@consiliency/agent-board-schema 1.3.0 → 1.5.0

package/tests/agent_board_agent_lineage.test.sql

@@ -0,0 +1,73 @@
+-- MBAUTHZ SL-3 (Lane C) pgTAP: agents.parent_agent_id / root_agent_id and the
+-- owner-consistency trigger.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(8);
+
+create temp table _lineage_fixture (
+  root_agent uuid,
+  root_user uuid,
+  other_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_root_user uuid;
+  v_other_user uuid;
+  v_root uuid := gen_random_uuid();
+begin
+  v_root_user := public.ensure_github_user('lin-root-' || v_suffix, 'lin-root-' || v_suffix || '@example.test', 'lin-root-' || v_suffix, 'LIN Root');
+  v_other_user := public.ensure_github_user('lin-other-' || v_suffix, 'lin-other-' || v_suffix || '@example.test', 'lin-other-' || v_suffix, 'LIN Other');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_root, 'agent', 'lin-root-' || v_suffix, 'LIN Root', 'active', v_root_user, v_root_user);
+
+  insert into _lineage_fixture values (v_root, v_root_user, v_other_user);
+end
+$$;
+
+-- Structure -----------------------------------------------------------------
+select has_column('agent_board', 'agents', 'parent_agent_id', 'agents has parent_agent_id');
+select has_column('agent_board', 'agents', 'root_agent_id', 'agents has root_agent_id');
+select col_type_is('agent_board', 'agents', 'parent_agent_id', 'uuid', 'parent_agent_id is uuid');
+select fk_ok('agent_board', 'agents', 'parent_agent_id', 'agent_board', 'agents', 'id',
+  'parent_agent_id references agents(id)');
+select fk_ok('agent_board', 'agents', 'root_agent_id', 'agent_board', 'agents', 'id',
+  'root_agent_id references agents(id)');
+
+-- Owner-consistency trigger -------------------------------------------------
+-- Child whose owner_user_id differs from its root's owner is rejected.
+select throws_ok(
+  (select format(
+     $q$insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id, parent_agent_id, root_agent_id)
+        values (gen_random_uuid(), 'agent', %L, 'LIN Bad Child', 'active', %L::uuid, %L::uuid, %L::uuid)$q$,
+     'lin-badchild-' || gen_random_uuid()::text, other_user, root_agent, root_agent)
+   from _lineage_fixture),
+  '23514', null,
+  'trigger rejects a parented agent whose owner differs from its root');
+
+-- Child whose owner matches its root's owner is allowed.
+select lives_ok(
+  (select format(
+     $q$insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id, parent_agent_id, root_agent_id)
+        values (gen_random_uuid(), 'agent', %L, 'LIN Good Child', 'active', %L::uuid, %L::uuid, %L::uuid)$q$,
+     'lin-goodchild-' || gen_random_uuid()::text, root_user, root_agent, root_agent)
+   from _lineage_fixture),
+  'trigger allows a parented agent whose owner matches its root');
+
+-- Unparented agent (NULL lineage) is unaffected regardless of owner.
+select lives_ok(
+  (select format(
+     $q$insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+        values (gen_random_uuid(), 'agent', %L, 'LIN Orphan', 'active', %L::uuid)$q$,
+     'lin-orphan-' || gen_random_uuid()::text, other_user)
+   from _lineage_fixture),
+  'unparented agent with NULL lineage is unaffected by the trigger');
+
+select finish();
+
+rollback;

