@consiliency/agent-board-schema 1.38.0 → 1.41.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.38.0",
+  "version": "1.41.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.38.0",
+  "packageVersion": "1.41.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 137,
-  "aggregateSha256": "bfe0b978234464938428a66199b75d2f8d028706517b4674f9ae11cae34c52d1",
+  "migrationCount": 139,
+  "aggregateSha256": "0c0daf769baedbae5243a7345d44df09613494c5ea2495b342222a7248dde6d0",
   "migrations": [
     {
       "order": 0,
@@ -1281,6 +1281,24 @@
       "sourceRef": "message-board",
       "bytes": 7204,
       "sha256": "464ae39acbd96330c5ad1c753fa1204ca290baa0d6f82d7d30d0ead4d2944d37"
+    },
+    {
+      "order": 137,
+      "id": "20260920000100_agent_board_realtime_credential_claim",
+      "filename": "20260920000100_agent_board_realtime_credential_claim.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 7556,
+      "sha256": "670d6e97ca84ef74ebd10a6ee102c328005a28aa48f8668ba444ce31b714cf02"
+    },
+    {
+      "order": 138,
+      "id": "20260921000100_agent_board_task_event_origin_posture",
+      "filename": "20260921000100_agent_board_task_event_origin_posture.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 48237,
+      "sha256": "c515e9cd08b73c118de64125da94735979add5d1128d3ff070ff904af77fef81"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 137)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 139)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(137);
+    expect(manifest.migrationCount).toBe(139);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -222,6 +222,29 @@ describe('manifest integrity', () => {
       // names. Definition-only: CREATE OR REPLACE with the identical signature, grants and
       // COMMENT restated in the same migration.
       '20260919000100_agent_board_signed_write_model_key.sql',
+      // #341 RTCREDCLAIM. `current_agent_id()` read the agent_credential_id claim ONLY from
+      // `request.jwt.claim.agent_credential_id`, which PostgREST sets and Realtime does not --
+      // so on a postgres_changes subscription the claim read NULL, NULL took the permissive
+      // branch by design, and the branch requiring a non-revoked credential never executed.
+      // Credential revocation did not stop realtime delivery. Measured: a JWT carrying a bogus
+      // credential still received its rows in 542ms. The fix is the coalesce shape auth.uid()
+      // has always used -- read the per-claim GUC, else `request.jwt.claims ->> ...` -- which is
+      // exactly why auth.uid() survived the same gap. Nothing is loosened: absence in BOTH
+      // sources still takes the permissive branch. Definition-only: CREATE OR REPLACE with the
+      // identical signature, grants and COMMENT restated in the same migration.
+      '20260920000100_agent_board_realtime_credential_claim.sql',
+      // #288 ORIGINPOSTURE. v_task_tree.verification_status was NULL for every task_event
+      // except the two written by a signed wrapper, and NULL cannot be told apart from
+      // "evidence was lost", "the writer forgot" and "unsigned on purpose". The class was
+      // derived by CALL CLOSURE (a member iff its closure reaches an INSERT INTO task_events):
+      // 12 members, where the issue body said 8 and its own triage comment said 5-6 -- neither
+      // naming create_tasking_delivery or signed_create_tasking_delivery. task_events gains
+      // origin_posture NOT NULL with NO DEFAULT, so a new direct-INSERT writer cannot insert at
+      // all; the funnel body moves behind an ungranted _append_task_event whose posture
+      // parameter is FIRST and undefaulted, which is what makes "no default" structural --
+      // PostgreSQL refuses a default before non-defaulted parameters. Nothing is DROPped: both
+      // public signatures stay byte-identical, so ACLs and COMMENTs survive.
+      '20260921000100_agent_board_task_event_origin_posture.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_auth_rls.test.sql

@@ -72,10 +72,15 @@ begin
     (v_task_a, v_thread_a, v_agent_a, v_agent_a, v_task_a, 'Auth RLS Task A', 'medium', 'distributed'),
     (v_task_b, v_thread_b, v_agent_b, v_agent_b, v_task_b, 'Auth RLS Task B', 'medium', 'distributed');
 
