@consiliency/agent-board-schema 1.35.0 → 1.40.0

package/tests/agent_board_write_enforcement_class.test.sql

@@ -0,0 +1,1016 @@
+-- Consiliency/message-board#325 — derive the write-enforcement class from EFFECT, not from the
+-- `signed_*` NAME.
+--
+-- agent_board_signed_write_enforced.test.sql (#310/#324) closes a class scoped by
+-- `proname like 'signed\_%'` and derived by stripping the prefix: 7 names, 11 overloads. That
+-- file DISCLOSES its own blind spot in its header — "a new ungated writer with NO signed twin
+-- turns NEITHER the flag nor an assertion red". This file closes that blind spot by scoping the
+-- class the other way: not by what a function is CALLED, but by what it DOES.
+--
+--   THE CLASS  every `authenticated`-EXECUTABLE function in `agent_board` that writes an
+--              `agent_board` relation — ITSELF OR THROUGH ANYTHING IT CALLS. Every part of that
+--              comes from `pg_catalog`: the population from `pg_proc` + `has_function_privilege`,
+--              the write-target universe from `pg_class`, the delegation edges from
+--              `agent_board_test.fn_call_closure()`. Nothing here is a list.
+--
+-- Measured on a scratch database built from this working tree's bundle: 59 writer overloads
+-- across 37 relations.
+--
+-- ===========================================================================================
+-- MEMBERSHIP IS TRANSITIVE, AND THE FIRST VERSION OF THIS FILE GOT THAT WRONG.
+-- ===========================================================================================
+-- The first revision scoped membership by DML IN THE ROOT'S OWN BODY: 44 overloads, 32 tables.
+-- That reintroduced, at the MEMBERSHIP layer, precisely the blindness #325 exists to remove.
+-- #324's direct-body scan misjudged four of seven send-family functions for delegating; this
+-- file's own class predicate then did the same thing one level up.
+--
+-- Every write HELPER is revoked from `authenticated`, so the delegating WRAPPERS are the only
+-- authenticated entry points — and a wrapper contains no DML. Measured: FIFTEEN
+-- authenticated-executable functions reach a direct writer through their closure and were
+-- OUTSIDE the 44 —
+--
+--     send_direct_message (x2)      post_board_message (x2)    send_multicast_message (x2)
+--     create_tasking_delivery (x2)  join_board                 leave_board
+--     invite_board_member           request_join_board         resolve_board_request
+--     redeem_invite_link            update_board_membership
+--
+-- `send_direct_message` -> `post_message` -> `insert into agent_board.messages` is a live chain,
+-- pinned positively by WEC-4 below.
+--
+-- THE ATTACK THAT MADE IT BLOCKING, and it needs no new privilege. `_upsert_delivery_recipient`
+-- UPDATEs `threads` and INSERTs `delivery_recipients`, and is revoked from `authenticated`. A new
+-- authenticated function whose entire body is `perform agent_board._upsert_delivery_recipient(…)`
+-- is an authenticated write of two class relations with no session derivation and no gate — and
+-- under own-body membership the class size stayed 44 and EVERY assertion stayed GREEN. It is
+-- #324's hole with one extra call. Mutation `w` pins it.
+--
+-- The repo had already paid for this lesson twice, in writing:
+--   * `agent_board_consent_gating.test.sql` EC-4 puts the SINK NAME in its class predicate for
+--     exactly this reason, so a one-hop wrapper cannot vanish from its own class.
+--   * the #113 lint comment in `scripts/run-agent-board-schema-tests.sh` says in so many words
+--     that DML-in-body "MISSES delegating RPCs such as join_board, whose writes live in a helper".
+-- Both were on disk while the first revision was written. Recorded here because the failure was
+-- not a lack of evidence.
+--
+-- ===========================================================================================
+-- THE PRICE OF TRANSITIVE MEMBERSHIP: THE FAIL-CLOSED DIRECTION INVERTS. Disclosed, not hidden.
+-- ===========================================================================================
+-- The signed_write header states the rule this file must now obey: an "empty violating set"
+-- assertion is fail-CLOSED when its population comes from `pg_proc`, and fail-OPEN when the
+-- population is drawn from the CLOSURE, because an empty closure empties the population too.
+--
+-- The population is NOW drawn from the closure. So with `fn_call_closure()` dead, `_wec_pop`
+-- goes empty and the two "violating set is empty" assertions — WEC-5 and WEC-9 — pass over
+-- NOTHING. Measured, not reasoned: mutation `e` shims the helper to zero rows and those two go
+-- GREEN, where under own-body membership they went red.
+--
+-- What replaces them as the tripwire is the EXACT-SET population pins, which is why WEC-2,
+-- WEC-3, WEC-8 and WEC-8 are exact sets and not counts: a dead closure empties them against a
+-- 59-name expectation and they fail LOUDLY. WEC-4 is the third leg and the one aimed squarely
+-- at the instrument — it asserts a specific delegation chain still exists, so a closure that
+-- has stopped resolving edges reds a named assertion instead of quietly widening a `not exists`.
+--
+-- The honest statement is therefore NOT "this file is fail-closed". It is: the two half
+-- assertions are fail-OPEN against a dead instrument, and four population/liveness pins beside
+-- them are fail-CLOSED. That is a weaker property than the first revision claimed, and it is
+-- the cost of covering delegation at all.
+--
+-- ===========================================================================================
+-- WHAT THIS FILE FOUND THAT ITS OWN PLAN DID NOT.
+-- ===========================================================================================
+--
+-- THE PLAN'S HALF B IS VACUOUS AS SPELLED. The plan says: "every writer reaches a shared authz
+-- predicate OR raises 42501 IN ITS CLOSURE. Expected violating set: EMPTY." That is true — 59 of
+-- 59 — but for a reason that makes it worthless: `_resolved_actor_agent_id`, the session resolver
+-- Half A already pins, ITSELF raises 42501. Every writer satisfying Half A satisfies
+-- closure-42501 automatically, so Half B would restate Half A and no mutation could red it.
+-- Measured over the 59:
+--
+--     42501 anywhere in the writer's CLOSURE   59 of 59   (satisfied via the resolver)
+--     42501 in the writer's OWN body           38 of 59
+--     reaches a shared authz predicate         28 of 59
+--     NEITHER of the two above                 16 of 59   ← the plan says this is 0
+--
+-- The plan's partition ("15 reach a shared predicate, the other 29 gate inline, 44/44") does not
+-- reproduce at any population.
+--
+-- AND ONE CLAIM FROM THIS FILE'S OWN FIRST REVISION DID NOT SURVIVE THE WIDER CLASS. Over the 44
+-- the predicate-reachers were a strict SUBSET of the own-body raisers, so the shared-predicate
+-- arm added no member and was disclosed as subsumed. Over the 59 that is FALSE: five writers —
+-- create_tasking_delivery, leave_board, post_board_message, send_direct_message and
+-- send_multicast_message (the jsonb-recipient overloads) — reach a shared predicate and raise no
+-- 42501 of their own. They are all DELEGATING members, i.e. exactly the ones own-body membership
+-- could not see. The arm is now load-bearing rather than subsumed, and the reason is worth
+-- keeping: a property measured over a class that was defined too narrowly is a property about
+-- the narrowness.
+--
+-- THE PLAN'S STRUCTURAL PRIVILEGE BOUND DOES NOT HOLD, and section 6 predicted it might:
+-- "measured for `board_memberships` only — re-verify per table". Re-verified per relation over
+-- all 37:
+--
+--     authenticated / anon   holds NO INSERT/UPDATE/DELETE/TRUNCATE on ANY of the 37.  HOLDS.
+--     service_role           holds direct DML on THIRTEEN of the 37 (WEC-18).          FAILS.
+--
+-- ===========================================================================================
+-- INSTRUMENT LIMITS — disclosed rather than discovered.
+-- ===========================================================================================
+--
+--   1. SCHEMA SCOPE. `fn_call_closure()` draws its population from `agent_board` only, so a
+--      writer, resolver or relay in ANOTHER schema forms no edge. Under transitive membership
+--      this cuts BOTH ways and that is new: a missed edge no longer only under-credits a gate,
+--      it can drop a function OUT OF THE CLASS. Bounded by WEC-3 being an exact set.
+--
+--   2. ASSEMBLED SQL. Fragment concatenation and `EXECUTE format('%I', …)` form no call edge and
+--      name no relation. The structural bound in WEC-17/19/20 is what bounds this — and per the
+--      finding above, it bounds it only against `authenticated` and `anon`, NOT service_role.
