@consiliency/agent-board-schema 1.35.0 → 1.40.0

package/tests/agent_board_signed_write_enforced.test.sql

@@ -0,0 +1,366 @@
+-- #310 — `signed_write_enforced` must describe the model this project actually ships.
+--
+-- The flag reported `false` on a system that was enforcing, because its predicate still encoded
+-- the abandoned "authenticated cannot execute the send RPCs" model. `20260918000100` re-points it
+-- at what enforcement means now. This file pins BOTH halves of that meaning, and the split is
+-- deliberate rather than convenient:
+--
+--   * the GRANT half is in the flag, because privileges are catalog facts a shipped function can
+--     read soundly at runtime;
+--   * the BODY half is here, because deciding "this writer derives its actor from the session and
+--     gates" means reading function source, and a shipped runtime scan of `prosrc` is satisfied by
+--     a COMMENT (#196/#199). The strip helpers that make such a scan sound are test-only, and
+--     shipping a second copy into `agent_board` is the two-copies-drift failure #199 names.
+--
+-- CONSEQUENCE, with the qualifier that makes it true. A new ungated writer THAT IS THE
+-- COUNTERPART OF A SIGNED GATEWAY turns an assertion in this file red rather than the flag. A new
+-- ungated writer with NO signed twin turns NEITHER red.
+--
+-- That is by construction, not by accident: every class-scoping predicate below bounds the class
+-- with `signed\_%` and derives the counterpart by stripping the prefix, so a writer without a
+-- signed twin is outside the class before any assertion runs. Measured, because a claim about
+-- one's own blind spot deserves evidence too: an `authenticated`-executable SECURITY DEFINER
+-- writer that derives nothing from the session left the flag `true` and all 19 assertions green.
+--
+-- The repo has many such writers already -- `create_board`, `join_board`, `invite_board_room`-
+-- style admission RPCs, `acquire_claim`, `delegate_task` -- none of which has a signed gateway.
+-- This file makes NO claim about them. Closing that properly needs an EFFECT-derived class
+-- ("every authenticated-executable function that writes a message/task/authority row") on the
+-- shape `agent_board_consent_gating.test.sql` EC-4 already uses, which is a bigger class than
+-- #310's subject; filed as a follow-up rather than smuggled in here.
+--
+-- An earlier draft of this note said "a new UNGATED writer" flatly. A review seat read the
+-- scoping predicates and showed the claim was broader than the class. Recording that here rather
+-- than only fixing the wording, because the unqualified sentence is the kind that gets copied.
+--
+-- THE CALL CLOSURE IS LOAD-BEARING, not a flourish. Only 3 of the 7 unsigned counterparts name
+-- `_resolved_actor_agent_id` in their own body; the send family DELEGATES to `post_message`. A
+-- direct body scan would report four of seven ungated and be WRONG.
+--
+-- WHAT MAKES A CLOSURE ASSERTION FAIL-CLOSED is where its POPULATION comes from, not which of the
+-- two spellings it uses -- an earlier version of this note said the spelling was the thing, and
+-- the rewrite below falsifies that. "The set that does NOT reach X is empty" is fail-OPEN when the
+-- population is drawn from the closure itself, because an empty closure empties the population
+-- too. It is fail-CLOSED when the population comes from `pg_proc`, because then an empty closure
+-- puts EVERY member in the non-reaching set. The assertions below take the population from
+-- pg_proc and pin its size with a canary, so both directions are covered. Proven by shimming the
+-- helper to return zero rows, not assumed.
+
+begin;
+select plan(22);
+
+-- ---------------------------------------------------------------------------
+-- THE DEFECT: the flag now describes a system that is enforcing.