-  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload)
+  -- #288: origin_posture is NOT NULL with no default, so this raw fixture insert must declare
+  -- one like any other writer. It emulates create_task's seq-1 'created' event, so it declares
+  -- create_task's own posture rather than a test-only placeholder -- a fixture that labelled
+  -- itself differently from the writer it stands in for would make OP-15-style invariants
+  -- assert against a shape production never produces.
+  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload, origin_posture)
   values
-    (v_task_a, v_thread_a, v_agent_a, 1, 'created', '{}'::jsonb),
-    (v_task_b, v_thread_b, v_agent_b, 1, 'created', '{}'::jsonb);
+    (v_task_a, v_thread_a, v_agent_a, 1, 'created', '{}'::jsonb, 'unattested:signed-metadata-rpc'),
+    (v_task_b, v_thread_b, v_agent_b, 1, 'created', '{}'::jsonb, 'unattested:signed-metadata-rpc');
 
   insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, message_type, body)
   values

package/tests/agent_board_realtime_credential_claim.test.sql

@@ -0,0 +1,301 @@
+-- #341 — the credential branch of `current_agent_id()` must run on BOTH claim transports.
+--
+-- WHY THIS FILE EXISTS. `current_agent_id()` read the credential claim from exactly one place,
+-- `request.jwt.claim.agent_credential_id`, which PostgREST sets and Realtime does not. So for
+-- every `postgres_changes` subscriber the claim read NULL, NULL took the permissive branch by
+-- design, and the branch requiring a non-revoked credential never executed. Credential revocation
+-- did not stop realtime delivery.
+--
+-- The defect was invisible to every existing test because they all exercise the PostgREST-shaped
+-- context, where the per-claim GUC IS set. The assertions below therefore separate the two
+-- transports deliberately: the ones that matter set the whole-JSON GUC and NOTHING else, which is
+-- the context a Realtime subscriber actually gets.
+--
+-- WHAT EACH HALF PINS:
+--   * per-claim transport  -- pre-existing behaviour, asserted so the fix cannot regress it;
+--   * whole-JSON transport -- the fix. These fail on the pre-#341 body;
+--   * absence in BOTH      -- the permissive branch, which callers with no credential depend on.
+--     Asserted positively rather than assumed, because "the fix did not over-deny" is the half a
+--     revocation fix is most likely to get wrong.
+
+begin;
+select plan(17);
+
+-- ---------------------------------------------------------------------------
+-- Fixture: one auth user, one active agent bound to it, three credentials
+-- (valid / revoked / expired) belonging to that agent.
+-- ---------------------------------------------------------------------------
+insert into auth.users (id, instance_id, aud, role, email, created_at, updated_at)
+values (
+  '34100000-0000-4000-8000-000000000001',
+  '00000000-0000-0000-0000-000000000000',
+  'authenticated', 'authenticated', 'rtcred-subject@example.test', now(), now()
+);
+
+insert into agent_board.agents (id, agent_type, handle, display_name, status, metadata, auth_user_id)
+values (
+  '34100000-0000-4000-8000-000000000010',
+  'agent', 'rtcred-subject', 'Realtime Credential Subject', 'active', '{}'::jsonb,
+  '34100000-0000-4000-8000-000000000001'
+);
+
+insert into agent_board.agent_credentials
+  (id, agent_id, refresh_token_hash, hash_version, credential_label, expires_at, revoked_at)
+values
+  ('34100000-0000-4000-8000-000000000100', '34100000-0000-4000-8000-000000000010',
+   '\x3411'::bytea, 1, 'valid', now() + interval '1 day', null),
+  ('34100000-0000-4000-8000-000000000200', '34100000-0000-4000-8000-000000000010',
+   '\x3412'::bytea, 1, 'revoked', now() + interval '1 day', now() - interval '1 hour'),
+  ('34100000-0000-4000-8000-000000000300', '34100000-0000-4000-8000-000000000010',
+   '\x3413'::bytea, 1, 'expired', now() - interval '1 hour', null);
+
+-- ---------------------------------------------------------------------------
+-- A. PER-CLAIM GUC context. NOTE THE LABEL: an earlier version called this "PostgREST-shaped",
+--    which is wrong -- PostgREST removed these GUCs at v12 and sets only request.jwt.claims, so
+--    NO production transport produces this context; only direct SQL / set_config does. Kept
+--    anyway, because it pins the coalesce ORDER and the pre-existing branch semantics.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', '34100000-0000-4000-8000-000000000001', true);
+select set_config('request.jwt.claims', '', true);
+select set_config('request.jwt.claim.agent_credential_id', '', true);
+
+select is(
+  (select agent_board.current_agent_id()),
