_expired: signing key is expired' using errcode = '22023';
+  end if;
+
+  -- Pending-challenge cap: reject once N=16 unexpired, unconsumed, still-pending
+  -- challenges already exist for this key. Serialized by the `for update` above.
+  select count(*)
+    into v_pending
+    from agent_board.agent_signing_key_challenges c
+   where c.signing_key_id = v_key.id
+     and c.proof_state = 'pending'
+     and c.consumed_at is null
+     and c.expires_at > now();
+
+  if v_pending >= c_pending_cap then
+    raise exception 'challenge_pending_cap: too many pending signing-key challenges for this key (max %)', c_pending_cap
+      using errcode = '22023';
+  end if;
+
+  v_expires_at := now() + p_expires_in;
+
+  insert into agent_board.agent_signing_key_challenges(
+    id,
+    signing_key_id,
+    agent_id,
+    challenge_nonce,
+    challenge_bytes,
+    expires_at,
+    metadata
+  )
+  values (
+    v_challenge_id,
+    v_key.id,
+    v_actor,
+    v_nonce,
+    'agent-signing-key-proof.v1:' || v_challenge_id::text || ':' || v_nonce,
+    v_expires_at,
+    jsonb_build_object('keyId', v_key.key_id, 'keyVersion', v_key.key_version)
+  );
+
+  update agent_board.agent_signing_keys
+     set proof_state = 'challenge_issued',
+         updated_at = now()
+   where id = v_key.id
+     and proof_state <> 'proven';
+
+  return query
+  select
+    v_challenge_id,
+    v_actor,
+    v_key.key_id,
+    v_key.key_version,
+    v_key.fingerprint,
+    'agent-signing-key-proof.v1:' || v_challenge_id::text || ':' || v_nonce,
+    v_expires_at;
+end;
+$$;
+
+revoke all on function agent_board.issue_signing_key_challenge(uuid, text, interval) from public, anon;
+grant execute on function agent_board.issue_signing_key_challenge(uuid, text, interval) to authenticated, service_role;

package/migrations/20260719000200_agent_board_signing_challenge_reaper.sql

@@ -0,0 +1,34 @@
+-- MBHARDEN SL-1 (IF-0-MBHARDEN-1b): expired signing-key-challenge reaper.
+--
+-- Additive, forward-only. Mirrors reap_expired_nonfleet_sessions
+-- (20260718000700): security definer, service_role-only, deletes-and-counts.
+-- Deletes agent_signing_key_challenges rows whose expires_at is older than
+-- p_older_than (default 7 days) and returns the affected count. Unexpired rows
+-- (expires_at within the grace) are never touched. Scheduling (pg_cron / external
+-- cadence) is a deferred owner; the callable function is in-scope.
+create or replace function agent_board.reap_expired_signing_key_challenges(
+  p_older_than interval default interval '7 days'
+)
+returns bigint
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_count bigint;
+begin
+  with deleted as (
+    delete from agent_board.agent_signing_key_challenges c
+     where c.expires_at < now() - coalesce(p_older_than, interval '7 days')
+    returning 1
+  )
+  select count(*) into v_count from deleted;
+  return v_count;
+end;
+$$;
+
+comment on function agent_board.reap_expired_signing_key_challenges(interval) is
+  'Deletes agent_signing_key_challenges rows expired older than p_older_than (default 7 days); returns the affected count. service_role-only.';
+
+revoke all on function agent_board.reap_expired_signing_key_challenges(interval) from public, anon, authenticated;
+grant execute on function agent_board.reap_expired_signing_key_challenges(interval) to service_role;