+-- ---------------------------------------------------------------------------
+select is(
+  (agent_board.get_bundle_compatibility()->>'signed_write_enforced'),
+  'true',
+  '#310: signed_write_enforced is TRUE on a system that is enforcing — the whole point of the issue');
+
+select is(
+  (select count(*)::text from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'signed_send_direct_message'),
+  '1',
+  '#310 anchor: the signed gateway exists — without it the grant clause below is vacuously true, so this is what stops "enforced" meaning "nothing to enforce"');
+
+-- ---------------------------------------------------------------------------
+-- THE GRANT HALF. The old predicate carried a FOUR-name hand list; there are SEVEN
+-- gateways, which is rule 1's failure in its plainest form. This set comes from pg_proc.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(array_agg(distinct p.proname::text order by p.proname::text), array[]::text[])
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname like 'signed\_%'),
+  array['signed_append_task_event', 'signed_create_tasking_delivery', 'signed_grant_board_role',
+        'signed_post_board_message', 'signed_send_direct_message', 'signed_send_multicast_message',
+        'signed_set_board_authority_ceiling']::text[],
+  '#310: there are SEVEN signed gateways — the retired predicate named four, and a new gateway fails here NAMING itself');
+
+select is(
+  (select coalesce(array_agg(r.rolname || ':' || p.proname order by r.rolname, p.proname), array[]::text[])
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    cross join (values ('authenticated'), ('anon')) as r(rolname)
+    where n.nspname = 'agent_board' and p.proname like 'signed\_%'
+      and has_function_privilege(r.rolname, p.oid, 'EXECUTE')),
+  array[]::text[],
+  '#310: no signed_* gateway is EXECUTE-able by authenticated or anon — via has_function_privilege, which resolves inherited and PUBLIC-default grants that role_routine_grants cannot see');
+
+-- The positive complement: the operator path must EXIST, or "nobody can call it" would satisfy
+-- the assertion above while meaning the gateway is dead rather than protected.
+select is(
+  (select coalesce(array_agg(distinct p.proname::text order by p.proname::text), array[]::text[])
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname like 'signed\_%'
+      and has_function_privilege('service_role', p.oid, 'EXECUTE')),
+  array['signed_append_task_event', 'signed_create_tasking_delivery', 'signed_grant_board_role',
+        'signed_post_board_message', 'signed_send_direct_message', 'signed_send_multicast_message',
+        'signed_set_board_authority_ceiling']::text[],
+  '#310: every signed_* IS executable by service_role — the operator path is protected, not dead');
+
+-- ---------------------------------------------------------------------------
+-- THE PAIRING, by NAME rather than by a list: each `signed_X` has an unsigned `X`. This is what
+-- makes "the enforcement class" catalog-derived — the class is not "the send RPCs someone
+-- remembered", it is the unsigned counterpart of every gateway that exists.
+-- ---------------------------------------------------------------------------
+-- Spelled as the MISSING set, not the present set. The present-set form was filtered by
+-- `where exists (counterpart)`, so a gateway with NO counterpart was filtered OUT of its own
+-- assertion and the aggregate still matched -- the description claimed "a gateway without one
+-- fails here" and the author's own mutation table refuted it: an orphan gateway reddened
+-- other assertions and never this one. What that form actually detected was counterpart
+-- REMOVAL. This form detects both, and names the orphan.
+select is(
+  (select coalesce(array_agg(s.counterpart order by s.counterpart), array[]::text[])
+     from (select regexp_replace(p.proname, '^signed_', '') as counterpart
+             from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board' and p.proname like 'signed\_%') s
+    where not exists (select 1 from pg_proc p2 join pg_namespace n2 on n2.oid = p2.pronamespace
+                       where n2.nspname = 'agent_board' and p2.proname = s.counterpart)),
+  array[]::text[],
+  '#310: every signed gateway HAS an unsigned counterpart — a gateway whose counterpart is missing or was never created fails here and names itself');
+
+select is(
+  (select coalesce(array_agg(distinct s.counterpart order by s.counterpart), array[]::text[])
+     from (select regexp_replace(p.proname, '^signed_', '') as counterpart
+             from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board' and p.proname like 'signed\_%') s
+    where exists (select 1 from pg_proc p2 join pg_namespace n2 on n2.oid = p2.pronamespace
+                   where n2.nspname = 'agent_board' and p2.proname = s.counterpart
+                     and has_function_privilege('authenticated', p2.oid, 'EXECUTE'))),
+  array['append_task_event', 'create_tasking_delivery', 'grant_board_role', 'post_board_message',
+        'send_direct_message', 'send_multicast_message', 'set_board_authority_ceiling']::text[],
+  '#310: every unsigned counterpart IS authenticated-executable — that is the shipped model (the gate is inside the function), and this pins it rather than leaving it implied');
+
+-- ---------------------------------------------------------------------------
+-- THE BODY HALF, over the CALL CLOSURE.
