@consiliency/agent-board-schema 1.35.0 → 1.38.0

package/src/deployment-drift.test.mjs

@@ -0,0 +1,301 @@
+// Tests for the deployment-drift DECISION.
+//
+// These call `evaluate()` from scripts/lib/drift-evaluate.mjs — the function the script
+// ships and uses. Nothing here reimplements the rule.
+//
+// That matters because the first version of this file did exactly that: it extracted two
+// leaf helpers and wrote the staleness rule locally, while the PR body claimed the tests
+// drove the shipped code. A three-seat review found the claim false and the real control
+// flow untested — including a path where a board with an unparseable timestamp was
+// reported `ok`.
+//
+// WHAT THE `OK` CASES ARE. An earlier version of this header claimed every "reports ok"
+// case below was a fail-open regression test. That was false, and it mattered: it dressed
+// up ordinary coverage as security coverage. There are two different kinds here, and they
+// are labelled:
+//   - FAIL-OPEN regression: the case returned `ok` in a previous version and must NOT.
+//     Those all assert UNKNOWN or DRIFT — see "UNKNOWN never collapses into OK" and
+//     "second-round fail-open regressions".
+//   - HAPPY-PATH / BOUNDARY / SKEW: the case must return OK, and the test exists so the
+//     check cannot be made trivially strict. A gate that fires on the normal state gets
+//     ignored, which is its own failure mode. These are the OK assertions at "the happy
+//     path is genuinely reachable", "does NOT flag a small, fresh gap", "tolerates a
+//     minute of clock skew", "pins the exact threshold boundary", and the behind-board
+//     case in "branches a mutation must not survive".
+//
+// The script itself — argv parsing, credential scrubbing, and the exit-code mapping this
+// whole PR exists for — is NOT exercised here. It is exercised as a subprocess in
+// deployment-drift-script.test.mjs, because none of it is reachable through `evaluate()`.
+import { describe, it, expect } from "vitest";
+import { evaluate, minorGap, pgTimestampToIso, OK, DRIFT, UNKNOWN } from "../../../scripts/lib/drift-evaluate.mjs";
+
+const NOW = new Date("2026-08-16T18:00:00Z").getTime();
+const BUMP = "2026-08-16T17:00:00Z";
+const base = (over = {}) => ({
+  merged: "1.35.0",
+  published: "1.35.0",
+  bumpIso: BUMP,
+  expectedSchemaVersion: 8,
+  expectedDigest: "f63027fa",
+  boards: [],
+  ...over,
+});
+const run = (facts, opts = {}) => evaluate(facts, { nowMs: NOW, ...opts });
+const board = (over = {}) => ({
+  ref: "b1",
+  running: "1.35.0",
+  schemaVersion: 8,
+  digest: "f63027fa",
+  installedAt: "2026-08-16 17:30:00+00",
+  ...over,
+});
+
+describe("the happy path is genuinely reachable", () => {
+  it("is OK when everything agrees", () => {
+    const r = run(base({ boards: [board()] }));
+    expect(r.status).toBe(OK);
+  });
+});
+
+// Each of these returned `ok` + exit 0 in the first version. That was the defect.