package/migrations/20260719000300_agent_board_enroll_rate_cap.sql

@@ -0,0 +1,72 @@
+-- MBHARDEN SL-1 (IF-0-MBHARDEN-1d): standalone /enroll per-source rate cap.
+--
+-- Additive, forward-only. /enroll is verify_jwt=false and creates NO
+-- pre-verification rows, so there is no pending set to bound (unlike the challenge
+-- path). DoS/amplification is instead bounded by a standalone per-source rolling
+-- rate cap: a counter table + a check_and_bump function.
+--
+-- MECHANISM ONLY (Execution Notes): this migration delivers a proven, callable
+-- cap. Its request-path call-site lives in supabase/functions/enroll/index.ts,
+-- which MBHARDEN must NOT touch (writer partition). Wiring the cap into the
+-- /enroll request path is delivered by MBPORTALGATE (which owns index.ts) or is an
+-- operational step. check_and_bump_enroll_rate is therefore intentionally
+-- not-yet-called by request code — it is NOT dead code.
+create table if not exists agent_board.enroll_rate_events (
+  id uuid primary key default gen_random_uuid(),
+  source text not null,
+  created_at timestamptz not null default now()
+);
+
+comment on table agent_board.enroll_rate_events is
+  'Per-source rolling-window rate-cap events for the verify_jwt=false /enroll surface. Mechanism only; request-path wiring is deferred to the index.ts owner.';
+
+create index if not exists idx_agent_board_enroll_rate_events_source_created
+  on agent_board.enroll_rate_events(source, created_at desc);
+
+-- Returns true and records an event when the source is under p_limit within the
+-- rolling p_window; returns false (and records NOTHING) once the source is at/over
+-- the cap. Rejecting without recording keeps an attacker from growing the table
+-- past the cap and fails closed. Approximate under high concurrency (no per-source
+-- lock) — acceptable for a coarse DoS cap.
+create or replace function agent_board.check_and_bump_enroll_rate(
+  p_source text,
+  p_limit integer,
+  p_window interval
+)
+returns boolean
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_count integer;
+begin
+  if p_source is null or length(p_source) = 0 then
+    raise exception 'enroll rate source must be non-empty' using errcode = '22023';
+  end if;
+  if p_limit is null or p_limit < 0 then
+    raise exception 'enroll rate limit must be non-negative' using errcode = '22023';
+  end if;
+
+  select count(*)
+    into v_count
+    from agent_board.enroll_rate_events e
+   where e.source = p_source
+     and e.created_at > now() - coalesce(p_window, interval '1 minute');
+
+  if v_count >= p_limit then
+    return false;
+  end if;
+
+  insert into agent_board.enroll_rate_events(source) values (p_source);
+  return true;
+end;
+$$;
+
+comment on function agent_board.check_and_bump_enroll_rate(text, integer, interval) is
+  'Rolling per-source rate cap for /enroll: records+allows while under p_limit in p_window, rejects (without recording) at/over the cap. service_role-only. Mechanism only; wiring deferred.';
+
+revoke all on function agent_board.check_and_bump_enroll_rate(text, integer, interval) from public, anon, authenticated;
+grant execute on function agent_board.check_and_bump_enroll_rate(text, integer, interval) to service_role;
+
+grant select, insert on agent_board.enroll_rate_events to service_role;

package/migrations/20260719001000_agent_board_identity_providers_portal_contract.sql

@@ -0,0 +1,38 @@
+-- MBPORTALGATE SL-1 (IF-0-MBPORTALGATE-1/2/6): freeze the real Portal token contract
+-- as config on the identity_providers allowlist.
+--
+-- Two forward-only, additive changes:
+--   (1) add an `actor_claim text` column (default 'act.sub') — names the verified OIDC
+--       claim the /enroll EF reads as the delegated actor (audit-only; never a trust
+--       decision). Mirrors subject_claim (added 20260718001300). Backfills the
+--       pre-existing mock row harmlessly (it is inert).
+--   (2) seed the REAL Portal identity_providers row INERT:
+--         issuer   = https://portal.consiliency.io
+--         audience = https://message-board.consiliency.io   (RFC 8707 resource; the
+--                    frozen resource-audience constant — byte-identical across the EF
+--                    ENROLL_AUDIENCE env, this seed row, and the client `resource=`)
+--         subject_claim = 'sub', actor_claim = 'act.sub'
+--         supported = true, policy_approved = FALSE   (INERT until the operational flip)
+--
+-- No provider ships policy_approved=true. Flipping the real Portal issuer to
+-- policy_approved and wiring its real JWKS URL is the OPERATIONAL step (E1/E2 external
+-- Portal gates; see plans/MBPORTAL-GATE-DECISION.md). The mock issuer row
+-- (https://mock-portal.test) is left untouched.
+--
+-- Additive forward-only migration; writes no agent_board.schema_version (stays 8).
+
+-- (1) actor_claim column — forward-only, default 'act.sub'.
+alter table agent_board.identity_providers
+  add column if not exists actor_claim text not null default 'act.sub';
+
+comment on column agent_board.identity_providers.actor_claim is
+  'Verified OIDC claim naming the delegated actor (default act.sub). Audit-only: read by the /enroll EF into the enrollment audit; never a trust decision.';
+
+-- (2) seed the real Portal row, INERT (policy_approved = false). Idempotent.
+insert into agent_board.identity_providers
+  (issuer, audience, supported, policy_approved,
+   allowed_scopes, allowed_board_scopes, allowed_agent_kinds, subject_claim, actor_claim)
+values
+  ('https://portal.consiliency.io', 'https://message-board.consiliency.io', true, false,
+   '{board:send,board:read}', '{}', '{agent,human}', 'sub', 'act.sub')
+on conflict (issuer, audience) do nothing;