+-- ---------------------------------------------------------------------------
+-- PER-OID, not per-name, and that is a correction rather than a refinement. An earlier draft
+-- aggregated `distinct root_name`, so adding an authenticated, UNGATED OVERLOAD of an existing
+-- counterpart left every expected name present -- another overload was still gated and supplied
+-- the name. Verified: the whole file stayed green with such an overload installed. Overloads are
+-- separate functions with separate grants, so the population is separate functions too.
+--
+-- Spelled as "the set that does NOT reach it is empty", which is fail-CLOSED here precisely
+-- because the population comes from pg_proc and not from the closure: if the closure helper ever
+-- returns nothing, every member lands in the non-reaching set and this goes red. The canary
+-- below pins the population size so the set cannot go empty by the population going empty.
+--
+-- WHAT "REACHES" PROVES, and what it does not. The closure establishes textual REACHABILITY,
+-- not data flow: a function could call the resolver and ignore the result, or call it on a
+-- branch that never executes. Two things narrow that gap without closing it. The resolver is
+-- SIDE-EFFECTFUL on the live path -- for `authenticated` it raises 42501 on a missing session or
+-- an id mismatch -- so even a result-ignoring call enforces session PRESENCE; and the
+-- drop-the-resolver mutation pins regressions in the existing members. What it does NOT enforce
+-- is actor BINDING: a function could resolve an actor and then write a caller-supplied id
+-- anyway. For the eleven current overloads the stronger property holds by reading -- the send
+-- family delegates to post_message, and set_board_authority_ceiling feeds v_actor into its owner
+-- gate on every path -- but that is a reading, not an assertion, and it is stated as one.
+select is(
+  (select coalesce(array_agg(pop.oid::regprocedure::text order by pop.oid::regprocedure::text), array[]::text[])
+     from (select p.oid
+             from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board'
+              and p.proname in (select regexp_replace(sp.proname, '^signed_', '')
+                                  from pg_proc sp join pg_namespace sn on sn.oid = sp.pronamespace
+                                 where sn.nspname = 'agent_board' and sp.proname like 'signed\_%')) pop
+    where not exists (select 1 from agent_board_test.fn_call_closure() cl
+                       where cl.root_oid = pop.oid and cl.reached_name = '_resolved_actor_agent_id')),
+  array[]::text[],
+  '#310: EVERY unsigned counterpart OVERLOAD REACHES the session resolver — per-OID, because a single ungated overload is a whole door and its name is already spoken for by the gated one');
+
+select is(
+  (select count(*)::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname in (select regexp_replace(sp.proname, '^signed_', '')
+                          from pg_proc sp join pg_namespace sn on sn.oid = sp.pronamespace
+                         where sn.nspname = 'agent_board' and sp.proname like 'signed\_%')),
+  '11',
+  '#310 canary: there are ELEVEN counterpart overloads across the seven names — pins the population of the assertion above, so an empty non-reaching set cannot mean an empty population');
+
+-- THE RELAY DOOR. The flag asks whether a `signed_%`-NAMED function is executable by a
+-- low-privilege role. That is not the same question as "can a low-privilege role reach the
+-- signed path", and the gap is reachable: an `authenticated`-executable SECURITY DEFINER
+-- function with ANY OTHER NAME can call a gateway through its owner's privileges. Verified --
+-- such a relay left the flag `true` and every assertion in this file green.
+--
+-- The flag cannot close this (it would have to read bodies). The closure can, and does -- but
+-- only within the bounds below, and those bounds point the DANGEROUS way for this one assertion.
+--
+-- WHY THE DIRECTION MATTERS HERE AND NOWHERE ELSE IN THIS FILE. Every other closure assertion is
+-- MUST-REACH: a call edge the closure misses puts a member in the non-reaching set and turns it
+-- RED. This is the file's only MUST-NOT-REACH assertion, so a missed edge turns it GREEN. Same
+-- instrument, opposite failure direction, which is why its limits are stated here rather than
+-- left implied:
+--
+--   * SCHEMA SCOPE. fn_call_closure's population is `agent_board` only. A SECURITY DEFINER relay
+--     in ANOTHER schema -- `public`, say -- calling agent_board.signed_post_board_message is
+--     invisible to this assertion AND to the flag. Reaching that state requires a migration,
+--     not grant drift, which is why it is disclosed rather than treated as live.