+describe("UNKNOWN never collapses into OK", () => {
+  it("npm unreachable is UNKNOWN, not current", () => {
+    expect(run(base({ published: null })).status).toBe(UNKNOWN);
+  });
+
+  it("an unreadable board is UNKNOWN, not current", () => {
+    expect(run(base({ boards: [{ ref: "b1", error: "HTTP 401" }] })).status).toBe(UNKNOWN);
+  });
+
+  it("a missing credential is UNKNOWN, not current", () => {
+    expect(run(base({ boards: [{ ref: "b1", error: "no SUPABASE_ACCESS_TOKEN" }] })).status).toBe(UNKNOWN);
+  });
+
+  it("an unparseable install timestamp is UNKNOWN — the specific bug a seat found", () => {
+    const r = run(base({ boards: [board({ installedAt: "not-a-date" })] }));
+    expect(r.status).toBe(UNKNOWN);
+    expect(r.findings.some((f) => /unparseable/.test(f.msg))).toBe(true);
+  });
+
+  it("a missing install timestamp is UNKNOWN", () => {
+    expect(run(base({ boards: [board({ installedAt: null })] })).status).toBe(UNKNOWN);
+  });
+
+  it("no bump date (shallow clone) is UNKNOWN for the board leg", () => {
+    expect(run(base({ bumpIso: null, boards: [board()] })).status).toBe(UNKNOWN);
+  });
+
+  it("a major-version difference is UNKNOWN, not OK", () => {
+    expect(run(base({ published: "2.0.0" })).status).toBe(UNKNOWN);
+  });
+
+  it("a malformed merged version is UNKNOWN and stops there", () => {
+    const r = run(base({ merged: "not-a-version" }));
+    expect(r.status).toBe(UNKNOWN);
+  });
+
+  it("a board record with no digest is UNKNOWN — cannot confirm same bytes", () => {
+    expect(run(base({ boards: [board({ digest: null })] })).status).toBe(UNKNOWN);
+  });
+});
+
+describe("real drift is DRIFT", () => {
+  it("flags more unpublished versions than the threshold", () => {
+    expect(run(base({ merged: "1.42.0" })).status).toBe(DRIFT);
+  });
+
+  it("does NOT flag a small, fresh gap — a check that cries wolf gets ignored", () => {
+    expect(run(base({ merged: "1.36.0" })).status).toBe(OK);
+  });
+
+  it("flags a small gap that has gone stale by age", () => {
+    const old = new Date("2026-08-01T17:00:00Z").toISOString();
+    expect(run(base({ merged: "1.36.0", bumpIso: old })).status).toBe(DRIFT);
+  });
+
+  it("flags a registry AHEAD of the checkout", () => {
+    expect(run(base({ merged: "1.28.0", published: "1.35.0" })).status).toBe(DRIFT);
+  });
+
+  it("flags a board with NO install record — absent is not up to date", () => {
+    expect(run(base({ boards: [{ ref: "b1", running: null }] })).status).toBe(DRIFT);
+  });
+
+  it("flags a board behind main", () => {
+    expect(run(base({ boards: [board({ running: "1.28.0" })] })).status).toBe(DRIFT);
+  });
+
+  it("flags a record installed before the version it claims existed", () => {
+    const r = run(base({ boards: [board({ installedAt: "2026-07-15 02:57:23+00" })] }));
+    expect(r.status).toBe(DRIFT);
+    expect(r.findings.some((f) => /stale/.test(f.msg))).toBe(true);
+  });
+
+  it("flags a record whose schema_version disagrees with the manifest", () => {
+    expect(run(base({ boards: [board({ schemaVersion: 7 })] })).status).toBe(DRIFT);
+  });
+
+  it("flags a record whose digest disagrees with the manifest — different bytes", () => {
+    expect(run(base({ boards: [board({ digest: "deadbeef" })] })).status).toBe(DRIFT);
+  });
+
+  it("tolerates a minute of clock skew rather than crying stale", () => {
+    expect(run(base({ boards: [board({ installedAt: "2026-08-16 16:59:30+00" })] })).status).toBe(OK);
+  });
+});
+
+describe("pgTimestampToIso", () => {
+  it("parses the Postgres two-digit offset that plain Date() rejects", () => {
+    expect(pgTimestampToIso("2026-07-15 02:57:23+00")).toBe("2026-07-15T02:57:23+00:00");
+    expect(Number.isNaN(new Date("2026-07-15T02:57:23+00").getTime())).toBe(true);
+  });
+  it("keeps fractional seconds", () => {
+    expect(pgTimestampToIso("2026-08-16 17:17:00.04088+00")).toBe("2026-08-16T17:17:00.04088+00:00");
+  });
+  it("assumes UTC for a naive timestamp", () => {
+    expect(pgTimestampToIso("2026-08-16 17:17:00")).toBe("2026-08-16T17:17:00Z");
+  });
+  it("returns null for unparseable input — unknown, never fresh", () => {
+    for (const v of ["not-a-date", null, undefined, ""]) expect(pgTimestampToIso(v)).toBeNull();
+  });
+});
+
+describe("minorGap", () => {
+  it("counts unpublished versions", () => expect(minorGap("1.35.0", "1.28.0")).toBe(7));
+  it("is zero when equal", () => expect(minorGap("1.35.0", "1.35.0")).toBe(0));
+  it("goes negative when the registry is ahead", () => expect(minorGap("1.28.0", "1.35.0")).toBe(-7));
+  it("refuses across a major", () => expect(minorGap("2.0.0", "1.35.0")).toBeNull());
+  it("returns null rather than guessing", () => expect(minorGap("nope", "1.35.0")).toBeNull());
+});
+
+// ---------------------------------------------------------------------------
+// Second-round findings. Every case below reported OK in the first rewrite.