package/tests/agent_board_agents_status_revoked.test.sql

@@ -0,0 +1,60 @@
+-- MBDELEG SL-1 pgTAP (IF-0-MBDELEG-1): agents.status admits 'revoked'.
+--
+-- Proves the CHECK-extension at 20260718000900 accepts the 4th literal 'revoked'
+-- alongside the 3 legacy literals, rejects an unknown literal, and that a write of
+-- status='revoked' (as the cascade performs) no longer throws check_violation.
+--
+-- Runs as postgres (service_role-equivalent).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(6);
+
+create temp table _srv_fx (a_upd uuid) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_upd uuid := gen_random_uuid();
+begin
+  -- Seed one agent to update to 'revoked' below.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status)
+  values (v_upd, 'agent', 'srv-upd-'||s, 'SRV-UPD', 'active');
+  insert into _srv_fx values (v_upd);
+end
+$$;
+
+-- Insert-side acceptance of each literal (distinct handles).
+select lives_ok(
+  $q$insert into agent_board.agents(agent_type, handle, display_name, status)
+     values ('agent', 'srv-active-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), 'A', 'active')$q$,
+  'agents.status accepts legacy literal ''active''');
+select lives_ok(
+  $q$insert into agent_board.agents(agent_type, handle, display_name, status)
+     values ('agent', 'srv-inactive-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), 'I', 'inactive')$q$,
+  'agents.status accepts legacy literal ''inactive''');
+select lives_ok(
+  $q$insert into agent_board.agents(agent_type, handle, display_name, status)
+     values ('agent', 'srv-suspended-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), 'S', 'suspended')$q$,
+  'agents.status accepts legacy literal ''suspended''');
+select lives_ok(
+  $q$insert into agent_board.agents(agent_type, handle, display_name, status)
+     values ('agent', 'srv-revoked-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), 'R', 'revoked')$q$,
+  'agents.status accepts the new literal ''revoked''');
+
+-- An unknown literal is rejected by agents_status_check.
+select throws_ok(
+  $q$insert into agent_board.agents(agent_type, handle, display_name, status)
+     values ('agent', 'srv-bogus-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), 'B', 'bogus')$q$,
+  '23514', null, 'agents.status rejects an unknown literal (check_violation)');
+
+-- A subtree write of status='revoked' (what the cascade performs) succeeds.
+select lives_ok(
+  (select format($q$update agent_board.agents set status = 'revoked' where id = %L::uuid$q$, a_upd) from _srv_fx),
+  'updating an existing agent to status=''revoked'' no longer throws check_violation');
+
+select finish();
+
+rollback;

package/tests/agent_board_auth_rpcs.test.sql

@@ -155,13 +155,15 @@ begin
 
   v_previous_credential_id := v_agent_one.credential_id;
 
-  select *
-    into v_rotated
-    from agent_board.rotate_agent_token(v_agent_one.agent_id);
-
-  if v_rotated.replaces_credential_id is distinct from v_previous_credential_id then
-    raise exception 'rotate_agent_token did not record replaces_credential_id';
-  end if;
+  -- MBDELEG (20260718001200): the 30-day refresh-token exchange is retired.
+  -- rotate_agent_token now raises 0A000; session refresh is re-signing
+  -- (PoP -> mint_fleet_agent_session), not a refresh-token rotation.
+  begin
+    perform * from agent_board.rotate_agent_token(v_agent_one.agent_id);
+    raise exception 'rotate_agent_token unexpectedly succeeded (should be deprecated)';
+  exception
+    when sqlstate '0A000' then null;
+  end;
 
   select *
     into v_revoked
@@ -263,12 +265,11 @@ $$;
 
 select pass('AUTHRPC preserved the service_role callback-runtime path');
 
--- portal#203 (defense in depth): rotate_agent_token routes through the same
--- _issue_agent_credential choke point, so a pre-existing system principal must
--- also fail closed on rotation. Create one directly (provision_agent now rejects
--- system) and assert rotation raises and mints nothing. Run as the superuser so
--- the direct agents insert is permitted; rotate_agent_token still bypasses the
--- platform-admin gate for a service/superuser caller, so the guard is exercised.
+-- portal#203 + MBDELEG (20260718001200, defense in depth): rotate_agent_token is
+-- now deprecated and raises 0A000 for ALL callers (session refresh is re-signing),
+-- which subsumes the earlier system-principal fail-closed path. A pre-existing
+-- system principal must still get no credential from rotation. Create one directly
+-- (provision_agent rejects system) and assert rotation raises 0A000 and mints nothing.
 reset role;
 do $$
 declare
@@ -288,12 +289,12 @@ begin
     perform * from agent_board.rotate_agent_token(v_system_agent_id);
     raise exception 'rotate_agent_token unexpectedly succeeded for a system principal';
   exception
-    when sqlstate '22023' then
+    when sqlstate '0A000' then
       v_raised := true;
   end;
 
   if not v_raised then
-    raise exception 'rotate_agent_token did not fail closed with sqlstate 22023 for a system principal';
+    raise exception 'rotate_agent_token did not fail closed with sqlstate 0A000 (deprecated) for a system principal';
   end if;
 
   if exists (
@@ -304,7 +305,7 @@ begin
 end
 $$;
 