+--   * DYNAMIC SQL. A gateway named inside an `EXECUTE '...'` literal forms no call edge, because
+--     stripped_body removes literals in its default mode. agent_board_fk_lock_edges.test.sql
+--     carries an FKL-11 dynamic-SQL tripwire for exactly this; fn_call_closure has none.
+--
+-- Both are recorded rather than closed, and neither is reachable by granting alone.
+select is(
+  (select coalesce(array_agg(distinct cl.root_oid::regprocedure::text order by cl.root_oid::regprocedure::text), array[]::text[])
+     from agent_board_test.fn_call_closure() cl
+     join pg_proc rp on rp.oid = cl.root_oid
+     join pg_namespace rn on rn.oid = rp.pronamespace
+     join pg_proc gp on gp.proname = cl.reached_name
+     join pg_namespace gn on gn.oid = gp.pronamespace
+    where rn.nspname = 'agent_board' and gn.nspname = 'agent_board'
+      and gp.proname like 'signed\_%'
+      and (has_function_privilege('authenticated', rp.oid, 'EXECUTE')
+           or has_function_privilege('anon', rp.oid, 'EXECUTE'))),
+  array[]::text[],
+  '#310: nothing IN agent_board executable by authenticated or anon reaches a signed_* gateway through its STATIC call closure — closes the in-schema SECURITY DEFINER relay; see the scope note above for the two doors it does not see');
+
+-- CANARY for the predicate set the coverage assertion below depends on. Two of its members are
+-- named rather than matched by pattern, so pattern drift would silently shrink the set and make
+-- the coverage claim easier to satisfy. Pinning the membership makes that drift loud.
+select is(
+  (select coalesce(array_agg(p.proname::text order by p.proname::text), array[]::text[])
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.prorettype = 'boolean'::regtype
+      and (p.proname ~ '^_(current_)?agent_(can|has)_'
+           or p.proname ~ '^_grant_within_'
+           or p.proname in ('_invite_permitted', '_membership_consent_present'))),
+  array['_agent_can_access_thread', '_agent_has_board_access', '_current_agent_can_access_task',
+        '_current_agent_can_access_thread', '_current_agent_can_mutate_task',
+        '_current_agent_can_post_to_thread', '_current_agent_can_send_to_board',
+        '_current_agent_has_board_access', '_grant_within_ceiling', '_invite_permitted',
+        '_membership_consent_present']::text[],
+  '#310 canary: the authorization-predicate set is exactly these eleven — note `_is_service_role` is excluded BY PATTERN, not by name: it discriminates a role, it does not authorize, and counting it would let a function that only checks it read as gated');
+
+-- PER-OID, for the same reason the resolver assertion above is: this was per-NAME, so an
+-- authenticated overload that reaches the resolver but NO authorization predicate was absorbed
+-- -- the gated sibling overload supplied the `exists` for the name. Measured: such an overload
+-- reddened ONLY the population canary above. That is a real tripwire, but the routine response
+-- to a count canary is to bump the count, and that edit would have silently absorbed the hole.
+-- A canary is not a substitute for the assertion it guards.
+select is(
+  (select coalesce(array_agg(pop.oid::regprocedure::text order by pop.oid::regprocedure::text), array[]::text[])
+     from (select p.oid
+             from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board'
+              and p.proname in (select regexp_replace(sp.proname, '^signed_', '')
+                                  from pg_proc sp join pg_namespace sn on sn.oid = sp.pronamespace
+                                 where sn.nspname = 'agent_board' and sp.proname like 'signed\_%')) pop
+    where not exists (
+      select 1 from agent_board_test.fn_call_closure() cl
+       join pg_proc ap on ap.proname = cl.reached_name
+       join pg_namespace an on an.oid = ap.pronamespace
+      where cl.root_oid = pop.oid
+        and an.nspname = 'agent_board' and ap.prorettype = 'boolean'::regtype
+        and (ap.proname ~ '^_(current_)?agent_(can|has)_'
+             or ap.proname ~ '^_grant_within_'
+             or ap.proname in ('_invite_permitted', '_membership_consent_present')))),
+  array['agent_board.set_board_authority_ceiling(uuid,text,uuid)']::text[],
+  '#310: exactly ONE counterpart OVERLOAD authorizes without reaching a shared predicate — per-OID, so an ungated overload cannot hide behind a gated sibling of the same name');
+
+-- ---------------------------------------------------------------------------
+-- THE EXEMPTION, asserted positively and BEHAVIOURALLY. `set_board_authority_ceiling` gates
+-- inline on the actor's board role instead of through a shared predicate, so the closure cannot
+-- see it. An exemption claimed by absence is this repo's named soft spot; these three assertions
+-- make the claim evidence.
