@consiliency/agent-board-schema 1.43.0 → 1.45.0

package/fixtures/already-applied.json

@@ -564,6 +564,14 @@
     {
       "id": "20260923000100_agent_board_heartbeat_preserve",
       "sha256": "22713b970564bc59433026f70934758982b4cf7832be9c06197faa2d4ecc0040"
+    },
+    {
+      "id": "20260924000100_agent_board_agent_liveness_denominator",
+      "sha256": "deb58ead6c4d7bbda686b85191d5eb2f2771ae2a405933ffbfbaabd7ad0117d9"
+    },
+    {
+      "id": "20260925000100_agent_board_ownerless_renew_ttl_cap",
+      "sha256": "da312f43cabf07c6dfd10dbe2a119fb46f49f24155e21adce4f38e291a38103c"
     }
   ]
 }

package/migrations/20260924000100_agent_board_agent_liveness_denominator.sql

@@ -0,0 +1,169 @@
+-- #367 — a liveness reader that cannot report "all clear" about a fleet it is not watching.
+--
+-- THE DEFECT THIS CLOSES. `v_ops_presence_heartbeats` selects FROM `agent_board.presence`:
+--
+--   from agent_board.presence p
+--   join agent_board.agents a on a.id = p.agent_id
+--   where p.expires_at < now();
+--
+-- `presence` is an upsert keyed by `agent_id`, written only by `heartbeat`. An agent that has
+-- NEVER heartbeated has no row, and a row that does not exist cannot be expired. So that view
+-- detects exactly one thing: "was reporting, then stopped". It is structurally blind to
+-- "never reported."
+--
+-- MEASURED, not theorised. On the canonical project on 2026-08-29, immediately after #366 shipped
+-- the writer half: `presence` held 0 rows while 8 agents were `status = 'active'`. Every one of
+-- them was unmonitored, and `select * from v_ops_presence_heartbeats` returned zero rows — output
+-- byte-identical to a fleet in perfect health. That is an absence of signal carrying an alarm's
+-- authority, which is worse than no reader at all, because a reader is something people trust.
+--
+-- THE FIX IS THE JOIN DIRECTION. This view selects FROM `agents` and LEFT JOINs `presence`, so a
+-- never-reporting agent is NAMED rather than missing. That is the whole idea; everything else here
+-- follows from it.
+--
+-- WHAT THIS DELIBERATELY DOES NOT CLAIM. #367 offers two shapes: (1) scope the claim to what the
+-- data supports, and (2) establish an expectation so that never-reporting is itself an anomaly.
+-- This is (1). `never_reported` is a REPORTED STATE, not a judgement — the view says "this agent
+-- has no presence row", never "this agent is stalled". Shape (2) would require deciding what
+-- "expected to be alive" means for an agent that is idle by design, and #366 is deliberate that an
+-- agent waiting on a human is indistinguishable from a stalled one from outside the process.
+-- Naming the state without asserting it is abnormal is how this stays honest while still being
+-- strictly more informative than the view it complements.
+--
+-- WHY THE SUMMARY FUNCTION EXISTS AT ALL. A caller that reads only rows still cannot tell
+-- "0 stale agents" from "nobody reports". The summary always emits `active_agents` alongside
+-- `reporting_agents`, so an empty stale set is reported as `0 stale of 3 reporting, of 8 active`
+-- and can never be rendered as "all clear". #367's first acceptance criterion is that the
+-- denominator appears in the output; putting it in a function rather than in a comment is what
+-- makes that mechanical.
+
+-- ---------------------------------------------------------------------------
+-- The view. `security_invoker` so RLS on `agents`/`presence` applies to the READER, matching
+-- every other view in agent_board — a definer view here would hand every caller a fleet-wide
+-- roster regardless of what they may see.
+-- ---------------------------------------------------------------------------
+create or replace view agent_board.v_agent_liveness
+with (security_invoker = true)
+as
+select
+  a.id                                        as agent_id,
+  a.handle                                    as agent_handle,
+  -- The vocabulary is closed and total: every active agent lands in exactly one of these.
+  -- `never_reported` is FIRST because it is the case the view exists to make visible.