+--
+--   3. REACHABILITY IS NOT DATA FLOW. The closure proves a writer REACHES the resolver, not that
+--      the resolved actor controls the write. The resolver is SIDE-EFFECTFUL — for an
+--      `authenticated` caller it raises 42501 on an absent session or a mismatched actor id — so
+--      even a result-ignoring call enforces session PRESENCE. It does NOT enforce actor BINDING.
+--      For `create_thread`, probed behaviourally in WEC-14..17, the stronger property holds by
+--      READING (it inserts `v_actor_agent_id`, the resolver's return, never the caller's
+--      argument). That is a reading of ONE member, stated as one and not generalised to 59.
+--
+--   4. VIEWS. Views ARE in the write-target universe below (`relkind in ('r','v','m','p')`), and
+--      that is a correction. The first revision scanned base tables only and justified it with
+--      "a write to a view is a write to its base table, which this set already contains" — true
+--      of the EFFECT and FALSE as a property of a REGEX, which matches the name written, not the
+--      name resolved. An `insert into agent_board.<auto-updatable view>` was therefore invisible.
+--      Including views closes it. Measured today: agent_board has 26 views and NO function writes
+--      one, so the arm is real but UNEXERCISED against shipped code — a fact about today's
+--      catalog, not a property of the scan. Only the 59 BASE tables are pinned as the universe
+--      canary; the view count is deliberately not pinned, because a new read-model view is
+--      routine and should not red an enforcement file.
+--
+--   5. REFERENTIAL ACTIONS. A CASCADE or SET NULL is a write path with no privilege, no function
+--      and no body. #317 measured this on `board_memberships` (2 rows to 0 on one
+--      `delete from boards`). Across this class: 88 writing edges — 74 CASCADE plus 14 SET NULL —
+--      from 19 parent relations, ONE OF WHICH IS `auth.users`, outside agent_board (WEC-22,
+--      WEC-23). An earlier revision counted CASCADE only while claiming to cover the class, which
+--      is why the SET NULL arm is named here rather than left to a filter. Nothing gates them.
+--
+--   6. REGEX, NOT A PARSER. The write-statement pattern is REUSED from
+--      agent_board_receipt_subject_gate.test.sql rather than rewritten, so there is one pattern
+--      to fix and not two to drift. From there it knows `merge into`, `update only`,
+--      `truncate [table] [only]`, quoted identifier parts and whitespace around the schema dot.
+--      It is reused but NOT verbatim: neither of that file's two alternations has a `copy` arm,
+--      so `copy agent_board.threads (…) from …` left the class unchanged and every assertion
+--      GREEN (mutation o). `copy` is folded in here. `COPY … TO`, a READ, now matches too — the
+--      fail-CLOSED direction, over-reporting loudly. The receipt file on main still lacks the
+--      arm: a pre-existing gap in a DIFFERENT file, recorded and not fixed in a test-only change.
+--      Relation names are interpolated unescaped; every agent_board relname is `[a-z_]+` today.
+--
+-- ===========================================================================================
+-- MECHANICS THAT ARE NOT OPTIONAL HERE (each cost a review round elsewhere in this repo).
+-- ===========================================================================================
+--
+--   * `stripped_body(oid, TRUE)` — KEEP LITERALS — for every predicate matching an error code or
+--     a marker. `42501` lives in `using errcode = '42501'`, a STRING LITERAL, and the DEFAULT
+--     mode strips literals: asking the default returns 0 and silently inverts the answer. Note
+--     the asymmetry that makes both modes correct in their place — literals are KEPT where a
+--     literal is the evidence, and `fn_call_closure` reads the DEFAULT so a function named inside
+--     a string cannot manufacture a call edge.
+--
+--   * No message string below contains a space-hyphen-hyphen-space sequence. A repo lint strips
+--     `--` to end of line even inside a quoted string, so one in a message swallows the following
+--     statements and reports unrelated files. Em dashes throughout.
+--
+--   * Every state-mutating RPC call runs inside `lives_ok($$ … $$)` with the result captured to a
+--     table that EXISTS BEFORE the call, never bare and never inside `is((select … from rpc(…)))`.
+--     A raise in the bare form aborts the transaction and pgTAP emits NO `not ok` (#113).
+--
+--   * `create_thread` returns TABLE, so it is called as `select * from …`, not projected.
+--
+-- ===========================================================================================
+-- MUTATION EVIDENCE — 30 mutations, every row MEASURED against this working tree's bundle on a
+-- scratch database, never predicted. `ran = 23/23` confirmed on EVERY row: a mutation that fails
+-- loudly but TRUNCATES the run hides every assertion after the abort, and three mutations in #317
+-- did exactly that. WEC-N === TAP assertion N by construction, verified mechanically.
+--
+-- EACH MUTATION WAS VERIFIED APPLIED AGAINST pg_catalog, not by the file having changed — a
+-- `create or replace` whose text changed but whose meaning did not is semantically inert, and an
+-- inert mutation that reds nothing is indistinguishable from a hole. The verification probe
+-- tracks the CLOSURE membership rule: an own-body probe would have called the wrapper attack
+-- below "class 59 -> 59", i.e. inert, while the file saw a new member. Each mutation ran inside
+-- the SAME transaction the test file rolls back; no leftovers, confirmed by query afterwards.
+--
+--   mut    what                                          VERIFY (catalog)         -> red
+--   -----  --------------------------------------------  -----------------------  --------------
+--   w      THE WRAPPER ATTACK. An authenticated function  class 59 -> 60           3, 5, 8, 9
+--          whose whole body is `perform
+--          agent_board._upsert_delivery_recipient(…)`
+--          THE ROW THE TRANSITIVE-MEMBERSHIP REVISION EXISTS FOR. Under own-body membership it
+--          reddened NOTHING: class stayed 44, all 23 assertions GREEN, while an authenticated
+--          caller could UPDATE `threads` and INSERT `delivery_recipients` with no session
+--          derivation and no gate. It is #324's hole with one extra call.
+--   x      A NEW UNGATED WRITER WHOSE ONLY 42501 IS       strict-raise match       3, 5, 8, 9
+--          PROSE: `raise notice 'see errcode 42501 …'`     -> false
+--          THE GUARD-DEFEATED-BY-PROSE ROW. Under the digits-only spelling this matched the
+--          "raises" test, was EXCLUDED from the WEC-8 category, counted as GATED, and reddened
+--          ONLY WEC-3 — which is exactly what WEC-3's own rationale says it may not rely on.
+--          Closed by requiring the SYNTAX of a raise; see the `_wec_raise_pat` note.
+--   y      a new ON DELETE SET NULL foreign key into      SET NULL edges on        1, 22, 23
+--          `agent_board.threads`                           threads 0 -> 1
+--          Reddened NOTHING while WEC-22/23 filtered `confdeltype = 'c'` and limit 5 claimed the
+--          function-less path was counted across the class. 14 such edges already existed.
+--   z      a gater spelled `raise insufficient_privilege` strict-raise match       3
+--          rather than with the SQLSTATE                   -> true
+--          A CORRECTNESS ROW, not an attack: it is properly gated, so redding ONLY WEC-3 (the
+--          class exact set) is the RIGHT answer. Under the digits-only spelling it fell into the
+--          WEC-8 category instead — fail-closed, so nothing shipped wrong, but a wrong diagnosis.
+--   v      an auto-updatable VIEW over a class relation   class 59 -> 60           2, 3, 5, 8, 9
+--          plus an authenticated function inserting into
+--          the VIEW rather than the relation
+--          Also GREEN before the rework: the target universe was base tables only, and the scan
+--          matches the name WRITTEN, not the relation it resolves to.
+--   a      a NEW ungated authenticated writer with        class 59 -> 60           3, 5, 8, 9
+--          direct DML and no gate
+--   b      an ungated authenticated OVERLOAD of           overloads 1 -> 2         3, 5, 8, 9
+--          `create_thread`
+--          PER-OID PROOF: the gated sibling still supplies the NAME.
+--   c      `create_thread` drops its                      closure edge 1 -> 0      5, 8, 9,
+--          `_resolved_actor_agent_id` call                                          14, 15, 16
+--          Reds WEC-8 and leaves nothing of the behavioural probe standing. It also reds 14/15
+--          BECAUSE the allow side now supplies a NULL actor id: with the resolver gone there is
+--          nothing to write, which is the actor-binding property the NULL upgrade bought.