+-- ---------------------------------------------------------------------------
+select agent_board.register_agent('agent', 'swe-owner', 'SWE Owner');
+select agent_board.register_agent('agent', 'swe-other', 'SWE Other');
+
+create temp table _swe on commit drop as
+select (select id from agent_board.agents where handle = 'swe-owner') as owner_id,
+       (select id from agent_board.agents where handle = 'swe-other') as other_id;
+
+select lives_ok(
+  $$ select agent_board.create_board((select owner_id from _swe), 'swe-board', 'SWE Board') $$,
+  'the owner creates a board');
+
+create temp table _sweb on commit drop as
+select id as board_id from agent_board.boards where slug = 'swe-board';
+
+select lives_ok(
+  $$ create temp table _swecap as select * from agent_board.set_board_authority_ceiling(
+       (select board_id from _sweb), 'admin', (select owner_id from _swe)) $$,
+  '#310 exemption, allow side: the board OWNER can set the authority ceiling');
+
+select is(
+  (select max_grantable_role from agent_board.board_authority_ceilings
+    where board_id = (select board_id from _sweb)),
+  'admin',
+  '#310 exemption: the owner call actually took effect — a refusal that also refused the owner would satisfy the deny assertion below on its own');
+
+select throws_ok(
+  $$ select agent_board.set_board_authority_ceiling(
+       (select board_id from _sweb), 'owner', (select other_id from _swe)) $$,
+  '42501',
+  null,
+  '#310 exemption, deny side (stranger): an agent with no membership at all is refused 42501');
+
+-- THE DENY SIDE ABOVE IS NOT ENOUGH ON ITS OWN, and this pair is why. A stranger is refused by
+-- any gate that checks membership AT ALL, so it cannot distinguish "owner-only" from
+-- "member-or-better". Measured: widening the inline gate from `bm.role = 'owner'` to
+-- `bm.role in ('owner','admin','member')` left BOTH assertions above green. The subject that
+-- separates the two claims is an ACTIVE NON-OWNER MEMBER, so that is what this seats.
+select lives_ok(
+  $$ select agent_board._upsert_board_membership_state(
+       (select board_id from _sweb), (select other_id from _swe), 'joined', (select owner_id from _swe)) $$,
+  'the other agent becomes an ACTIVE member of the board');
+
+select is(
+  (select role from agent_board.board_memberships
+    where board_id = (select board_id from _sweb) and agent_id = (select other_id from _swe)
+    order by case when membership_state in ('joined','subscribed') then 0 else 1 end, created_at desc, id desc
+    limit 1),
+  'member',
+  '#310 fixture: that membership is a plain member, not an owner — the precondition the assertion below needs');
+
+select throws_ok(
+  $$ select agent_board.set_board_authority_ceiling(
+       (select board_id from _sweb), 'owner', (select other_id from _swe)) $$,
+  '42501',
+  null,
+  '#310 exemption, deny side (non-owner MEMBER): the inline gate is OWNER-only, not merely membership-checking — this is the assertion the stranger case cannot make');
+
+-- ---------------------------------------------------------------------------
+-- THE INSTRUMENT. Both of these are #310's own acceptance criteria.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(array_agg(p.proname::text order by p.proname::text), array[]::text[])
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and agent_board_test.stripped_body(p.oid, true) ~* 'role_routine_grants'),
+  array[]::text[],
+  '#310: NO shipped function reads information_schema.role_routine_grants — it shows direct grants only and is filtered to visible roles, the fail-open shape #302 corrected');
+
+-- The #118 class: recreating a SECURITY DEFINER function drops its ACL and COMMENT, and a
+-- CREATE OR REPLACE that changed the signature would silently re-grant EXECUTE to PUBLIC.