+  '34100000-0000-4000-8000-000000000010'::uuid,
+  'A1 per-claim transport, no credential claim: resolves the agent (permissive branch)'
+);
+
+select set_config('request.jwt.claim.agent_credential_id', '34100000-0000-4000-8000-000000000100', true);
+select is(
+  (select agent_board.current_agent_id()),
+  '34100000-0000-4000-8000-000000000010'::uuid,
+  'A2 per-claim transport, VALID credential: resolves the agent'
+);
+
+select set_config('request.jwt.claim.agent_credential_id', '34100000-0000-4000-8000-000000000200', true);
+select is(
+  (select agent_board.current_agent_id()),
+  null::uuid,
+  'A3 per-claim transport, REVOKED credential: denies'
+);
+
+-- ---------------------------------------------------------------------------
+-- B. Realtime-shaped context: ONLY the whole-JSON GUC. These are the fix.
+--    Every per-claim GUC is cleared first, so a pass here cannot be produced by
+--    the source that already worked.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', '', true);
+select set_config('request.jwt.claim.agent_credential_id', '', true);
+
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated"}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  '34100000-0000-4000-8000-000000000010'::uuid,
+  'B1 realtime transport, claims carry no credential key: resolves (permissive branch preserved)'
+);
+
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":"34100000-0000-4000-8000-000000000100"}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  '34100000-0000-4000-8000-000000000010'::uuid,
+  'B2 realtime transport, VALID credential in claims: resolves (fix does not over-deny)'
+);
+
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":"34100000-0000-4000-8000-000000000200"}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  null::uuid,
+  'B3 realtime transport, REVOKED credential in claims: denies (the #341 defect)'
+);
+
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":"34100000-0000-4000-8000-000000000300"}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  null::uuid,
+  'B4 realtime transport, EXPIRED credential in claims: denies'
+);
+
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":"99999999-9999-4999-8999-999999999999"}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  null::uuid,
+  'B5 realtime transport, credential belonging to no agent: denies'
+);
+
+-- A credential that exists and is valid but belongs to a DIFFERENT agent must not authorize this
+-- one. The nearest principal that should still be refused, rather than a stranger: a stranger is
+-- refused by any check that looks at anything at all.
+insert into auth.users (id, instance_id, aud, role, email, created_at, updated_at)
+values (
+  '34100000-0000-4000-8000-000000000002',
+  '00000000-0000-0000-0000-000000000000',
+  'authenticated', 'authenticated', 'rtcred-other@example.test', now(), now()
+);
+insert into agent_board.agents (id, agent_type, handle, display_name, status, metadata, auth_user_id)
+values (
+  '34100000-0000-4000-8000-000000000020',
+  'agent', 'rtcred-other', 'Other Agent', 'active', '{}'::jsonb,
+  '34100000-0000-4000-8000-000000000002'
+);
+insert into agent_board.agent_credentials
+  (id, agent_id, refresh_token_hash, hash_version, credential_label, expires_at, revoked_at)
+values
+  ('34100000-0000-4000-8000-000000000400', '34100000-0000-4000-8000-000000000020',
+   '\x3414'::bytea, 1, 'other-valid', now() + interval '1 day', null);
+
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":"34100000-0000-4000-8000-000000000400"}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  null::uuid,
+  'B6 realtime transport, valid credential owned by ANOTHER agent: denies'
+);
+
+-- ---------------------------------------------------------------------------
+-- C. Precedence and shape.
+-- ---------------------------------------------------------------------------
+-- Both sources present: the per-claim value is preferred. Asserted so the coalesce ORDER is
+-- pinned, not merely its membership. A revoked value in the ignored source must not deny.
+select set_config('request.jwt.claim.agent_credential_id', '34100000-0000-4000-8000-000000000100', true);
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":"34100000-0000-4000-8000-000000000200"}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  '34100000-0000-4000-8000-000000000010'::uuid,
+  'C1 both sources present: per-claim wins over whole-JSON'
+);
+
+-- The function must still be SECURITY DEFINER with a pinned search_path. A recreate that dropped
+-- either would change who it can read and what it resolves, silently.
+select is(
+  (select p.prosecdef from pg_catalog.pg_proc p