+// ---------------------------------------------------------------------------
+describe("second-round fail-open regressions", () => {
+  it("an unpublished gap with an undeterminable bump date is UNKNOWN, not OK", () => {
+    expect(run(base({ merged: "1.36.0", bumpIso: null })).status).toBe(UNKNOWN);
+  });
+
+  it("a board behind main with an undeterminable bump date is UNKNOWN, not OK", () => {
+    expect(run(base({ bumpIso: null, boards: [board({ running: "1.34.0" })] })).status).toBe(UNKNOWN);
+  });
+
+  it("missing manifest expectations make the consistency leg UNKNOWN, not a silent skip", () => {
+    // Three seats reproduced this: a corrupt manifest disabled the digest and
+    // schema_version comparisons while still printing "record consistent".
+    const r = run(base({ expectedDigest: null, expectedSchemaVersion: null, boards: [board({ digest: "deadbeef" })] }));
+    expect(r.status).toBe(UNKNOWN);
+    expect(r.findings.some((f) => /record consistent/.test(f.msg))).toBe(false);
+  });
+
+  it("a board record with no schema_version is UNKNOWN", () => {
+    expect(run(base({ boards: [board({ schemaVersion: null })] })).status).toBe(UNKNOWN);
+  });
+
+  it("a malformed version does not parse as its numeric prefix", () => {
+    expect(minorGap("1.35.0garbage", "1.35.0")).toBeNull();
+    expect(run(base({ published: "1.35.0garbage" })).status).toBe(UNKNOWN);
+  });
+
+  it("a published PATCH ahead is drift, not agreement", () => {
+    // minor-only comparison called 1.35.1 equal to 1.35.0 while the registry was ahead
+    expect(run(base({ published: "1.35.1" })).status).toBe(DRIFT);
+  });
+
+  it("non-finite thresholds refuse to evaluate rather than passing everything", () => {
+    expect(run(base({ merged: "1.58.0" }), { maxVersions: NaN }).status).toBe(UNKNOWN);
+    expect(run(base({ merged: "1.58.0" }), { maxDays: NaN }).status).toBe(UNKNOWN);
+  });
+});
+
+describe("status accumulation — previously unpinned", () => {
+  it("DRIFT outranks UNKNOWN when both are present", () => {
+    // A RANK swap survived the first suite because no case mixed the two.
+    const r = run(base({ published: null, boards: [board({ running: "1.20.0" })] }));
+    expect(r.findings.some((f) => f.level === UNKNOWN)).toBe(true);
+    expect(r.findings.some((f) => f.level === DRIFT)).toBe(true);
+    expect(r.status).toBe(DRIFT);
+  });
+
+  it("pins the exact threshold boundary", () => {
+    expect(run(base({ merged: "1.38.0" })).status).toBe(OK); // gap 3 == maxVersions
+    expect(run(base({ merged: "1.39.0" })).status).toBe(DRIFT); // gap 4 > maxVersions
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Branches a mutation must not survive.
+//
+// Each of the four below was measured UNPINNED: the mutation named in its comment was
+// applied to drift-evaluate.mjs and all 38 tests stayed green. A green suite is not
+// evidence; these exist so that each mutation reds a named assertion.
+// ---------------------------------------------------------------------------
+describe("branches a mutation must not survive", () => {
+  // Mutation: delete the `add(UNKNOWN, ...)` for an unparseable bumpIso (:100-102).