+-- Measured before the migration was written: authenticated and service_role held EXECUTE, anon
+-- did not, PUBLIC held nothing. This pins that it still holds.
+-- Aggregated over pg_roles, NOT a four-name candidate list. The list form was the
+-- exemption-list soft spot rule 1 names: a widening grant to any OTHER existing role -- a portal
+-- role, `dashboard_user` -- changes the real executor set and passes a membership test over four
+-- names. Superusers and the function's OWNER are excluded because their access is implicit
+-- rather than granted, and excluding the owner BY OID rather than by name keeps this portable to
+-- a cluster where the bundle is owned by something other than `postgres`.
+select is(
+  (select coalesce(array_agg(r.rolname::text order by r.rolname::text), array[]::text[])
+     from pg_roles r
+    cross join (select p.oid, p.proowner from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+                 where n.nspname = 'agent_board' and p.proname = 'get_bundle_compatibility') f
+    where not r.rolsuper
+      and r.oid <> f.proowner
+      and has_function_privilege(r.rolname, f.oid, 'EXECUTE')),
+  array['authenticated', 'service_role']::text[],
+  '#310 / #118 class: exactly authenticated and service_role hold granted EXECUTE on the health RPC — over ALL non-superuser roles, so a grant to any role at all fails here');
+
+select isnt(
+  (select obj_description(
+            (select p.oid from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+              where n.nspname = 'agent_board' and p.proname = 'get_bundle_compatibility'), 'pg_proc')),
+  null,
+  '#310 / #118 class: the COMMENT survived the recreate — DROP FUNCTION discards it and a recreate that omits it loses the only in-database statement of what the flag means');
+
+select * from finish();
+rollback;

package/tests/agent_board_source_strip_helper.test.sql

@@ -29,7 +29,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(47);
+select plan(57);
 
 -- ---------------------------------------------------------------------------
 -- The four demonstrated masking constructs.
@@ -361,6 +361,105 @@ select throws_ok(
   null, null,
   'SQLBODY-15: stripped_def is LOUD on a missing oid too -- it used to return NULL');
 
+-- ===========================================================================
+-- AMBIGUOUS SPLICE (message-board#304)
+--
+-- stripped_def locates the body inside pg_get_functiondef by FIRST textual
+-- occurrence. The generated definition carries author-controlled text before the
+-- body — the function name, every argument name, the SET clauses — so a body
+-- that also occurs there sends the splice into the HEADER: the header is
+-- corrupted and the REAL body comes back unstripped, which satisfies every
+-- negative assertion and defeats every positive one over the result.
+--
+-- The trigger is built the way a real one arrives: a quoted ARGUMENT NAME that
+-- happens to spell the body. That is the same surface a mint_harden assertion
+-- was already defeated through (an argument named p_raw_key_fingerprint, the
+-- #196 lint's rule 3), so these fixtures are a shrunk copy of a defect that has
+-- happened, not an invented one.
+--
+-- Both arms are covered. The BEGIN ATOMIC arm added in #303 is the MORE exposed
+-- one: a deparsed body is short and normalized, so coincidental collision is
+-- likelier there than in a hand-written prosrc body.
+--
+-- The fixtures live in pg_temp, NOT agent_board: stripped_def now RAISES on
+-- them, and the catalog-derived corpus scans below sweep agent_board.
+-- ===========================================================================
+create function pg_temp._mb304_prosrc_collision("select 'mb304-collision-marker'" int)
+  returns text language sql as $mb$select 'mb304-collision-marker'$mb$;
+
+create function pg_temp._mb304_atomic_collision(p int, "RETURN 'mb304-collision-marker'::text" int)
+  returns text language sql return 'mb304-collision-marker';
+
+-- The non-colliding twins. Same bodies, ordinary argument names. They prove the
+-- raises below are caused by the AMBIGUITY and not by the fixture shape, and
+-- that the fix did not turn stripped_def into a function that refuses everything.