+--   d      `set_board_role_gate` loses its ONLY authority own-body raise           8, 9
+--          check (owner gate + its 42501)                  true -> false            (5 STAYS GREEN)
+--          THE DISCRIMINATING MUTATION: the writer still derives its actor, so Half A passes, and
+--          it now refuses NOBODY.
+--   e      `fn_call_closure()` shimmed to zero rows       closure rows -> 0        2, 3, 4, 7, 8,
+--                                                                                   18, 22, 23
+--          THE FAIL-OPEN INVERSION, MEASURED. WEC-5 and WEC-9 stay GREEN — they are "violating
+--          set is empty" over a population now drawn FROM the closure, so an empty closure
+--          empties the population and they pass over nothing. Under own-body membership they
+--          RED. What catches it instead: the exact-set population pins (2, 3, 8), the privilege
+--          and referential sets that also derive from the class (18, 22, 23), and WEC-4, the
+--          delegation-liveness assertion added for exactly this. Eight assertions red — but NOT
+--          the two half assertions, and that is the honest shape of the trade.
+--   f      `merge into only "agent_board"."threads"`      class 59 -> 60           3, 5, 8, 9
+--   g      `truncate table only agent_board.presence`     class 59 -> 60           3, 5, 8, 9
+--   h      an authenticated function writing a NEW table  class 59 -> 60           1, 2, 3, 5, 8, 9
+--   i      `grant insert on agent_board.threads` to anon  anon INSERT -> true      17, 19
+--   j      `grant insert on agent_board.threads` to a     new role INSERT          19
+--          BRAND-NEW role                                  -> true
+--          THE THREE-ARM PROOF: `j` reds ONLY the aclexplode arm. WEC-17 names
+--          authenticated/anon, WEC-18 names service_role, so a role neither mentions self-names
+--          nowhere else. Neither arm subsumes the other.
+--   k      `_resolved_actor_agent_id` stops raising       own-body raise           11, 16
+--                                                          true -> false
+--          WHY WEC-11 IS AN ASSERTION AND NOT A SENTENCE. WEC-8 stays GREEN: it asks which
+--          resolver each member REACHES, and the resolver is still reached, still called, still
+--          there — it has simply stopped refusing. WEC-11 is the only structural catch.
+--   l      a new ON DELETE CASCADE foreign key into       cascade fks on           1, 22, 23
+--          `agent_board.threads`                           threads 0 -> 1
+--   m      a new table `threads_archive` plus an          class 59 -> 60           1, 2, 3, 5, 8, 9
+--          authenticated writer of it
+--          NOT THE NEGATIVE PIN IT WAS DESIGNED TO BE, recorded rather than quietly dropped. The
+--          intent was #287's `read_receipts_archive` case — a writer of a LOOK-ALIKE relation
+--          must not be attributed to the real one — but any new agent_board relation joins the
+--          target universe by construction, so this is a CORRECT new member. The boundary
+--          property was measured DIRECTLY instead and HOLDS: the scan attributes that writer to
+--          `threads_archive` and to NOTHING ELSE, in particular not to `threads`, while the
+--          control `create_thread` is attributed to `threads`. That is the `\M` right-hand
+--          boundary working, with a positive control beside it so a clean result cannot mean a
+--          pattern matching nothing.
+--   mctl   `m` plus a REAL new writer in the same         class 59 -> 61           1, 2, 3, 5, 8, 9
+--          transaction
+--   n      a writer whose INSERT lives inside an          class 59 -> 60           3, 5, 8, 9
+--          `EXECUTE` STRING LITERAL
+--          What `keep_literals = true` buys beyond error codes: dynamic SQL lives in a literal,
+--          and the DEFAULT mode would strip this writer's only statement and report it clean.
+--   o      `copy agent_board.threads (…) from …`          class 59 -> 60           3, 5, 8, 9
+--          FOUND A REAL HOLE AND CLOSED IT. Before `copy` joined the alternation this function
+--          was invisible and every assertion GREEN. The plan listed `copy` as a battery row and
+--          the pattern it told this file to reuse has no `copy` arm in EITHER alternation, so
+--          "the pattern already knows copy" was false; only running the row showed it.
+--   p5     a new function whose NAME matches the          shape names 3 -> 4       6
+--          derivation-shape pattern
+--   p6     a SECOND writer with `auth.uid()` in its own   own-body auth.uid        3, 7, 8, 9
+--          body                                            writers 1 -> 2
+--   p10    a new boolean `_agent_can_frobnicate`          predicate set 11 -> 12   10
+--   p12    `_require_platform_admin_user_id` stops        own-body raise           12
+--          raising                                         true -> false
+--   p13    `current_agent_id` STARTS raising 42501        own-body raise           13, 14, 15, 16
+--                                                          false -> true
+--          The direction matters: if it raised, it would count as a refusal and WEC-8 would
+--          silently widen what "gated" means.
+--   p1415  `create_thread` refuses EVERYBODY              body raises, no INSERT   3, 8, 14, 15
+--          (unconditional raise)
+--          THE ALLOW SIDE EARNING ITS PLACE. A gate admitting NOBODY leaves the DENY assertion
+--          (16) GREEN; only WEC-14/15 catch it.
+--   p18    one service_role privilege revoked from the    service_role DELETE on   18
+--          pinned exact set                                fleet_machines -> false
+--   p20    `revoke insert on agent_board.threads`         postgres INSERT          14, 15, 20
+--          from `postgres`                                 -> false
+--   p21    `revoke select on agent_board.threads`         authenticated SELECT     21
+--          from `authenticated`                            -> false
+--
+-- COVERAGE: the union of the red columns above is EXACTLY assertions 1 through 23 — every
+-- assertion in this file goes red under at least one mutation.
+--
+-- SUBSUMPTION, measured rather than claimed away. WEC-9's red-set is a strict SUBSET of WEC-8's:
+-- no row reds 9 without 8, while `e` and `p1415` red 8 without 9. WEC-9 is therefore a STATEMENT
+-- of the class-wide property, not an independent pin, and it says so at its own site. The
+-- membership assertion that used to sit beside WEC-8 was subsumed the same way and was DELETED;
+-- WEC-9 is kept because deleting it would leave the file's headline claim existing only as an
+-- inference from a sixteen-member category listing.
+--
+-- WHAT NO MUTATION REDDENED, disclosed rather than left for a reviewer to find: a new writer that
+-- is CORRECTLY GATED reds only WEC-3, the exact class set (mutation z is exactly this case). That
+-- is by construction — a gated writer violates neither half — but it makes WEC-3 the sole
+-- tripwire for that case, and the routine response to a red exact set is to add the name. Adding
+-- the name is the correct fix HERE, unlike bumping a count, only because WEC-5/8/9 independently
+-- establish that the added member is gated. THAT RATIONALE WAS TOO BROAD BEFORE mutation x: with
+-- the digits-only raise spelling, a prose-42501 writer satisfied WEC-8 and WEC-9 by evasion, so
+-- for that one shape they established nothing and WEC-3 really was alone. The strict raise
+-- pattern is what makes the sentence true again.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(23);
+
+-- ===========================================================================================
+-- THE CLASS, derived from pg_catalog. Nothing below is a list of names.
+-- ===========================================================================================
+-- The write-target universe. `relkind in ('r','v','m','p')` — base tables, views, matviews and
+-- partitioned parents. Views are here because the scan matches the name a statement WRITES, not
+-- the relation it ultimately resolves to; see limit 4.
+create temp table _wec_target on commit drop as
+select c.oid as reloid, c.relname::text as relname, c.relkind
+  from pg_class c
+ where c.relnamespace = 'agent_board'::regnamespace
+   and c.relkind in ('r', 'v', 'm', 'p');
+
+-- DIRECT writers: every agent_board function with a write statement in its own stripped body.
+-- The population is deliberately NOT restricted to authenticated-executable functions — the
+-- helpers are revoked from authenticated, and they are the ones that hold the DML. Restricting
+-- here is the mistake this revision corrects.