+  // No board, and merged === published, so this finding is the ONLY non-OK source —
+  // without it the status is OK.
+  it("an unparseable bump timestamp is UNKNOWN even when every other leg agrees", () => {
+    const r = run(base({ bumpIso: "not-a-date", boards: [] }));
+    expect(r.status).toBe(UNKNOWN);
+    expect(r.findings.some((f) => f.level === UNKNOWN && /version-bump timestamp is unparseable/.test(f.msg))).toBe(true);
+  });
+
+  // Mutation: change the board-leg `add(UNKNOWN, ...)` for an incomparable version to OK.
+  it("a board across a MAJOR from merged is UNKNOWN, never OK", () => {
+    const r = run(base({ boards: [board({ running: "2.0.0" })] }));
+    expect(r.status).toBe(UNKNOWN);
+    expect(r.findings.some((f) => f.level === UNKNOWN && /running 2\.0\.0 is not comparable/.test(f.msg))).toBe(true);
+  });
+
+  // Mutation: drop the early `return` after the malformed-merged UNKNOWN (:96). The
+  // existing "a malformed merged version is UNKNOWN and stops there" asserts only the
+  // status, which the mutation preserves — so it asserted the label, not the stopping.
+  it("a malformed merged version STOPS evaluation — exactly one finding, nothing else runs", () => {
+    const r = run(base({ merged: "1.x.0", published: "1.35.0", boards: [board(), board({ ref: "b2", digest: "deadbeef" })] }));
+    expect(r.status).toBe(UNKNOWN);
+    expect(r.findings).toHaveLength(1);
+    expect(r.findings[0].msg).toMatch(/cannot compare anything/);
+  });
+
+  // Mutation: force the behind-board outcome to DRIFT unconditionally (:158 as numbered
+  // before this block was added). One version behind, bumped an hour ago, is inside
+  // release cadence and must not fire.
+  //
+  // Double duty: the ancient `installedAt` here pins the STATED LIMIT that a behind
+  // board's staleness check does not run (see the LIMIT comment in drift-evaluate.mjs).
+  // If that limit is ever closed, this assertion reds and must be rewritten deliberately
+  // rather than the limit being closed by accident.
+  // Mutation: delete the `gap < 0` branch, restoring the fall-through. Reproduced by a
+  // seat: a board running 1.36.0 against merged 1.35.0 with a MATCHING digest reported
+  // status ok, exit 0, and a message asserting the record was consistent. The publish leg
+  // has always called this same relation DRIFT; the board leg did not.
+  it("a board AHEAD of merged is DRIFT even when its digest and schema_version match", () => {
+    const r = run(base({ boards: [board({ running: "1.36.0" })] })); // digest/schemaVersion match
+    expect(r.status).toBe(DRIFT);
+    expect(r.findings.some((f) => f.level === DRIFT && /is running 1\.36\.0, which is AHEAD of merged/.test(f.msg))).toBe(true);
+    // The old fall-through produced this message while returning ok. Its presence would
+    // mean the ahead board was evaluated as though it were current.
+    expect(r.findings.some((f) => /record consistent/.test(f.msg))).toBe(false);
+  });
+
+  it("a board AHEAD with a MISMATCHED digest is DRIFT for being ahead, not for the bytes", () => {
+    // The symmetric case. A board ahead SHOULD disagree with a manifest describing merged,
+    // so the honest single finding is the ahead-ness; "different bytes" would be noise
+    // dressed as a second defect.
+    const r = run(base({ boards: [board({ running: "1.36.0", digest: "deadbeef", schemaVersion: 9 })] }));
+    expect(r.status).toBe(DRIFT);
+    expect(r.findings.some((f) => f.level === DRIFT && /AHEAD of merged/.test(f.msg))).toBe(true);
+    expect(r.findings.some((f) => /different bytes/.test(f.msg))).toBe(false);
+  });
+
+  it("a board a PATCH ahead is DRIFT too — the half-step sign is classified", () => {
+    // minorGap returns ±0.5 for a patch difference; -0.5 took the same fall-through.