-select pass('AUTHRPC rotate_agent_token also fails closed for system principals');
+select pass('AUTHRPC rotate_agent_token is deprecated (0A000) and mints no credential');
 
 select finish();
 

package/tests/agent_board_board_role.test.sql

@@ -0,0 +1,129 @@
+-- MBAUTHZ SL-1 (Lane A) pgTAP: board_memberships.role, boards.role_gate_enforced,
+-- and the role gate on invite_board_member/resolve_board_request.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(13);
+
+create temp table _board_role_fixture (
+  board uuid,
+  creator_agent uuid,
+  member_agent uuid,
+  admin_agent uuid,
+  target_agent uuid,
+  other_agent uuid,
+  creator_user uuid,
+  member_user uuid,
+  admin_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_creator_user uuid;
+  v_member_user uuid;
+  v_admin_user uuid;
+  v_creator uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_admin uuid := gen_random_uuid();
+  v_target uuid := gen_random_uuid();
+  v_other uuid := gen_random_uuid();
+  v_board uuid;
+begin
+  v_creator_user := public.ensure_github_user('br-creator-' || v_suffix, 'br-creator-' || v_suffix || '@example.test', 'br-creator-' || v_suffix, 'BR Creator');
+  v_member_user := public.ensure_github_user('br-member-' || v_suffix, 'br-member-' || v_suffix || '@example.test', 'br-member-' || v_suffix, 'BR Member');
+  v_admin_user := public.ensure_github_user('br-admin-' || v_suffix, 'br-admin-' || v_suffix || '@example.test', 'br-admin-' || v_suffix, 'BR Admin');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_creator, 'agent', 'br-creator-' || v_suffix, 'BR Creator', 'active', v_creator_user, v_creator_user),
+    (v_member, 'agent', 'br-member-' || v_suffix, 'BR Member', 'active', v_member_user, v_member_user),
+    (v_admin, 'agent', 'br-admin-' || v_suffix, 'BR Admin', 'active', v_admin_user, v_admin_user),
+    (v_target, 'agent', 'br-target-' || v_suffix, 'BR Target', 'active', null, null),
+    (v_other, 'agent', 'br-other-' || v_suffix, 'BR Other', 'active', null, null);
+
+  select board_id into v_board
+    from agent_board.create_board(v_creator, 'br-board-' || v_suffix, 'BR Board', 'board role test', '{}'::jsonb, 'private');
+
+  -- The creator's owner membership is now seeded by create_board (ROOMOWN). The
+  -- `other` membership is inserted with the column DEFAULT (member) to exercise the
+  -- one-time backfill; member/admin get explicit roles for gate tests.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id)
+  values
+    (v_board, v_other, 'joined', v_creator);
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_member, 'joined', v_creator, 'member'),
+    (v_board, v_admin, 'joined', v_creator, 'admin');
+
+  insert into _board_role_fixture values
+    (v_board, v_creator, v_member, v_admin, v_target, v_other, v_creator_user, v_member_user, v_admin_user);
+end
+$$;
+
+-- Structure -----------------------------------------------------------------
+select has_column('agent_board', 'board_memberships', 'role', 'board_memberships has role column');
+select col_type_is('agent_board', 'board_memberships', 'role', 'text', 'role is text');
+select col_has_check('agent_board', 'board_memberships', 'role', 'role is check-constrained');
+select has_column('agent_board', 'boards', 'role_gate_enforced', 'boards has role_gate_enforced flag');
+select col_type_is('agent_board', 'boards', 'role_gate_enforced', 'boolean', 'role_gate_enforced is boolean');
+
+-- Default behavior (member membership above was inserted without role) -------
+select is(
+  (select role from agent_board.board_memberships bm join _board_role_fixture f on bm.agent_id = f.member_agent and bm.board_id = f.board),
+  'member', 'explicit member role persists');
+
+-- One-time backfill: creator membership -> owner; other membership -> member.
+update agent_board.board_memberships bm
+   set role = 'owner'
+  from agent_board.boards b
+ where bm.board_id = b.id
+   and bm.agent_id = b.created_by_agent_id
+   and bm.role <> 'owner';
+
+select is(
+  (select role from agent_board.board_memberships bm join _board_role_fixture f on bm.agent_id = f.creator_agent and bm.board_id = f.board),
+  'owner', 'backfill sets creator membership role to owner');
+select is(
+  (select role from agent_board.board_memberships bm join _board_role_fixture f on bm.agent_id = f.other_agent and bm.board_id = f.board),
+  'member', 'backfill leaves non-creator membership as member');
+
+-- Gate: flag=false (default) preserves any-active-member behavior ------------
+-- Non-creator member (role member) may invite when the flag is off.
+select set_config('request.jwt.claim.sub', (select member_user from _board_role_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target_agent, creator_agent) from _board_role_fixture),
+  'flag off: active member (role member) may invite');
+
+-- Service_role / null actor (no agent maps to this sub) bypasses.
+select set_config('request.jwt.claim.sub', gen_random_uuid()::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target_agent, creator_agent) from _board_role_fixture),
+  'flag off: service_role/null actor may invite');
+
+-- Gate: flag=true requires owner/admin ---------------------------------------
+update agent_board.boards set role_gate_enforced = true
+ where id = (select board from _board_role_fixture);
+
+select set_config('request.jwt.claim.sub', (select member_user from _board_role_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target_agent, creator_agent) from _board_role_fixture),
+  '42501', null,
+  'flag on: role member actor is denied invite');
+
+select set_config('request.jwt.claim.sub', (select admin_user from _board_role_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target_agent, creator_agent) from _board_role_fixture),
+  'flag on: role admin actor may invite');
+
+-- Service_role / null actor still bypasses even with the flag on.
+select set_config('request.jwt.claim.sub', gen_random_uuid()::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target_agent, creator_agent) from _board_role_fixture),
+  'flag on: service_role/null actor still bypasses');
+
+select finish();
+
+rollback;