+create temp table _wec_direct on commit drop as
+select p.oid as fn_oid, t.relname, t.relkind
+  from pg_proc p
+  cross join _wec_target t
+ where p.pronamespace = 'agent_board'::regnamespace
+   and p.prokind in ('f','p')
+   and p.prolang <> (select oid from pg_language where lanname = 'internal')
+   and lower(agent_board_test.stripped_body(p.oid, true))
+       ~ ('(insert\s+into|merge\s+into|update|delete\s+from|truncate|copy)(\s+table)?(\s+only)?\s+'
+          || '(("?agent_board"?\s*\.\s*)?' || t.relname || '\M'
+          || '|("?agent_board"?\s*\.\s*)?"' || t.relname || '")');
+
+create temp table _wec_closure on commit drop as
+select * from agent_board_test.fn_call_closure();
+
+-- THE RAISE PATTERN, defined ONCE because it is used by three assertions and two copies drift.
+--
+-- It matches a RAISE, not the digits. The obvious spelling — `stripped_body(oid, true) ~ '42501'`
+-- — is PROSE-SATISFIABLE, and that is measured rather than feared: a function whose only 42501 is
+-- inside `raise notice 'see errcode 42501 for details'` matched it, was therefore EXCLUDED from
+-- the WEC-8 category and counted as GATED, and reddened only WEC-3. That is the
+-- guard-defeated-by-prose class this repo has been burned by before, and `keep_literals = true`
+-- is what makes it reachable here: literals must be kept so `using errcode = '42501'` is visible,
+-- and keeping them lets a message string speak too. The fix is to require the SYNTAX of a raise
+-- rather than the presence of the code. Mutation `x` pins it.
+--
+-- `insufficient_privilege` is in the alternation because it is 42501's condition NAME: a
+-- `raise insufficient_privilege` gater is a real refusal. Under the digits-only spelling it fell
+-- into the WEC-8 category — fail-CLOSED, so nothing shipped wrong, but with a wrong diagnosis.
+--
+-- WHAT IT STILL DOES NOT SEE, stated rather than discovered: `using errcode = v_code`, where the
+-- code is computed. Such a function reads as not-raising, lands in the WEC-8 category and must
+-- then satisfy the resolver arm — fail-CLOSED, and no agent_board function is written that way
+-- today (measured: this pattern and the digits-only one agree on ALL 67 shipped raisers; they
+-- differ only on the decoy).
+create temp table _wec_raise_pat on commit drop as
+select 'errcode\s*=\s*''?42501|sqlstate\s+''?42501|insufficient_privilege'::text as pat;
+
+-- THE POPULATION, per-OID and TRANSITIVE: an authenticated-executable root that reaches a direct
+-- writer through the call closure. `fn_call_closure()` is REFLEXIVE (every function reaches
+-- itself), so this single `exists` covers "writes in its own body" and "writes through a callee"
+-- without a second arm.
+--
+-- Overloads are separate functions with separate grants, so they are separate members: an
+-- ungated overload is a whole door, and its NAME is already spoken for by its gated sibling.
+--
+-- The signature is BUILT from `proargtypes`, not rendered by `regprocedure::text`, because
+-- `regprocedure` OMITS THE SCHEMA for anything visible on the current search_path — which this
+-- file's header puts `agent_board` on. `pg_get_function_identity_arguments` is not the fix
+-- either: it renders declared PARAMETER NAMES. `format_type` over `proargtypes` reproduces
+-- regprocedure's rendering exactly and depends on no session state.
+create temp table _wec_pop on commit drop as
+select distinct p.oid,
+       'agent_board.' || p.proname || '('
+         || coalesce((select string_agg(format_type(u.t, null), ',' order by u.ord)
+                        from unnest(p.proargtypes) with ordinality as u(t, ord)), '')
+         || ')' as sig
+  from pg_proc p
+ where p.pronamespace = 'agent_board'::regnamespace
+   and p.prokind in ('f','p')
+   and p.prolang <> (select oid from pg_language where lanname = 'internal')
+   and has_function_privilege('authenticated', p.oid, 'EXECUTE')
+   and exists (select 1 from _wec_closure cl
+                join _wec_direct d on d.fn_oid = cl.reached_oid
+               where cl.root_oid = p.oid);
+
+-- WEC-1. The universe canary. Without it, a write-target set that had gone empty would empty the
+-- writer population too. Base tables only — see limit 4 on why the 26 views are not pinned.
+select is(
+  (select count(*)::text from _wec_target where relkind = 'r'),
+  '59',
+  '#325 canary: agent_board has 59 base tables — the universe the write scan runs over, pinned so an empty violating set below cannot mean an empty universe');
+
+-- WEC-2. The relations the class writes, as an EXACT SET. A new one names itself.
+select is(
+  (select coalesce(array_agg(distinct d.relname order by d.relname), array[]::text[])
+     from _wec_direct d
+    where exists (select 1 from _wec_closure cl join _wec_pop p on p.oid = cl.root_oid
+                   where cl.reached_oid = d.fn_oid)),
+  array[
+        'agent_credentials',
+        'agent_signing_key_challenges',
+        'agent_signing_keys',
+        'agents',
+        'artifacts',
+        'board_authority_ceilings',
+        'board_invite_blocks',
+        'board_invite_redemptions',
+        'board_invite_tokens',
+        'board_membership_events',
+        'board_memberships',
+        'boards',
+        'callback_endpoints',
+        'callback_outbox_events',
+        'callback_subscriptions',
+        'claims',
+        'conflicts',
+        'delegation_policies',
+        'delegations',
+        'delivery_recipients',
+        'escalations',
+        'fleet_harness_registrations',
+        'fleet_machine_agents',
+        'fleet_machines',
+        'fleet_onboarding_invite_bounds',
+        'fleet_receive_policies',
+        'fleet_repo_scopes',
+        'fleet_revocation_events',
+        'fleet_trust_domains',
+        'inbox_items',
+        'messages',
+        'presence',
+        'read_receipts',
+        'send_authz_telemetry',
+        'task_events',
+        'tasks',
+        'threads'
+        ]::text[],
+  '#325: these 37 agent_board relations are written by an authenticated-executable function, directly or through a callee — five of them (board_invite_redemptions, board_membership_events, callback_outbox_events, delivery_recipients, send_authz_telemetry) were invisible while membership was own-body');
+
+-- WEC-3. The class itself, as an EXACT SET of SIGNATURES, and it is signatures rather than
+-- `count(*) = 59` for two reasons. The routine response to a red count is to bump the count,
+-- which absorbs the member the canary caught (#324). And under transitive membership this set is
+-- also the population tripwire for a dead closure: it fails against a 59-name expectation rather
+-- than passing over nothing.