+    expect(run(base({ boards: [board({ running: "1.35.1" })] })).status).toBe(DRIFT);
+  });
+
+  it("a board 1 behind and fresh is OK even with an ancient install timestamp", () => {
+    const r = run(base({ boards: [board({ running: "1.34.0", installedAt: "2020-01-01 00:00:00+00" })] }));
+    expect(r.status).toBe(OK);
+    expect(r.findings.some((f) => f.level === OK && /is 1 schema version\(s\) behind main/.test(f.msg))).toBe(true);
+  });
+});

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 134)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 137)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(134);
+    expect(manifest.migrationCount).toBe(137);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -186,6 +186,42 @@ describe('manifest integrity', () => {
       // (the #244 resumption lookup misses and the non-null owner conjunct fails). The owner
       // uuid is unchanged, so no FK and no live session moves.
       '20260916000100_agent_board_federated_identity_injective_slug.sql',
+      // #317 INVITENODOWNGRADE. `_upsert_board_membership_state` is the sole sink that writes
+      // membership_state, and it wrote p_membership_state unconditionally -- so an invite (or a
+      // join request) landing on an agent who is already `joined`/`subscribed` REPLACED active
+      // standing with the weaker offer state. Reproduced on production. Distinct from #109, which
+      // was a wrong-ROW defect fixed by p_membership_id targeting; this is the right row moved in
+      // the wrong DIRECTION. `invited`/`requested` are offers, so applying one to an existing
+      // membership is now a no-op on membership_state (not an exception -- invite is idempotent by
+      // design and raising would break callers that succeed today). Every other transition,
+      // including re-invite after `removed`, is unchanged. The sink also now emits the RESULTING
+      // ROW's state rather than the requested argument: before the guard the two could not
+      // differ, and after it a no-op offer would otherwise append `invite_offer -> invited` to
+      // the append-only ledger beside a row that says `joined` -- the same discipline
+      // _redeem_unbounded_invite_for_agent already follows.
+      '20260917000100_agent_board_invite_no_downgrade.sql',
+      // #310 SIGNEDWRITEFLAG. `get_bundle_compatibility` reported
+      // `signed_write_enforced: false` on a system that IS enforcing, because the predicate
+      // still encoded the model 20260718000800 deliberately abandoned: it asked whether
+      // `authenticated` can EXECUTE four raw write RPCs. There are SEVEN signed gateways, not
+      // four, and the send family is OVERLOADED, so the old hand list was wrong twice over.
+      // The flag now reads pg_proc rows for `signed\_%` and asks `has_function_privilege`
+      // (which resolves inherited and PUBLIC-default grants that `role_routine_grants`
+      // structurally cannot see -- the #302 fail-open shape and the #118 recreate class).
+      // Definition-only: CREATE OR REPLACE with the identical signature, so the ACL survives;
+      // grants and a COMMENT are restated in the same migration anyway.
+      '20260918000100_agent_board_signed_write_enforced_repoint.sql',
+      // #326 SIGNEDWRITEMODEL. `signed_write_enforced` has the right VALUE and the wrong
+      // NAME: it is called "signed write enforced" and it tests "the signed path is
+      // operator-only". A boolean cannot say which proposition it means, so a reader had to
+      // combine it with `installed_bundle_version` and a 1.37.0 boundary to decode it. Adds a
+      // self-describing `signed_write_model` sibling ('operator-only-gateway'). ADDITIVE: the
+      // client's runtime type guard requires three keys to be PRESENT, so dropping or
+      // re-pointing the boolean was not available -- the first breaks every deployed client's
+      // recognition of a HEALTHY response, the second is the permanently-lying instrument #310
+      // names. Definition-only: CREATE OR REPLACE with the identical signature, grants and
+      // COMMENT restated in the same migration.