package/tests/agent_board_bundle_endpoint_compat.test.sql

@@ -22,15 +22,27 @@ select ok(has_function_privilege('service_role',
 -- before any install: not ready, schema version still reported
 select is((agent_board.get_bundle_compatibility() ->> 'ready'), 'false',
   'not ready before materializer records an install');
-select is((agent_board.get_bundle_compatibility() ->> 'schema_version'), '7',
-  'compatibility reports schema version 7');
+select is((agent_board.get_bundle_compatibility() ->> 'schema_version'), '8',
+  'compatibility reports schema version 8');
 
--- signed-write enforcement posture is active (canary revoked direct writes)
+-- Post-MBSESSION the 8 core sends are re-granted to authenticated, so the LIVE
+-- baseline posture is signed_write_enforced=false. Exercise BOTH branches in this
+-- rolled-back txn. Enforced branch: revoke EXECUTE from authenticated on ALL
+-- eight gated-write overloads (the probe checks by routine name, so any single
+-- remaining overload grant keeps enforcement false) -> reports active=true.
+revoke execute on function agent_board.send_direct_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.send_direct_message(uuid, uuid, jsonb, text, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.send_multicast_message(uuid, uuid, uuid[], text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.send_multicast_message(uuid, uuid, jsonb, text, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.post_board_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.post_board_message(uuid, uuid, text, text, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.create_tasking_delivery(uuid, uuid, text, text, uuid[], uuid, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.create_tasking_delivery(uuid, uuid, text, text, jsonb, text, text, text, text, text, jsonb) from authenticated;
 select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'true',
-  'signed-write enforcement is reported active');
+  'signed-write enforcement reports active when all gated write RPCs are revoked from authenticated');
 