+select is( -- pgtap-allow-raise-checked
+  (select coalesce(array_agg(p.sig order by p.sig), array[]::text[]) from _wec_pop p),
+  array[
+    'agent_board.acquire_claim(uuid,text,text,timestamp with time zone,uuid,uuid,jsonb)',
+    'agent_board.add_artifact(uuid,text,text,text,uuid,uuid,uuid,uuid,jsonb)',
+    'agent_board.append_task_event(uuid,uuid,text,jsonb,text,uuid,timestamp with time zone)',
+    'agent_board.block_board_inviter(uuid,uuid,uuid,jsonb)',
+    'agent_board.create_board(uuid,text,text,text,jsonb,text)',
+    'agent_board.create_fleet_onboarding_invite(uuid,uuid,text,text,text,text,text,text,text,integer,timestamp with time zone,uuid,jsonb)',
+    'agent_board.create_invite_link(uuid,text,text,integer,timestamp with time zone,uuid,jsonb)',
+    'agent_board.create_or_find_thread(uuid,text,text,text,jsonb)',
+    'agent_board.create_task(uuid,uuid,text,text,uuid,uuid,text,text,jsonb)',
+    'agent_board.create_tasking_delivery(uuid,uuid,text,text,jsonb,text,text,text,text,text,jsonb)',
+    'agent_board.create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)',
+    'agent_board.create_thread(uuid,text,text,jsonb)',
+    'agent_board.delegate_task(uuid,uuid,text,text,uuid,text,text,jsonb)',
+    'agent_board.delete_callback_endpoint(uuid,uuid)',
+    'agent_board.disable_callback_endpoint(uuid,uuid,text,jsonb)',
+    'agent_board.grant_board_role(uuid,uuid,text,uuid)',
+    'agent_board.heartbeat(uuid,uuid,text,text,interval,jsonb)',
+    'agent_board.invite_board_member(uuid,uuid,uuid,jsonb)',
+    'agent_board.issue_signing_key_challenge(uuid,text,interval)',
+    'agent_board.join_board(uuid,uuid,text,uuid,jsonb)',
+    'agent_board.leave_board(uuid,uuid,jsonb)',
+    'agent_board.mark_read(uuid,uuid,bigint)',
+    'agent_board.post_board_message(uuid,uuid,text,text,text,text,text,text,text,jsonb)',
+    'agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)',
+    'agent_board.post_message(uuid,uuid,text,text,uuid,jsonb)',
+    'agent_board.provision_agent(text,text,jsonb,uuid)',
+    'agent_board.raise_conflict(uuid,uuid,text,text,text,uuid,jsonb)',
+    'agent_board.raise_escalation(uuid,uuid,text,text,text,uuid,uuid,jsonb)',
+    'agent_board.record_signing_key_proof_result(uuid,uuid,text,boolean,text,jsonb)',
+    'agent_board.redeem_invite_link(text,jsonb)',
+    'agent_board.register_agent(text,text,text,text,jsonb)',
+    'agent_board.register_callback_endpoint(uuid,text,jsonb)',
+    'agent_board.register_fleet_machine(uuid,uuid,text,text,text,jsonb)',
+    'agent_board.release_claim(uuid)',
+    'agent_board.renew_claim(uuid,timestamp with time zone)',
+    'agent_board.request_join_board(uuid,uuid,jsonb)',
+    'agent_board.resolve_board_request(uuid,uuid,text,uuid,jsonb)',
+    'agent_board.resolve_conflict(uuid,uuid,jsonb)',
+    'agent_board.resolve_escalation(uuid,uuid,jsonb)',
+    'agent_board.revoke_agent(uuid,text)',
+    'agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)',
+    'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb)',
+    'agent_board.revoke_invite_link(text,jsonb)',
+    'agent_board.rotate_callback_signing_key(uuid,uuid,jsonb)',
+    'agent_board.self_enroll_human(text)',
+    'agent_board.send_direct_message(uuid,uuid,jsonb,text,text,text,text,text,text,jsonb)',
+    'agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)',
+    'agent_board.send_multicast_message(uuid,uuid,jsonb,text,text,text,text,text,text,jsonb)',
+    'agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)',
+    'agent_board.set_board_authority_ceiling(uuid,text,uuid)',
+    'agent_board.set_board_role_gate(uuid,boolean)',
+    'agent_board.set_fleet_receive_policy(uuid,text,text,boolean,uuid,uuid,jsonb)',
+    'agent_board.subscribe_callback_endpoint(uuid,uuid,text,text,uuid,jsonb)',
+    'agent_board.unblock_board_inviter(uuid,uuid,uuid)',
+    'agent_board.unsubscribe_callback_endpoint(uuid,uuid,text,text,uuid,jsonb)',
+    'agent_board.update_board_membership(uuid,uuid,text,jsonb)',
+    'agent_board.update_inbox_item_state(uuid,uuid,text,jsonb)',
+    'agent_board.upsert_delegation_policy(uuid,text,jsonb,integer,interval,boolean)',
+    'agent_board.verify_callback_endpoint(uuid,uuid,jsonb)'
+    ]::text[],
+  '#325: the effect-derived class is exactly these 59 authenticated-executable writer OVERLOADS — per-OID, and TRANSITIVE, so a delegating wrapper whose own body holds no DML is a member rather than a blind spot');
+
+-- WEC-4. THE DELEGATION-CHAIN LIVENESS PIN, and the mitigation for the fail-open inversion the
+-- header describes. Everything above depends on `fn_call_closure()` actually resolving edges; a
+-- closure that silently stopped doing so would EMPTY the population and make WEC-5 and WEC-9
+-- pass over nothing. This asserts one specific chain still exists, end to end and by name:
+-- `send_direct_message` reaches `post_message`, and `post_message` writes `messages`. It is
+-- EC-4's sink-name shape from agent_board_consent_gating.test.sql, aimed at the exact edge class
+-- this revision exists for — the send family, which is where #324's direct-body scan went wrong.
+select is(
+  (select (select count(*) from _wec_closure cl join pg_proc rp on rp.oid = cl.root_oid
+            where rp.pronamespace = 'agent_board'::regnamespace
+              and rp.proname = 'send_direct_message' and cl.reached_name = 'post_message')::text
+          || '/' ||
+          (select count(*) from _wec_direct d join pg_proc p on p.oid = d.fn_oid
+            where p.proname = 'post_message' and d.relname = 'messages')::text),
+  '2/1',
+  '#325 instrument liveness: BOTH send_direct_message overloads reach post_message, and post_message writes messages — the delegation chain is real, so a closure that stopped resolving edges reds HERE instead of silently emptying the class');
+
+-- ===========================================================================================
+-- HALF A — every writer derives its actor FROM THE SESSION.
+-- ===========================================================================================
+-- FOUR shapes. Scoring against only `_resolved_actor_agent_id` and `current_agent_id` produced
+-- three false "blocking adjudications" during planning, one flagged as a possible weakly-gated
+-- destructive verb; all three were correctly gated by shapes the predicate did not know. A class
+-- assertion is only as complete as its list of what COUNTS as satisfying it — the mirror image of
+-- rule 1, and the same failure. WEC-6 is the catalog query that keeps that list honest.
+--
+-- `auth.uid()` is matched in the writer's OWN body, and that is the difference between an
+-- assertion and a tautology: it lives in the `auth` schema so it forms no closure edge of its
+-- own, but two agent_board functions call it, so "something in my closure mentions auth.uid()"
+-- matches 59 of 59. Scored on the own body it matches exactly one — WEC-7 pins that.
+-- WEC-5.
+select is(
+  (select coalesce(array_agg(p.sig order by p.sig), array[]::text[])
+     from _wec_pop p
+    where not exists (
+            select 1 from _wec_closure cl
+             where cl.root_oid = p.oid
+               and cl.reached_name in ('_resolved_actor_agent_id', 'current_agent_id',
+                                       '_require_platform_admin_user_id'))
+      and lower(agent_board_test.stripped_body(p.oid, true)) !~ 'auth\s*\.\s*uid\s*\('),
+  array[]::text[],
+  '#325 HALF A: EVERY authenticated-executable writer derives its actor from the SESSION — see the header on why this spelling is fail-OPEN against a dead closure and which assertions cover that');
+
+-- WEC-6. The derivation-shape set, from the catalog. Two of the three are also named by hand in
+-- WEC-5, so a rename or a pattern drift would silently SHRINK what counts as satisfying Half A
+-- and make it easier to pass. This makes that drift loud.
+select is(
+  (select coalesce(array_agg(p.proname::text order by p.proname::text), array[]::text[])
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and p.proname ~ 'current_agent_id|resolved_actor|require_platform_admin'),
+  array['_require_platform_admin_user_id', '_resolved_actor_agent_id', 'current_agent_id']::text[],
+  '#325 canary: the agent_board session-derivation shapes are exactly these three — a fourth, or a rename, fails here and names itself instead of quietly leaving Half A short');
+
+-- WEC-7. The anti-vacuity pin for Half A's fourth shape.
+select is(
+  (select coalesce(array_agg(p.sig order by p.sig), array[]::text[])
+     from _wec_pop p
+    where lower(agent_board_test.stripped_body(p.oid, true)) ~ 'auth\s*\.\s*uid\s*\('),
+  array['agent_board.self_enroll_human(text)']::text[],
+  '#325: exactly ONE writer derives from raw auth.uid() — self_enroll_human CREATES the identity a session would resolve to, so it cannot use the resolver; scored on the own body because the closure form matches all 59 and would make Half A vacuous');
+
+-- ===========================================================================================
+-- HALF B — every writer REFUSES SOMEBODY. Labelled honestly: it pins that a refusal exists on the
+-- path, NOT that the refusal admits the right people. Only WEC-14..17 speak to that, for one
+-- member.
+-- ===========================================================================================
+-- WEC-8. THE SESSION-DERIVATION-ONLY CATEGORY, and the resolver each member relies on, in ONE
+-- assertion carrying both readings. These are the writers that reach NO shared authz predicate
+-- and raise no 42501 of their own; the plan predicts the set is EMPTY and measured it has 16
+-- members. Their authority check is not absent, it is the RESOLVER — which REFUSES an absent
+-- session and a mismatched actor id with 42501.