+      '20260919000100_agent_board_signed_write_model_key.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_bundle_endpoint_compat.test.sql

@@ -1,5 +1,5 @@
 begin;
-select plan(12);
+select plan(21);
 
 -- objects exist
 select has_table('agent_board', 'bundle_installation', 'bundle_installation table exists');
@@ -25,27 +25,47 @@ select is((agent_board.get_bundle_compatibility() ->> 'ready'), 'false',
 select is((agent_board.get_bundle_compatibility() ->> 'schema_version'), '8',
   'compatibility reports schema version 8');
 
--- Post-MBSESSION the 8 core sends are re-granted to authenticated, so the LIVE
--- baseline posture is signed_write_enforced=false. Exercise BOTH branches in this
--- rolled-back txn. Enforced branch: revoke EXECUTE from authenticated on ALL
--- eight gated-write overloads (the probe checks by routine name, so any single
--- remaining overload grant keeps enforcement false) -> reports active=true.
-revoke execute on function agent_board.send_direct_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) from authenticated;
-revoke execute on function agent_board.send_direct_message(uuid, uuid, jsonb, text, text, text, text, text, text, jsonb) from authenticated;
+-- #310: this block used to exercise the flag's two branches by revoking and re-granting the
+-- EIGHT send overloads, because the predicate asked whether `authenticated` could execute them.
+-- That predicate encoded the model 20260718000800 deliberately abandoned, and it reported
+-- `false` for a system that WAS enforcing. 20260918000100 re-points it at the signed gateway's
+-- grants, so the same two branches are now driven from a `signed_*` function instead.
+--
+-- Both branches still run inside this rolled-back txn, and driving BOTH is the point: an
+-- assertion that only ever sees `true` cannot tell "the flag is right" from "the flag is stuck".
+select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'true',
+  'signed-write enforcement reports active on the shipped posture — the signed gateway exists and no signed_* is executable by authenticated or anon (#310)');
+
+-- Enforcement-off branch: EXECUTE on any ONE signed_* gateway reaching `authenticated` is
+-- enough. The probe iterates pg_proc rows, so this holds for every gateway and every overload,
+-- not just the one named here.
+grant execute on function agent_board.signed_post_board_message(jsonb, jsonb) to authenticated;
+select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'false',
+  'enforcement flips to false when a single signed_* gateway becomes executable by authenticated');
+
+revoke execute on function agent_board.signed_post_board_message(jsonb, jsonb) from authenticated;
+
+-- `anon` is checked too, and separately: the retired predicate looked only at `authenticated`,
+-- so an anon grant on the signed path would have left it reporting enforced.
+grant execute on function agent_board.signed_send_direct_message(jsonb, jsonb) to anon;
+select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'false',
+  'enforcement flips to false for an ANON grant as well — the retired predicate only looked at authenticated');
+
+revoke execute on function agent_board.signed_send_direct_message(jsonb, jsonb) from anon;
+select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'true',
+  'and back to true once the grant is withdrawn — the flag tracks the grant rather than latching');
+
+-- The re-granted SEND path must NOT move the flag -- #310's defect stated as an assertion.
+-- This REVOKES and RE-GRANTS a send overload so it observes a genuine state change; the earlier
+-- draft asserted the same value twice with nothing happening in between, which documented the
+-- claim rather than probing it.
 revoke execute on function agent_board.send_multicast_message(uuid, uuid, uuid[], text, text, text, text, text, jsonb) from authenticated;
-revoke execute on function agent_board.send_multicast_message(uuid, uuid, jsonb, text, text, text, text, text, text, jsonb) from authenticated;
-revoke execute on function agent_board.post_board_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) from authenticated;
-revoke execute on function agent_board.post_board_message(uuid, uuid, text, text, text, text, text, text, text, jsonb) from authenticated;
-revoke execute on function agent_board.create_tasking_delivery(uuid, uuid, text, text, uuid[], uuid, text, text, text, jsonb) from authenticated;
-revoke execute on function agent_board.create_tasking_delivery(uuid, uuid, text, text, jsonb, text, text, text, text, text, jsonb) from authenticated;
 select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'true',
-  'signed-write enforcement reports active when all gated write RPCs are revoked from authenticated');
+  '#310: REVOKING a send RPC from authenticated does not move the flag — the retired predicate would have flipped to true here, which is precisely what it got wrong');
 
--- Re-grant branch: re-granting EXECUTE on any one gated write RPC (as MBSESSION
--- does at 20260718000800) flips enforcement back to false.