+  case
+    when p.agent_id is null      then 'never_reported'
+    when p.expires_at < now()    then 'stale'
+    else                              'fresh'
+  end                                         as liveness_state,
+  p.availability,
+  p.thread_id,
+  p.activity_summary,
+  p.last_heartbeat_at,
+  p.expires_at,
+  -- NULL rather than a number for a never-reporting agent. A zero here would read as
+  -- "reported just now", which is the opposite of the truth.
+  case
+    when p.last_heartbeat_at is null then null
+    else round(extract(epoch from (now() - p.last_heartbeat_at)) / 60.0, 2)
+  end                                         as heartbeat_lag_minutes
+from agent_board.agents a
+left join agent_board.presence p on p.agent_id = a.id
+where a.status = 'active';
+
+comment on view agent_board.v_agent_liveness is
+  '#367 liveness reader. Selects FROM agents and LEFT JOINs presence, so an agent that has NEVER '
+  'heartbeated is NAMED with liveness_state = never_reported rather than being absent — the blind '
+  'spot in v_ops_presence_heartbeats, which selects from presence and therefore cannot see an '
+  'agent with no row. liveness_state is one of never_reported / stale / fresh and is a REPORTED '
+  'STATE, not a judgement: never_reported means "no presence row", NOT "stalled". Deciding that '
+  'idleness is abnormal is #367 shape (2) and is deliberately not done here. security_invoker, so '
+  'RLS applies to the reader.';
+
+-- ---------------------------------------------------------------------------
+-- The summary. Its ONLY job is to make an empty result impossible to misread.
+-- ---------------------------------------------------------------------------
+create or replace function agent_board.agent_liveness_summary()
+returns table(
+  active_agents    integer,
+  reporting_agents integer,
+  fresh            integer,
+  stale            integer,
+  never_reported   integer
+)
+language sql
+stable
+security invoker
+set search_path = agent_board, public
+as $$
+  select
+    count(*)::integer                                                as active_agents,
+    count(*) filter (where liveness_state <> 'never_reported')::integer as reporting_agents,
+    count(*) filter (where liveness_state = 'fresh')::integer        as fresh,
+    count(*) filter (where liveness_state = 'stale')::integer        as stale,
+    count(*) filter (where liveness_state = 'never_reported')::integer as never_reported
+  from agent_board.v_agent_liveness;
+$$;
+
+comment on function agent_board.agent_liveness_summary() is
+  '#367 denominator. Returns active_agents and reporting_agents ALONGSIDE the stale count, so a '
+  'caller can never render "0 stale" as "all clear" — 0 stale of 0 reporting, of 8 active, is an '
+  'unmonitored fleet, and it reads as one. The four state counts sum to active_agents by '
+  'construction because v_agent_liveness assigns every active agent exactly one state. '
+  'security invoker + stable: it is a projection of the view and inherits the caller''s RLS.';
+
+-- ---------------------------------------------------------------------------
+-- The OLD view is left in service deliberately — it answers a narrower question correctly and
+-- operators' saved queries reference it — but it now carries its own blind spot in the catalog.
+-- Two review seats independently made the same point: shipping a fix while the DOCUMENTED alarm
+-- path still has the defect closes an issue without closing the exposure. `specs/operations.md`
+-- was repointed in the same change; this comment is for whoever reads the catalog instead.
+-- ---------------------------------------------------------------------------
+comment on view agent_board.v_ops_presence_heartbeats is
+  'Expired presence leases. BLIND SPOT, by construction: it selects FROM presence, and presence '
+  'has no row for an agent that has NEVER heartbeated — so this detects only "was reporting, then '
+  'stopped" and an empty result is byte-identical to a healthy fleet. Measured 2026-08-29 on the '
+  'canonical project: 0 presence rows, 8 active agents, this view returned nothing. For "who in '
+  'the fleet is alive" use agent_board.v_agent_liveness and agent_board.agent_liveness_summary() '
+  '(#367), which select FROM agents and state their denominator. This view remains correct for '
+  'the narrower question it actually answers.';
+
+-- ---------------------------------------------------------------------------
+-- SERVICE_ROLE ONLY, and this is the most important line in the file.
+--
+-- The first version of this migration granted both to `authenticated` as well, reasoning that
+-- `security_invoker` made that safe because RLS would apply to the reader. That reasoning was
+-- exactly backwards, and a red-team review seat found it. RLS does not merely LIMIT what an
+-- authenticated caller sees here — it CHANGES WHAT THE ANSWER MEANS:
+--
+--   * `agents`   is `using (current_agent_id() is not null)`  → an agent sees EVERY agent row.