+--
+-- IT IS ONE ASSERTION BECAUSE TWO WOULD NOT HAVE BEEN TWO PINS. A previous revision put a
+-- separate "here are the 16" exact set beside this one; a review seat showed the pair set
+-- STRICTLY SUBSUMES it — every membership change alters a pair, so the membership assertion
+-- could never red alone and added no detection power. Merged rather than kept for symmetry, and
+-- NOT repaired by restricting either one to the 16 literal names, which would substitute a hand
+-- list for a derived set: rule 1's own anti-pattern. The pair array below still NAMES every
+-- member, so a new ungated writer joins it and names itself.
+--
+-- What the pairs buy over bare membership: a member that LOSES its resolver renders
+-- `(NO RAISING RESOLVER)` and reds, and a member that silently SWITCHES which resolver it trusts
+-- reds too. Measured distinct from WEC-9 in both directions — mutation c reds this one and
+-- leaves WEC-9 green; mutation d reds both.
+--
+-- `current_agent_id` is deliberately absent from the pair vocabulary: it RETURNS NULL rather than
+-- raising (pinned by WEC-13), so counting it would let a writer whose only derivation is a
+-- nullable lookup read as refusing.
+select is( -- pgtap-allow-raise-checked
+  (select coalesce(array_agg(x.pair order by x.pair), array[]::text[])
+     from (select p.sig || ' -> ' ||
+                  coalesce((select string_agg(distinct cl.reached_name, '+' order by cl.reached_name)
+                              from _wec_closure cl
+                             where cl.root_oid = p.oid
+                               and cl.reached_name in ('_resolved_actor_agent_id',
+                                                       '_require_platform_admin_user_id')),
+                           '(NO RAISING RESOLVER)') as pair
+             from _wec_pop p
+            where not exists (
+                    select 1 from _wec_closure cl
+                      join pg_proc ap on ap.oid = cl.reached_oid
+                     where cl.root_oid = p.oid
+                       and ap.pronamespace = 'agent_board'::regnamespace
+                       and ap.prorettype = 'boolean'::regtype
+                       and (ap.proname ~ '^_(current_)?agent_(can|has)_'
+                            or ap.proname ~ '^_grant_within_'
+                            or ap.proname in ('_invite_permitted', '_membership_consent_present')))
+              and lower(agent_board_test.stripped_body(p.oid, true)) !~ (select pat from _wec_raise_pat)) x),
+  array[
+    'agent_board.block_board_inviter(uuid,uuid,uuid,jsonb) -> _resolved_actor_agent_id',
+    'agent_board.create_or_find_thread(uuid,text,text,text,jsonb) -> _resolved_actor_agent_id',
+    'agent_board.create_thread(uuid,text,text,jsonb) -> _resolved_actor_agent_id',
+    'agent_board.delete_callback_endpoint(uuid,uuid) -> _resolved_actor_agent_id',
+    'agent_board.disable_callback_endpoint(uuid,uuid,text,jsonb) -> _resolved_actor_agent_id',
+    'agent_board.issue_signing_key_challenge(uuid,text,interval) -> _resolved_actor_agent_id',
+    'agent_board.provision_agent(text,text,jsonb,uuid) -> _require_platform_admin_user_id',
+    'agent_board.register_callback_endpoint(uuid,text,jsonb) -> _resolved_actor_agent_id',
+    'agent_board.revoke_agent(uuid,text) -> _require_platform_admin_user_id',
+    'agent_board.rotate_callback_signing_key(uuid,uuid,jsonb) -> _resolved_actor_agent_id',
+    'agent_board.subscribe_callback_endpoint(uuid,uuid,text,text,uuid,jsonb) -> _resolved_actor_agent_id',
+    'agent_board.unblock_board_inviter(uuid,uuid,uuid) -> _resolved_actor_agent_id',
+    'agent_board.unsubscribe_callback_endpoint(uuid,uuid,text,text,uuid,jsonb) -> _resolved_actor_agent_id',
+    'agent_board.update_inbox_item_state(uuid,uuid,text,jsonb) -> _resolved_actor_agent_id',
+    'agent_board.upsert_delegation_policy(uuid,text,jsonb,integer,interval,boolean) -> _resolved_actor_agent_id',
+    'agent_board.verify_callback_endpoint(uuid,uuid,jsonb) -> _resolved_actor_agent_id'
+    ]::text[],
+  '#325 HALF B, part 1: exactly these 16 writers reach NO shared authz predicate and raise no 42501 of their own, and each NAMES the raising resolver it relies on — 14 the session resolver, 2 the platform-admin one; a new ungated writer joins this set, and a member that loses or switches its resolver reds here');
+
+-- WEC-9. The union, and the only assertion here that is a claim about the WHOLE class rather than
+-- about a category. Not spelled over the CLOSURE for 42501: that form is satisfied by 59 of 59
+-- through the resolver alone, so it would restate Half A and no mutation could red it.
+--
+-- ITS DETECTION IS SUBSUMED BY WEC-8, and saying so is the point rather than a caveat. Any member
+-- that lands in this violating set is by construction in WEC-8's category with the pair
+-- `(NO RAISING RESOLVER)`, so WEC-9 cannot red without WEC-8 redding too. Measured across the
+-- whole battery: no row reds 9 without 8, while `e` and `p1415` red 8 without 9.
+--
+-- It is KEPT anyway, and this is a deliberate exception to "a duplicate is not a second pin" —
+-- the same reasoning that MERGED the old membership assertion into WEC-8 would delete this one
+-- too. The difference is what the two assert. WEC-8 is a statement about sixteen named functions;
+-- this is the statement of the file's HEADLINE PROPERTY over all 59, and a class-enforcement file
+-- whose class-wide claim exists only as an inference from a category listing is the "comment
+-- claims what no assertion does" shape. So it is retained as a STATEMENT with no independent
+-- detection power, labelled as such, rather than presented as a third pin.
+select is(
+  (select coalesce(array_agg(p.sig order by p.sig), array[]::text[])
+     from _wec_pop p
+    where not exists (
+            select 1 from _wec_closure cl
+              join pg_proc ap on ap.oid = cl.reached_oid
+             where cl.root_oid = p.oid
+               and ap.pronamespace = 'agent_board'::regnamespace
+               and ap.prorettype = 'boolean'::regtype
+               and (ap.proname ~ '^_(current_)?agent_(can|has)_'
+                    or ap.proname ~ '^_grant_within_'
+                    or ap.proname in ('_invite_permitted', '_membership_consent_present')))
+      and lower(agent_board_test.stripped_body(p.oid, true)) !~ (select pat from _wec_raise_pat)
+      and not exists (
+            select 1 from _wec_closure cl
+             where cl.root_oid = p.oid
+               and cl.reached_name in ('_resolved_actor_agent_id',
+                                       '_require_platform_admin_user_id'))),
+  array[]::text[],
+  '#325 HALF B, part 2: EVERY writer reaches a shared predicate, OR raises 42501 in its own text, OR reaches a raising resolver — it pins that a refusal exists on the path, NOT that the refusal admits the right people');
+
+-- WEC-10. The authorization-predicate set, from the catalog, shared with #310 deliberately —
+-- two files disagreeing about what counts as gated is worse than either being wrong.
+-- `_is_service_role` is excluded BY PATTERN, not by name: it discriminates a role, it does not
+-- authorize, and counting it would let a function that only checks it read as gated.
+select is(
+  (select coalesce(array_agg(p.proname::text order by p.proname::text), array[]::text[])
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and p.prorettype = 'boolean'::regtype
+      and (p.proname ~ '^_(current_)?agent_(can|has)_'
+           or p.proname ~ '^_grant_within_'
+           or p.proname in ('_invite_permitted', '_membership_consent_present'))),
+  array['_agent_can_access_thread', '_agent_has_board_access', '_current_agent_can_access_task',
+        '_current_agent_can_access_thread', '_current_agent_can_mutate_task',
+        '_current_agent_can_post_to_thread', '_current_agent_can_send_to_board',
+        '_current_agent_has_board_access', '_grant_within_ceiling', '_invite_permitted',
+        '_membership_consent_present']::text[],
+  '#325 canary: the shared authorization-predicate set is exactly these eleven — over the 59 this arm is LOAD-BEARING (5 writers reach a predicate and raise no 42501 of their own), which was not true of the narrower class');
+
+-- WEC-11 and WEC-12. The two facts WEC-8 rests on, asserted rather than assumed. Without them a
+-- resolver that stopped raising would leave WEC-8 green while its meaning evaporated: the 16
+-- would still REACH it, and it would no longer refuse anybody. Measured — mutation k does exactly
+-- that and WEC-8 stays GREEN, so these are the pins, not a restatement.