+create function pg_temp._mb304_prosrc_control(p int)
+  returns text language sql as $mb$select 'mb304-collision-marker'$mb$;
+
+create function pg_temp._mb304_atomic_control(p int)
+  returns text language sql return 'mb304-collision-marker';
+
+-- PREMISE. Everything below is worthless if the fixtures are not actually
+-- ambiguous, so the ambiguity is MEASURED with the same occurrence count the
+-- fixed helper uses — not assumed from how the argument was named.
+select is(
+  (select ((length(pg_get_functiondef(p.oid)) - length(replace(pg_get_functiondef(p.oid), p.prosrc, '')))
+           / length(p.prosrc))::int
+     from pg_proc p where p.oid = 'pg_temp._mb304_prosrc_collision(int)'::regprocedure),
+  2,
+  'MB304 PREMISE-A: the prosrc fixture really does have its body occurring TWICE in its own generated definition');
+
+select is(
+  (select ((length(pg_get_functiondef(p.oid))
+            - length(replace(pg_get_functiondef(p.oid), pg_get_function_sqlbody(p.oid), '')))
+           / length(pg_get_function_sqlbody(p.oid)))::int
+     from pg_proc p where p.oid = 'pg_temp._mb304_atomic_collision(int,int)'::regprocedure),
+  2,
+  'MB304 PREMISE-B: the BEGIN ATOMIC fixture really does have its DEPARSED body occurring TWICE in its own generated definition');
+
+select throws_ok(
+  $$ select agent_board_test.stripped_def('pg_temp._mb304_prosrc_collision(int)'::regprocedure) $$,
+  null, null,
+  'MB304-1: an ambiguous PROSRC body RAISES rather than splicing into the header and returning the body unstripped');
+
+select throws_ok(
+  $$ select agent_board_test.stripped_def('pg_temp._mb304_atomic_collision(int,int)'::regprocedure) $$,
+  null, null,
+  'MB304-2: the BEGIN ATOMIC arm added in #303 refuses the same way — the deparsed body is where a coincidental collision is MOST likely');
+
+-- The controls. Unambiguous bodies must still splice, so the refusals above are
+-- about AMBIGUITY and stripped_def has not become uniformly loud. lives_ok first
+-- and the state check separately: a bare `ok(stripped_def(...) !~ …)` on a
+-- raising call ABORTS the transaction, which pgTAP reports as no `not ok` at all
+-- and silently drops every assertion after it.
+select lives_ok(
+  $$ select agent_board_test.stripped_def('pg_temp._mb304_prosrc_control(int)'::regprocedure) $$,
+  'MB304-3: CONTROL — the same prosrc body with an ordinary argument name is UNambiguous and still splices');
+
+select ok(
+  agent_board_test.stripped_def('pg_temp._mb304_prosrc_control(int)'::regprocedure)
+    !~ 'mb304-collision-marker',
+  'MB304-4: ...and that spliced result really is stripped');
+
+select ok(
+  agent_board_test.stripped_def('pg_temp._mb304_prosrc_control(int)'::regprocedure, true)
+    ~ 'mb304-collision-marker',
+  'MB304-5: ...and keep-literals mode keeps the marker, so MB304-4 is not passing because the definition collapsed');
+
+select lives_ok(
+  $$ select agent_board_test.stripped_def('pg_temp._mb304_atomic_control(int)'::regprocedure) $$,
+  'MB304-6: CONTROL — the same deparsed body with an ordinary argument name is UNambiguous and still splices');
+
+select ok(
+  agent_board_test.stripped_def('pg_temp._mb304_atomic_control(int)'::regprocedure)
+    !~ 'mb304-collision-marker',
+  'MB304-7: ...and that spliced result really is stripped');
+
+select ok(
+  agent_board_test.stripped_def('pg_temp._mb304_atomic_control(int)'::regprocedure, true)
+    ~ 'mb304-collision-marker',
+  'MB304-8: ...and keep-literals mode keeps the marker, so MB304-7 is not passing because the definition collapsed');
+
 -- ---------------------------------------------------------------------------
 -- CORPUS (catalog-derived). The vectors above are written by hand and can only
 -- prove what their author thought of. These run the scanner over every live