--- probe covers ALL four gated RPCs: re-granting EXECUTE on one of the OTHER
--- three (not send_direct_message) must flip enforcement to false.
+-- Re-grant branch: re-granting EXECUTE on any one gated write RPC (as MBSESSION
+-- does at 20260718000800) flips enforcement back to false.
 grant execute on function agent_board.send_multicast_message(uuid, uuid, uuid[], text, text, text, text, text, jsonb) to authenticated;
 select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'false',
   'enforcement flips to false when any gated write RPC is re-granted to authenticated');

package/tests/agent_board_canary_signed_fleet_enforcement.test.sql

@@ -14,8 +14,8 @@ select function_privs_are(
   'send_direct_message',
   array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
   'authenticated',
-  array[]::text[],
-  'authenticated cannot bypass direct signed gateway'
+  array['EXECUTE'],
+  'authenticated may execute direct scoped send on the MBSESSION re-granted path'
 );
 
 select function_privs_are(
@@ -23,8 +23,8 @@ select function_privs_are(
   'send_multicast_message',
   array['uuid','uuid','uuid[]','text','text','text','text','text','jsonb'],
   'authenticated',
-  array[]::text[],
-  'authenticated cannot bypass multicast signed gateway'
+  array['EXECUTE'],
+  'authenticated may execute multicast scoped send on the MBSESSION re-granted path'
 );
 
 select function_privs_are(
@@ -32,8 +32,8 @@ select function_privs_are(
   'post_board_message',
   array['uuid','uuid','uuid','text','text','text','text','text','jsonb'],
   'authenticated',
-  array[]::text[],
-  'authenticated cannot bypass board signed gateway'
+  array['EXECUTE'],
+  'authenticated may execute board scoped send on the MBSESSION re-granted path'
 );
 
 select function_privs_are(
@@ -41,8 +41,8 @@ select function_privs_are(
   'create_tasking_delivery',
   array['uuid','uuid','text','text','uuid[]','uuid','text','text','text','jsonb'],
   'authenticated',
-  array[]::text[],
-  'authenticated cannot bypass tasking signed gateway'
+  array['EXECUTE'],
+  'authenticated may execute tasking scoped send on the MBSESSION re-granted path'
 );
 