+-- keep_literals = true is mandatory: `42501` is a string literal in `using errcode = '42501'`.
+-- WEC-11.
+select ok(
+  lower(agent_board_test.stripped_body(
+    (select oid from pg_proc where pronamespace = 'agent_board'::regnamespace
+      and proname = '_resolved_actor_agent_id'), true)) ~ '42501',
+  '#325: _resolved_actor_agent_id RAISES 42501 — the fact WEC-8 rests on, so the exemption category cannot go hollow while its assertion stays green');
+
+-- WEC-12.
+select ok(
+  lower(agent_board_test.stripped_body(
+    (select oid from pg_proc where pronamespace = 'agent_board'::regnamespace
+      and proname = '_require_platform_admin_user_id'), true)) ~ '42501',
+  '#325: _require_platform_admin_user_id RAISES 42501 — the same fact for the platform-admin arm of WEC-8');
+
+-- WEC-13. The negative half of the pair, and the reason `current_agent_id` is excluded from
+-- "raising". If it ever starts raising, this reds and the exclusion should be revisited — the
+-- exclusion is currently the STRICTER choice, so a failure here means WEC-8 is being harder than
+-- it needs to be, not that it has gone soft.
+select ok(
+  lower(agent_board_test.stripped_body(
+    (select oid from pg_proc where pronamespace = 'agent_board'::regnamespace
+      and proname = 'current_agent_id'), true)) !~ (select pat from _wec_raise_pat),
+  '#325: current_agent_id does NOT raise — it returns NULL on an unresolved principal, which is why it is not counted as a refusal in WEC-8');
+
+-- ===========================================================================================
+-- THE BEHAVIOURAL PROBE. WEC-5..10 are SOURCE-SHAPE claims: they see that a refusal is reachable,
+-- never that it fires. These three make the claim evidence, for one representative of the 16.
+-- `create_thread` is chosen because it is the WEAKEST case in the class — nothing but the
+-- resolver stands between a caller and a `threads` row — so if the resolver refuses here, the
+-- category WEC-8 describes is real.
+-- ===========================================================================================
+create temp table _wec_agent (
+  label     text primary key,
+  agent_id  uuid,
+  user_id   uuid
+) on commit drop;
+
+create temp table _wec_thread (
+  label      text primary key,
+  thread_id  uuid,
+  subject    text
+) on commit drop;
+
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_u_a uuid;
+  v_u_b uuid;
+  v_a   uuid := gen_random_uuid();
+  v_b   uuid := gen_random_uuid();
+begin
+  v_u_a := public.ensure_github_user('wec-a-' || v_sfx, 'wec-a-' || v_sfx || '@example.test', 'wec-a-' || v_sfx, 'WEC A');
+  v_u_b := public.ensure_github_user('wec-b-' || v_sfx, 'wec-b-' || v_sfx || '@example.test', 'wec-b-' || v_sfx, 'WEC B');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_a, 'agent', 'wec-a-' || v_sfx, 'WEC A', 'active', v_u_a, v_u_a),
+         (v_b, 'agent', 'wec-b-' || v_sfx, 'WEC B', 'active', v_u_b, v_u_b);
+
+  insert into _wec_agent values ('a', v_a, v_u_a), ('b', v_b, v_u_b);
+end
+$$;
+
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select user_id from _wec_agent where label = 'a')::text, true);
+
+-- The ALLOW side runs first and is not decoration: a gate that refused EVERYBODY would satisfy
+-- the deny assertion below on its own, and the file would claim enforcement while describing a
+-- dead RPC. Measured — mutation p1415 makes create_thread refuse unconditionally and the deny
+-- assertion stays GREEN; only this pair catches it. The capture table exists BEFORE the call
+-- (#113) so a raise surfaces as a named `not ok` instead of aborting with no TAP output.
+-- WEC-14.
+-- p_created_by_agent_id is passed as NULL ON PURPOSE, and that is an upgrade a review seat asked
+-- for. Passing A's own id under A's session makes supplied == resolved, so the follow-up could
+-- not tell "the RESOLVER's return was written" from "the ARGUMENT was written" — it would have
+-- read as an actor-binding proof while proving only that the two agreed. With NULL supplied there
+-- is no argument to write, so the author column can only have come from the session. This is the
+-- one place in the file that speaks to limit 3 (reachability is not data flow), and it now
+-- speaks to it for real, for one member.
+select lives_ok(
+  $$ insert into _wec_thread
+       select 'self', t.thread_id, t.subject
+         from agent_board.create_thread(null::uuid, 'WEC self thread') t $$,
+  '#325 allow side: an authenticated agent creates a thread with NO supplied actor id [call succeeds]');
+
+-- WEC-15.
+select is(
+  (select created_by_agent_id from agent_board.threads
+    where id = (select thread_id from _wec_thread where label = 'self')),
+  (select agent_id from _wec_agent where label = 'a'),
+  '#325 allow side / ACTOR BINDING: the row was written and its author is agent A, which with a NULL supplied id can only have come from the SESSION — the write took effect, so the deny below is a refusal rather than a broken RPC');
+
+-- THE DENY SIDE USES THE NEAREST PRINCIPAL, not a stranger, and #310 is where that lesson was
+-- bought: a stranger is refused by any gate that checks anything at all, so it cannot tell
+-- "binds the actor to the session" apart from "checks that some agent exists". Agent B is a REAL,
+-- ACTIVE agent with its own live session identity. The only thing wrong with the call is that A
+-- is making it.
+-- WEC-16.
+select throws_ok(
+  $$ select * from agent_board.create_thread(
+       (select agent_id from _wec_agent where label = 'b'), 'WEC impersonation attempt') $$,
+  '42501',
+  'p_created_by_agent_id must match current_agent_id()',
+  '#325 deny side: agent A cannot create a thread AS agent B — the resolver refuses a real, active, NEAREST principal, which is the behaviour WEC-8 asserts only structurally');
+
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- ===========================================================================================
+-- THE STRUCTURAL BOUND — three arms, none of which subsumes the others (mutations i, j).
+-- ===========================================================================================
+create temp table _wec_class_tables on commit drop as
+select distinct d.relname, ('agent_board.' || quote_ident(d.relname))::regclass as reloid
+  from _wec_direct d
+ where exists (select 1 from _wec_closure cl join _wec_pop p on p.oid = cl.root_oid
+                where cl.reached_oid = d.fn_oid);
+
+-- WEC-17. The arm that matters for THIS class, and it HOLDS. Its MESSAGE is a correction: the
+-- earlier wording said this is "what makes the body scan a complete surface", and that conclusion
+-- is false — a write can go through a SECURITY DEFINER wrapper whose own body contains no DML,
+-- which is the entire defect this revision fixes. What the absence of a direct grant establishes
+-- is narrower and is all that is claimed now: authenticated and anon cannot write these relations
+-- WITHOUT going through some agent_board function. Which functions those are is WEC-3's job.
+select is(
+  (select coalesce(array_agg(r || ':' || pv || ':' || t.relname
+                             order by r || ':' || pv || ':' || t.relname), array[]::text[])
+     from _wec_class_tables t
+     cross join unnest(array['authenticated', 'anon']) as r
+     cross join unnest(array['INSERT', 'UPDATE', 'DELETE', 'TRUNCATE']) as pv
+    where has_table_privilege(r, t.reloid, pv)),
+  array[]::text[],
+  '#325: NEITHER authenticated NOR anon holds a direct write privilege on ANY of the 37 class relations — so for those two roles every write goes through some agent_board function; WEC-3 is what says which');
+
+-- WEC-18. The arm that DOES NOT hold, pinned as an exact set rather than omitted. service_role
+-- writes thirteen of these relations directly, with no function and no body — the structural
+-- bound simply does not cover that route. Spelled per relation:privilege so a DELETE appearing on
+-- a relation that had only INSERT names itself.