+--   * `presence` is `using (agent_id = current_agent_id())`   → an agent sees ONLY ITS OWN row.
+--
+-- So for an authenticated caller the LEFT JOIN converts "this row is invisible to you" into
+-- `p.agent_id is null`, which this view then labels `never_reported`. Measured on a local cluster
+-- with TWO genuinely healthy agents, both with fresh presence rows:
+--
+--   as service_role            → fresh=2  never_reported=0     (true)
+--   as authenticated agent one → fresh=1  never_reported=1     (FABRICATED)
+--
+-- The reader would invent the exact alarm it exists to report, and it would do so confidently and
+-- per-caller, so two readers would disagree with no way to tell which was right. That is strictly
+-- worse than the blind spot this migration closes: `v_ops_presence_heartbeats` UNDER-reports
+-- (silence), and this would OVER-report (a false positive with an agent's name on it).
+--
+-- An authenticated agent cannot answer "who in the fleet is alive" at all, because it cannot see
+-- anyone else's presence. That is a property of the RLS model, not a gap in this view, and the
+-- honest response is to withhold the surface rather than to serve a per-caller answer that reads
+-- like a fleet-wide one. Liveness is an operations question and this is an operations surface.
+--
+-- `security_invoker` is KEPT even though only service_role is granted: it is defence in depth, so
+-- that if a future migration widens the grant the rows are still RLS-filtered rather than leaked
+-- wholesale. AL-9 pins the grant so widening it fails a test that says why.
+-- ---------------------------------------------------------------------------
+grant select on agent_board.v_agent_liveness to service_role;
+
+-- The REVOKE is not redundant, and AL-9b caught it missing. A newly created function is granted
+-- EXECUTE to PUBLIC by default, so `authenticated` inherits it through PUBLIC and granting only
+-- service_role above changes nothing on its own. This is the schema-mechanics trap AGENTS.md
+-- names, arriving on a plain `create or replace function` rather than on a DROP.
+revoke all on function agent_board.agent_liveness_summary() from public;
+grant execute on function agent_board.agent_liveness_summary() to service_role;

package/migrations/20260925000100_agent_board_ownerless_renew_ttl_cap.sql

@@ -0,0 +1,166 @@
+-- #373 — the ownerless TTL cap was ACQUIRE-ONLY, so the bound it advertises did not exist.
+--
+-- THE GAP, re-derived from the catalog rather than taken from the issue:
+--
+--   acquire_claim   guard=true   ttl_cap=true   quota=true
+--   renew_claim     guard=false  ttl_cap=false  quota=false
+--   release_claim   guard=false  ttl_cap=false  quota=false
+--
+-- `_claimgate_ownerless_ttl_cap()` (30 days) bounded an ownerless `file`/`tool`/`custom` lease at
+-- ACQUIRE and nowhere else. An agent could take a 30-day lease and renew it indefinitely, past the
+-- cap, forever. The duration bound was advertised and unenforced.
+--
+-- A COMMENT THAT DESCRIBED BEHAVIOUR THE CODE DID NOT HAVE. `_claimgate_ownerless_ttl_cap()` says
+-- ENFORCE "extends the horizon to renew for all non-task kinds". For the ownerless kinds it
+-- demonstrably did not — the ENFORCE rewrite (20260825000100) re-authorises and clamps only
+-- machine/repository/repo_file and says so in its own text. That is the shape AGENTS.md rule 5
+-- names: an intention written as a fact, which reads as true and is never re-checked.
+--
+-- CLAMP, NOT REJECT — and this differs from acquire deliberately. `acquire_claim` RAISES on an
+-- over-cap lease (22023): nothing is lost, the caller simply asks for less. A renew that raised
+-- would instead KILL A LIVE LEASE the agent is currently relying on, converting a length problem
+-- into an availability incident. Renew already resolves this the same way for the fleet-gated
+-- kinds — clamp to the horizon, and let an over-long legacy lease reconcile at its next renew --
+-- so the ownerless clamp mirrors renew's own idiom rather than acquire's.