 select ok(

package/tests/agent_board_delegation_enforcement.test.sql

@@ -0,0 +1,175 @@
+-- MBDELEG SL-1 pgTAP (IF-0-MBDELEG-2): bounded root-minted delegation spinoff.
+--
+-- Proves mint_delegated_child mints ONLY under the full bound set (mode=root_minted,
+-- policy unrevoked, root principal active, requested ⊆ allowed_scopes, true lineage
+-- root, max_active_children) and rejects each violation with no child/grant; that a
+-- minted child gets a revocable ephemeral signing key; and that renew_delegated_grant
+-- extends while the root is active but raises once the root is revoked/inactive (a
+-- grant cannot outlive the root's authority).
+--
+-- Runs as postgres (service_role-equivalent).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(18);
+
+create temp table _deleg_fx (
+  owner_id uuid, r1 uuid, r2 uuid, r3 uuid,
+  child_a uuid, child_b uuid, exp_a timestamptz,
+  slug_c text, ca_pubkey text
+) on commit drop;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  u_owner uuid; u_r1 uuid; u_r2 uuid; u_r3 uuid;
+  v_r1 uuid := gen_random_uuid(); v_r2 uuid := gen_random_uuid(); v_r3 uuid := gen_random_uuid();
+  v_pol1 uuid := gen_random_uuid(); v_pol2 uuid := gen_random_uuid(); v_pol3 uuid := gen_random_uuid();
+  v_ca uuid; v_cb uuid; v_exp_a timestamptz;
+  -- Real (random) 43-char base64url Ed25519 public keys, generated caller-side.
+  v_ca_pubkey text := rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+  v_cb_pubkey text := rtrim(translate(encode(extensions.gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+begin
+  u_owner := public.ensure_github_user('deleg-own-'||s, 'deleg-own-'||s||'@example.test', 'deleg-own-'||s, 'OWN');
+  u_r1 := public.ensure_github_user('deleg-r1-'||s, 'deleg-r1-'||s||'@example.test', 'deleg-r1-'||s, 'R1');
+  u_r2 := public.ensure_github_user('deleg-r2-'||s, 'deleg-r2-'||s||'@example.test', 'deleg-r2-'||s, 'R2');
+  u_r3 := public.ensure_github_user('deleg-r3-'||s, 'deleg-r3-'||s||'@example.test', 'deleg-r3-'||s, 'R3');
+
+  -- Root R1: root_minted policy, allowed_scopes=[a,b], ceiling 8h, max 2 children.
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_r1, 'agent', 'deleg-r1-'||s, 'R1', 'active', u_r1, u_owner);
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, max_depth, max_active_children, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_pol1, v_r1, 'root_minted', 1, 2, jsonb_build_array('scope:a', 'scope:b'), interval '8 hours', true);
+
+  -- Root R2: independent_auth policy (opts out of root-minted spinoff).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_r2, 'agent', 'deleg-r2-'||s, 'R2', 'active', u_r2, u_owner);
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes, child_ttl_ceiling)
+  values (v_pol2, v_r2, 'independent_auth', jsonb_build_array('scope:a'), interval '8 hours');
+
+  -- Root R3: root_minted, uncapped, require_child_signing_key -> used for the
+  -- malformed-public-key rejection (reaches the key-enrollment step).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_r3, 'agent', 'deleg-r3-'||s, 'R3', 'active', u_r3, u_owner);
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes, child_ttl_ceiling, require_child_signing_key)
+  values (v_pol3, v_r3, 'root_minted', jsonb_build_array('scope:a'), interval '8 hours', true);
+
+  -- Happy child-a (scope:a), enrolling the caller-supplied public key. Grant #1.
+  select child_agent_id, grant_expires_at into v_ca, v_exp_a
+    from agent_board.mint_delegated_child(v_r1, 'deleg-ca-'||s, jsonb_build_array('scope:a'), v_ca_pubkey);
+
+  -- Give child-a its own root_minted policy so the no-transitive (max_depth) guard is
+  -- exercised directly (parent_agent_id is not null), not merely the missing-policy path.
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes, child_ttl_ceiling)
+  values (gen_random_uuid(), v_ca, 'root_minted', jsonb_build_array('scope:a'), interval '8 hours');
+
+  -- ttl-cap child-b: request 30 days, must be capped at the 8h ceiling. Grant #2.
+  select child_agent_id into v_cb
+    from agent_board.mint_delegated_child(v_r1, 'deleg-cb-'||s, jsonb_build_array('scope:a'), v_cb_pubkey, interval '30 days');
+
+  insert into _deleg_fx values (u_owner, v_r1, v_r2, v_r3, v_ca, v_cb, v_exp_a, 'deleg-cc-'||s, v_ca_pubkey);
+end
+$$;
+
+-- Function existence.
+select has_function('agent_board', 'mint_delegated_child', array['uuid','text','jsonb','text','interval'], 'mint_delegated_child exists');
+select has_function('agent_board', 'renew_delegated_grant', array['uuid','interval'], 'renew_delegated_grant exists');
+
+-- Happy mint: grant row shape.
+select is(
+  (select count(*)::int from agent_board.delegation_grants g
+    where g.child_agent_id = (select child_a from _deleg_fx)
+      and g.root_agent_id = (select r1 from _deleg_fx)
+      and g.parent_agent_id = (select r1 from _deleg_fx)