 grant execute on function agent_board.send_multicast_message(uuid, uuid, uuid[], text, text, text, text, text, jsonb) to authenticated;
-select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'false',
-  'enforcement flips to false when any gated write RPC is re-granted to authenticated');
+select is((agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'), 'true',
+  '#310: and RE-GRANTING it does not move the flag either — authenticated holding EXECUTE on the unsigned send path is the shipped model, not a lapse');
 
 -- after the materializer records an install: ready + bundle identity present,
 -- and no credential/row content leaks (only whitelisted keys)
@@ -57,5 +77,40 @@ select is(
   'true:1.1.0:deadbeef',
   'ready + bundle identity reported after install record');
 
+-- ===========================================================================
+-- SIGNEDWRITEMODEL (message-board#326)
+--
+-- `signed_write_enforced` has the right VALUE and the wrong NAME: it is called
+-- "signed write enforced" and it tests "the signed path is operator-only". The
+-- sibling below NAMES the proposition, so a reader decodes the boolean without
+-- consulting the 1.37.0 version boundary.
+-- ===========================================================================
+select is((agent_board.get_bundle_compatibility() ->> 'signed_write_model'),
+  'operator-only-gateway',
+  'MB326-1: the handshake NAMES the model its boolean is answering, so the flag decodes without a version boundary');
+
+-- The key is a CONSTANT about this bundle, not a derivation from the database.
+-- Driving the boolean to its other branch must not move it: a model that flipped
+-- with the state it describes would be a second boolean, not a label.
+grant execute on function agent_board.signed_post_board_message(jsonb, jsonb) to authenticated;
+select is(
+  (agent_board.get_bundle_compatibility() ->> 'signed_write_model') || ':' ||
+  (agent_board.get_bundle_compatibility() ->> 'signed_write_enforced'),
+  'operator-only-gateway:false',
+  'MB326-2: the model NAME is a constant about the bundle — it stays put while the boolean it labels flips to false');
+revoke execute on function agent_board.signed_post_board_message(jsonb, jsonb) from authenticated;
+
+-- ADDITIVE, which is the whole argument for adding rather than renaming.
+-- packages/agent-board-client/src/compatibility.ts recognises a health response
+-- with `"schema_version" in value && "signed_write_enforced" in value && "ready"
+-- in value`. Asserted as PRESENCE of each of the three, one at a time, because
+-- that is what the guard tests -- a combined check would pass on two of three.
+select ok(agent_board.get_bundle_compatibility() ? 'schema_version',
+  'MB326-3: the deployed client type guard''s first key is still PRESENT');
+select ok(agent_board.get_bundle_compatibility() ? 'signed_write_enforced',
+  'MB326-4: ...its second key, the one a rename or retirement would have removed, is still PRESENT');
+select ok(agent_board.get_bundle_compatibility() ? 'ready',
+  'MB326-5: ...and its third');
+
 select * from finish();
 rollback;

package/tests/agent_board_consent_substrate.test.sql

@@ -709,7 +709,14 @@ select is(
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.prokind = 'f'
       and p.proname in ('join_board','resolve_board_request','update_board_membership','_upsert_board_membership_state')
-      and pg_get_functiondef(p.oid) ~ '_membership_consent_present'),
+      -- stripped_body, NOT pg_get_functiondef. This read the RAW definition, so a COMMENT
+      -- naming the predicate counted as a READER of it: #317 added an in-body comment to
+      -- _upsert_board_membership_state explaining why that function must NOT emit a state the
+      -- predicate would read as consent, and this assertion promptly reported the function as a
+      -- third reader. The direction was safe -- an exact-set match can only gain a name, so it
+      -- failed LOUDLY rather than passing -- but "mentions it" and "calls it" are different
+      -- claims and this one is about calls. Same helper, same reason, as #196/#199.
+      and agent_board_test.stripped_body(p.oid) ~ '_membership_consent_present'),
   'resolve_board_request, update_board_membership',
   'scope: exactly TWO membership routes read the predicate');