+--
+-- SAME FOUR CONDITIONS AS ACQUIRE, so one flag governs both paths and a board that opted out of
+-- our locking is not clamped by it either:
+--   the kind is ownerless · not service_role · _claimgate_ownerless_guards_enabled()
+--   · the claim's board is not claim_policy='advisory'
+--
+-- WHAT THIS DOES NOT DO. The per-agent quota (50 concurrent ownerless claims) is untouched. It was
+-- never defeated by this gap — renewing does not increase an agent's claim count — and all three
+-- board seats on #369 converged on that independently. This closes the TTL half only.
+create or replace function agent_board.renew_claim(p_lease_token uuid, p_lease_expires_at timestamptz)
+returns table(claim_id uuid, task_id uuid, thread_id uuid, agent_id uuid, resource_kind text, resource_key text, status text, lease_token uuid, lease_expires_at timestamptz, released_at timestamptz, created_at timestamptz, updated_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_actor_agent_id uuid;
+  v_kind text;
+  v_key text;
+  v_thread_id uuid;
+  v_effective_expires timestamptz;
+begin
+  if not agent_board._is_service_role() then
+    v_actor_agent_id := agent_board._resolved_actor_agent_id(null, 'current_agent_id');
+    if not exists (
+      select 1
+        from agent_board.claims c
+       where c.lease_token = p_lease_token
+         and c.agent_id = v_actor_agent_id
+    ) then
+      raise exception 'claim not accessible to current agent' using errcode = '42501';
+    end if;
+  end if;
+
+  -- CLAIMGATE/ENFORCE (#133): re-authorize + horizon for the predicate-gated kinds. Read the
+  -- live lease's resource identity (SECURITY DEFINER, so RLS does not hide it). A dead/expired
+  -- lease yields a null kind and the UPDATE below matches nothing (preserves prior behavior).
+  select c.resource_kind, c.resource_key, c.thread_id
+    into v_kind, v_key, v_thread_id
+    from agent_board.claims c
+   where c.lease_token = p_lease_token
+     and c.status = 'active'
+     and c.released_at is null
+     and c.lease_expires_at > now();
+
+  -- RE-AUTH: bound revocation latency to one lease term. Uses the SAME session wrapper acquire
+  -- consults (_can_claim_resource -> _can_claim_resource_for(current_agent_id())), so service_role
+  -- keeps its carve-out and acquire+renew share ONE per-kind flag (a mutation splitting the flags
+  -- fails a test). Task-renew is EXCLUDED (ownership-only, ratified supersession).
+  if v_kind in ('machine', 'repository', 'repo_file')
+     and agent_board._claimgate_kind_enforced(v_kind) then
+    if not agent_board._can_claim_resource(v_kind, agent_board._canonical_claim_key(v_kind, v_key)) then
+      raise exception 'not authorized to renew this % claim (fleet authority revoked)', v_kind
+        using errcode = '42501';
+    end if;
+  end if;
+
+  -- HORIZON: clamp the renewed lease to now()+horizon for an ENFORCED fleet-gated kind — this is
+  -- where an existing overlong lease reconciles (no bulk-clamp migration; the horizon clamps it
+  -- at its next renew). service_role exempt. Same per-kind flag as acquire.
+  v_effective_expires := p_lease_expires_at;
+  if v_kind in ('machine', 'repository', 'repo_file')
+     and not agent_board._is_service_role()
+     and agent_board._claimgate_kind_enforced(v_kind)
+     and p_lease_expires_at > now() + agent_board._claimgate_max_lease_horizon() then
+    v_effective_expires := now() + agent_board._claimgate_max_lease_horizon();
+  end if;
+
+  -- #373 OWNERLESS TTL CAP AT RENEW. The half that was missing: without this an agent renews a
+  -- file/tool/custom lease past the 30-day cap indefinitely and the bound is decorative.
+  --
+  -- Clamps rather than raises, unlike acquire. A raise here would kill a lease the agent is
+  -- actively holding; shortening it costs one more renew. Same resolution the fleet-kind horizon
+  -- clamp above already applies, and the same place an over-long legacy lease reconciles.
+  --
+  -- The four conditions are acquire's, verbatim, so ONE operator flag governs both paths and a
+  -- board that declined our locking (claim_policy='advisory') is not clamped by it either. The
+  -- thread comes from the LIVE CLAIM, never from a caller argument -- a caller-supplied thread
+  -- would let an agent choose which board's policy is consulted.