+     join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'current_agent_id'),
+  true,
+  'C2 current_agent_id remains SECURITY DEFINER'
+);
+
+-- ---------------------------------------------------------------------------
+-- E. MALFORMED CLAIM SHAPES MUST DENY, NOT RAISE.
+--
+-- A correctness seat measured that the UUID regex never guarded the cast: `::uuid` is evaluated
+-- at SQL-function startup, before any qual filtering, so a malformed claim raised 22P02 rather
+-- than denying -- on the OLD body too, which is why this migration removes the cast entirely and
+-- compares as text. Every one of these was RED before that change.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.agent_credential_id', '', true);
+
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":""}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  '34100000-0000-4000-8000-000000000010'::uuid,
+  'E1 EMPTY-STRING claim is ABSENT on the whole-JSON arm too, matching the per-claim arm'
+);
+
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":"bogus"}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  null::uuid,
+  'E2 NON-UUID credential claim denies cleanly instead of raising 22P02'
+);
+
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":42}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  null::uuid,
+  'E3 NUMERIC credential claim denies cleanly instead of raising 22P02'
+);
+
+-- Case-insensitivity is load-bearing now that the comparison is text: uuid::text is canonical
+-- LOWERCASE, so an uppercase claim would silently stop matching without lower().
+select set_config(
+  'request.jwt.claims',
+  '{"sub":"34100000-0000-4000-8000-000000000001","role":"authenticated","agent_credential_id":"34100000-0000-4000-8000-000000000100"}',
+  true
+);
+select is(
+  (select agent_board.current_agent_id()),
+  '34100000-0000-4000-8000-000000000010'::uuid,
+  'E4 UPPERCASE credential claim still matches (uuid::text is lowercase; lower() bridges it)'
+);
+
+-- ---------------------------------------------------------------------------
+-- D. THE CLASS. #341 is one site; this asserts it is the ONLY one, and keeps it that way.
+--
+-- A function that reads a per-claim GUC (`request.jwt.claim.<name>`) WITHOUT also reading the
+-- whole-JSON GUC has #341's defect by construction: PostgREST populates the first, Realtime only
+-- the second, so its check silently does not run for subscribers. Catalog-derived, so a NEW
+-- function with that shape fails this and NAMES ITSELF rather than needing anyone to remember.
+--
+-- `keep_literals => true` is REQUIRED and is the trap this repo documents: the GUC name is a
+-- STRING LITERAL, and stripped_body strips literals by default, so the default spelling matches
+-- nothing and the assertion passes vacuously.
+--
+-- Note `request.jwt.claim.` carries a trailing dot, so it does not also match `request.jwt.claims`.
+-- ---------------------------------------------------------------------------
+
+-- Population canary FIRST: an empty "no offenders" result must not be reachable by the class
+-- being empty. If nothing reads a per-claim GUC at all, this file is asserting nothing.
+select cmp_ok(
+  (select count(*)
+     from pg_catalog.pg_proc p
+     join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid, true) like '%request.jwt.claim.%'),
+  '>=',
+  1::bigint,
+  'D1 population canary: at least one agent_board function reads a per-claim JWT GUC'
+);
+
+select is_empty(
+  $$
+  select p.proname
+    from pg_catalog.pg_proc p
+    join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+   where n.nspname = 'agent_board'
+     and agent_board_test.stripped_body(p.oid, true) like '%request.jwt.claim.%'
+     and agent_board_test.stripped_body(p.oid, true) not like '%request.jwt.claims%'
+  $$,
+  'D2 no agent_board function reads a per-claim JWT GUC without also reading request.jwt.claims'
+);
+
+select finish();
+rollback;

package/tests/agent_board_signer_lifecycle.test.sql

@@ -511,7 +511,7 @@ select is(
     where n.nspname = 'agent_board'
       and p.proname like 'signed\_%'
       and agent_board_test.stripped_body(p.oid)
-          ~ '\m(send_direct_message|send_multicast_message|post_board_message|append_task_event|create_tasking_delivery)\s*\('),
+          ~ '\m(send_direct_message|send_multicast_message|post_board_message|_?append_task_event|create_tasking_delivery)\s*\('),
   'signed_append_task_event,signed_create_tasking_delivery,signed_post_board_message,'
   || 'signed_send_direct_message,signed_send_multicast_message',
   'the five exempt wrappers each perform a message/task write, which is why they are exempt');