+      and g.revoked_at is null),
+  1, 'happy mint inserted exactly one live grant (root=parent=R1) for child-a');
+
+-- Happy mint: child provisioned lineage-parented under the root, same owner, active.
+select is(
+  (select a.parent_agent_id = (select r1 from _deleg_fx)
+       and a.root_agent_id = (select r1 from _deleg_fx)
+       and a.owner_user_id = (select owner_id from _deleg_fx)
+       and a.status = 'active'
+     from agent_board.agents a where a.id = (select child_a from _deleg_fx)),
+  true, 'minted child is parented under the root, shares owner_user_id, and is active');
+
+-- Happy mint: revocable ephemeral signing key enrolled for the child.
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k
+    where k.agent_id = (select child_a from _deleg_fx)
+      and k.key_id = 'delegated-ephemeral'
+      and k.status = 'active' and k.revoked_at is null),
+  1, 'minted child got exactly one active revocable ephemeral signing key');
+
+-- #5: the enrolled key is the EXACT caller-supplied public key (no placeholder).
+select is(
+  (select public_key from agent_board.agent_signing_keys k
+    where k.agent_id = (select child_a from _deleg_fx) and k.key_id = 'delegated-ephemeral'),
+  (select ca_pubkey from _deleg_fx),
+  'minted child enrolls the caller-supplied Ed25519 public key verbatim (no placeholder/zero key)');
+
+-- #5: a malformed/short public key is rejected at the key-enrollment step (R3 has
+-- capacity + require_child_signing_key, so all prior gates pass).
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'), %L)$q$,
+     r3, 'deleg-bad-'||replace(substr(gen_random_uuid()::text,1,8),'-',''), repeat('A',20)) from _deleg_fx),
+  '22023', null, 'mint rejects a malformed/short child public key (#5)');
+
+-- Scope-exceed: scope:c is not a subset of allowed [a,b].
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:c'))$q$,
+     r1, 'deleg-cx-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _deleg_fx),
+  '42501', null, 'mint rejects a requested scope outside allowed_scopes (scope-exceed)');
+
+-- Scope-exceed minted nothing: no grant beyond the two live ones for R1.
+select is(
+  (select count(*)::int from agent_board.delegation_grants g
+    where g.root_agent_id = (select r1 from _deleg_fx) and g.revoked_at is null),
+  2, 'the two successful mints are the only live grants (scope-exceed created none)');
+
+-- ttl-cap: child-b grant_expires_at is capped at the 8h ceiling (not 30 days).
+select ok(
+  (select g.grant_expires_at <= now() + interval '8 hours' + interval '1 minute'
+     from agent_board.delegation_grants g where g.child_agent_id = (select child_b from _deleg_fx)),
+  'a 30-day TTL request is capped at the 8h child_ttl_ceiling (outlive-by-ttl blocked)');
+
+-- independent_auth: mode is not root_minted => reject.
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'))$q$,
+     r2, 'deleg-cy-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _deleg_fx),
+  '42501', null, 'mint rejects an independent_auth root (self-provisioning, not root-minted)');
+
+-- No-transitive (max_depth=1): a root_minted child (parent_agent_id not null) cannot mint.
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'))$q$,
+     child_a, 'deleg-gc-'||replace(substr(gen_random_uuid()::text,1,8),'-','')) from _deleg_fx),
+  '42501', null, 'mint rejects a transitive attempt from a delegated child (max_depth=1)');
+
+-- Over-fan-out: R1 already has 2 live grants (max_active_children=2) => reject the 3rd.
+select throws_ok(
+  (select format($q$select agent_board.mint_delegated_child(%L::uuid, %L, jsonb_build_array('scope:a'))$q$,
+     r1, slug_c) from _deleg_fx),
+  '42501', null, 'mint rejects the (N+1)th child when max_active_children=N (over-fan-out)');
+
+-- Renew works while the root is active + unrevoked (child works for hours).
+select lives_ok(
+  (select format($q$select agent_board.renew_delegated_grant(%L::uuid)$q$, child_a) from _deleg_fx),
+  'renew_delegated_grant extends the grant while the root is active');
+select ok(
+  (select g.last_renewed_at is not null and g.grant_expires_at > now()
+     from agent_board.delegation_grants g where g.child_agent_id = (select child_a from _deleg_fx)),
+  'renew stamped last_renewed_at and pushed grant_expires_at into the future');
+
+-- Revoke the root's authority: suspend R1, then renew must raise (grant cannot outlive root).
+select lives_ok(
+  (select format($q$update agent_board.agents set status = 'suspended' where id = %L::uuid$q$, r1) from _deleg_fx),
+  'suspend the root R1');
+select throws_ok(
+  (select format($q$select agent_board.renew_delegated_grant(%L::uuid)$q$, child_a) from _deleg_fx),
+  '42501', null, 'renew raises once the root is inactive (grant cannot outlive root authority)');
+
+select finish();
+
+rollback;