+select is(
+  (select coalesce(array_agg(pv || ':' || t.relname order by pv || ':' || t.relname), array[]::text[])
+     from _wec_class_tables t
+     cross join unnest(array['INSERT', 'UPDATE', 'DELETE', 'TRUNCATE']) as pv
+    where has_table_privilege('service_role', t.reloid, pv)),
+  array[
+        'DELETE:board_invite_blocks',
+        'DELETE:fleet_harness_registrations',
+        'DELETE:fleet_machine_agents',
+        'DELETE:fleet_machines',
+        'DELETE:fleet_receive_policies',
+        'DELETE:fleet_repo_scopes',
+        'DELETE:fleet_revocation_events',
+        'DELETE:fleet_trust_domains',
+        'INSERT:board_authority_ceilings',
+        'INSERT:board_invite_blocks',
+        'INSERT:board_invite_redemptions',
+        'INSERT:board_invite_tokens',
+        'INSERT:board_membership_events',
+        'INSERT:fleet_harness_registrations',
+        'INSERT:fleet_machine_agents',
+        'INSERT:fleet_machines',
+        'INSERT:fleet_receive_policies',
+        'INSERT:fleet_repo_scopes',
+        'INSERT:fleet_revocation_events',
+        'INSERT:fleet_trust_domains',
+        'INSERT:send_authz_telemetry',
+        'UPDATE:board_authority_ceilings',
+        'UPDATE:board_invite_redemptions',
+        'UPDATE:board_invite_tokens',
+        'UPDATE:fleet_harness_registrations',
+        'UPDATE:fleet_machine_agents',
+        'UPDATE:fleet_machines',
+        'UPDATE:fleet_receive_policies',
+        'UPDATE:fleet_repo_scopes',
+        'UPDATE:fleet_revocation_events',
+        'UPDATE:fleet_trust_domains'
+        ]::text[],
+  '#325: service_role holds direct DML on THIRTEEN of the 37 class relations — the plan asserts this bound holds and it DOES NOT; pinned as an exact set so the hole is bounded and a widening names itself');
+
+-- WEC-19. The rule-1-correct arm. WEC-17 and WEC-18 are hand lists of three role names between
+-- them, so an INSERT granted to a brand-new role self-names in NEITHER. This reads the ACL itself.
+-- aclexplode over pg_class.relacl rather than information_schema.role_table_grants: that view is
+-- filtered to roles the CURRENT user can see, and a privilege-dependent visibility filter has no
+-- place inside a completeness claim (#302).
+select is(
+  (select coalesce(array_agg(distinct coalesce(g.rolname, 'PUBLIC') || ':' || a.privilege_type
+                                      || ':' || t.relname
+                             order by coalesce(g.rolname, 'PUBLIC') || ':' || a.privilege_type
+                                      || ':' || t.relname), array[]::text[])
+     from _wec_class_tables t
+     join pg_class c on c.oid = t.reloid
+     cross join aclexplode(c.relacl) a
+     left join pg_roles g on g.oid = a.grantee
+    where a.privilege_type <> 'SELECT'
+      and coalesce(g.rolname, 'PUBLIC') not in ('postgres', 'service_role')),
+  array[]::text[],
+  '#325: NO grantee other than the owner and service_role holds a non-SELECT privilege on any class relation — a grant to PUBLIC or to a role no assertion here names fails HERE and names itself');
+
+-- WEC-20. The owner exclusion from WEC-19, asserted positively. An exclusion nobody checks is a
+-- place to hide a grantee, which is this repo's named soft spot.
+-- The OWNER claim is checked as ownership, over EVERY class relation, not inferred from two
+-- privileges on one table. The earlier form asserted INSERT and DELETE on `threads` and called
+-- that "is the table OWNER"; there was no `relowner` check anywhere in the file, so the label
+-- claimed more than the query. Both halves are asserted now: postgres owns all 37, and holds the
+-- write privileges the exclusion assumes.
+select ok(
+  (select count(*) from _wec_class_tables t join pg_class c on c.oid = t.reloid
+     where c.relowner <> 'postgres'::regrole) = 0
+    and has_table_privilege('postgres', 'agent_board.threads', 'INSERT')
+    and has_table_privilege('postgres', 'agent_board.threads', 'DELETE'),
+  '#325: postgres OWNS every one of the 37 class relations (pg_class.relowner, not inferred from a privilege) and holds writes on them — so the WEC-19 exclusion is a fact about ownership, not a carve-out');
+
+-- WEC-21. The over-revoke guard. A file that only ever asserts absence would call a schema with
+-- every privilege revoked a success.
+select ok(
+  has_table_privilege('authenticated', 'agent_board.threads', 'SELECT')
+    and has_table_privilege('service_role', 'agent_board.threads', 'SELECT'),
+  '#325: authenticated and service_role DO hold SELECT on a class relation — WEC-17 is a write revoke, not a dead schema');
+
+-- ===========================================================================================
+-- FUNCTION-LESS WRITE PATHS — referential actions that write a class relation with no privilege,
+-- no function and no body. Nothing above gates them; these two BOUND them so growth is visible.
+-- ===========================================================================================
+-- `confdeltype in ('c','n','d')` — CASCADE, SET NULL and SET DEFAULT — and the two non-cascade
+-- arms are a correction. An earlier revision filtered `= 'c'` while limit 5 claimed the
+-- function-less path was "counted across the whole class"; SET NULL performs an ungated UPDATE of
+-- a class relation and 14 such edges exist, including `agents_parent_agent_id_fkey`,
+-- `agent_signing_keys_revoked_by_agent_id_fkey` and
+-- `agent_credentials_replaced_by_credential_id_fkey`. The claim covered less than it said.
+-- RESTRICT and NO ACTION (3 and 25 edges) are deliberately excluded: they REFUSE the parent
+-- delete rather than writing the child. `confupdtype` is NO ACTION on all 116 foreign keys, so
+-- the update-side of the same class is empty today and is not pinned; it would need its own arm
+-- the day a referenced key becomes mutable.
+--
+-- Parents are rendered with their REAL schema, not a hardcoded `agent_board.` prefix, because one
+-- of them is NOT in agent_board: `auth.users`. Deleting a Supabase auth user SET NULLs
+-- `agents.auth_user_id`, which is a cross-schema function-less write into a class relation. The
+-- hardcoded form mislabelled it `agent_board.users`, a relation that does not exist.
+-- WEC-22. The parent relations, as an exact set. A NEW parent whose deletion cascades into a
+-- class relation names itself here.
+select is(
+  (select coalesce(array_agg(distinct pn.nspname || '.' || pc.relname
+                             order by pn.nspname || '.' || pc.relname), array[]::text[])
+     from _wec_class_tables t
+     join pg_constraint con on con.conrelid = t.reloid
+     join pg_class pc on pc.oid = con.confrelid
+     join pg_namespace pn on pn.oid = pc.relnamespace
+    where con.contype = 'f' and con.confdeltype in ('c', 'n', 'd')),
+  array[
+        'agent_board.agent_credentials',
+        'agent_board.agent_signing_keys',
+        'agent_board.agents',
+        'agent_board.board_invite_tokens',
+        'agent_board.boards',
+        'agent_board.callback_endpoints',
+        'agent_board.callback_subscriptions',
+        'agent_board.delegations',
+        'agent_board.delivery_recipients',
+        'agent_board.fleet_harness_registrations',
+        'agent_board.fleet_machines',
+        'agent_board.fleet_repo_scopes',
+        'agent_board.fleet_trust_domains',
+        'agent_board.inbox_items',
+        'agent_board.messages',
+        'agent_board.task_events',
+        'agent_board.tasks',
+        'agent_board.threads',
+        'auth.users'
+        ]::text[],
+  '#325: deleting a row in one of these 19 parents CASCADES or SET NULLs into a class relation — a write path with no privilege check and no function body, so no assertion in this file gates it; one parent is auth.users, i.e. outside agent_board entirely');
+
+-- WEC-23. The edge count. This IS a bare count and the hazard is stated rather than left for a
+-- reviewer: the routine response to a red count is to bump it, which absorbs a new cascade edge
+-- silently. It is safe here ONLY because WEC-22 names the parents independently — a new edge from
+-- a NEW parent reds both; a new edge from an EXISTING parent reds only this one and must be read
+-- as a real change to the ungated surface, never bumped without checking it.
+select is(
+  (select count(*)::text
+     from _wec_class_tables t
+     join pg_constraint con on con.conrelid = t.reloid
+    where con.contype = 'f' and con.confdeltype in ('c', 'n', 'd')),
+  '88',
+  '#325: 88 writing referential actions (74 CASCADE + 14 SET NULL) reach the 37 class relations — bump this number only after confirming the new edge is intended; see WEC-22, which names parents independently');
+
+select * from finish();
+
+rollback;