+  if v_kind in ('file', 'tool', 'custom')
+     and not agent_board._is_service_role()
+     and agent_board._claimgate_ownerless_guards_enabled()
+     and agent_board._claimgate_board_claim_policy(v_thread_id) <> 'advisory'
+     and v_effective_expires > now() + agent_board._claimgate_ownerless_ttl_cap() then
+    v_effective_expires := now() + agent_board._claimgate_ownerless_ttl_cap();
+  end if;
+
+  -- CLAIMKEY (#133) MUST-FIX 1: re-canonicalize the STORED key as the lease is renewed, but
+  -- NEVER propagate a uniqueness collision. A check-then-act guard is NOT race-safe: two aliased
+  -- legacy rows renewed concurrently at READ COMMITTED can both observe the canonical key free
+  -- and one loses on claims_active_resource_unique (23505). So attempt the canonicalization and,
+  -- on unique_violation (deterministic alias OR concurrent race), retry ONCE keeping the CURRENT
+  -- key. That makes renew non-raising UNCONDITIONALLY (true normalize-only); the surviving legacy
+  -- key is the deferred dual-key alias the ENFORCE phase closes.
+  begin
+    return query
+    update agent_board.claims c
+       set lease_expires_at = v_effective_expires,
+           resource_key = agent_board._canonical_claim_key(c.resource_kind, c.resource_key),
+           updated_at = now()
+     where c.lease_token = p_lease_token
+       and c.status = 'active'
+       and c.released_at is null
+       and c.lease_expires_at > now()
+    returning c.id, c.task_id, c.thread_id, c.agent_id, c.resource_kind, c.resource_key, c.status, c.lease_token, c.lease_expires_at, c.released_at, c.created_at, c.updated_at;
+  exception when unique_violation then
+    -- the canonical key is already held (by a committed twin or a concurrent renew/acquire):
+    -- renew the lease keeping the current key, aliasing deferred to ENFORCE. Only the key change
+    -- can raise unique_violation (the lease/timestamp columns are unconstrained), so the retry
+    -- cannot itself collide.
+    return query
+    update agent_board.claims c
+       set lease_expires_at = v_effective_expires,
+           updated_at = now()
+     where c.lease_token = p_lease_token
+       and c.status = 'active'
+       and c.released_at is null
+       and c.lease_expires_at > now()
+    returning c.id, c.task_id, c.thread_id, c.agent_id, c.resource_kind, c.resource_key, c.status, c.lease_token, c.lease_expires_at, c.released_at, c.created_at, c.updated_at;
+  end;
+end;
+$$;
+
+-- The comment #373 called out as describing behaviour the code did not have. It now does.
+comment on function agent_board._claimgate_ownerless_ttl_cap() is
+  'Max lease horizon for an ownerless (file/tool/custom) claim: 30 days. Enforced at BOTH acquire '
+  '(which RAISES 22023 on an over-cap request) and renew (which CLAMPS, because raising would kill '
+  'a live lease the agent is relying on). #373 closed the renew half; before that this comment '
+  'claimed a horizon renew did not apply and a lease could be renewed past the cap forever. '
+  'Governed by _claimgate_ownerless_guards_enabled() on both paths, and skipped for a board whose '
+  'claim_policy is advisory.';
+
+-- Second stale comment, raised by a review seat: the flags table said this scope_key gates the
+-- ownerless guards "in acquire_claim", which was true when written and is not now. Same rule-5
+-- shape as the helper comment above -- a recorded fact that keeps asserting itself after the code
+-- moved. Corrected here rather than left for the next reader to disbelieve.
+comment on table agent_board.claimgate_enforcement_flags is
+  'CLAIMGATE per-scope enforcement flags. Absent row => disabled (SHADOW default: blocks nothing). '
+  'scope_key ''ownerless_guards'' gates the ownerless (file/tool/custom) guards on BOTH write '
+  'paths: the TTL cap + per-agent quota in acquire_claim, and the TTL clamp in renew_claim (#373 '
+  '-- before that the cap was acquire-only and a lease could be renewed past it forever). '
+  'Operator-managed (service_role); enabled only after the prod lease-length census.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.43.0",
+  "packageVersion": "1.45.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 141,
-  "aggregateSha256": "d97c281cbc43a2c031dc769731473c6c9d1aa4facb0f72d07095cd1b9301a163",
+  "migrationCount": 143,
+  "aggregateSha256": "e5f248a69031759fbd220b5504268c4ca3159fc7cf641404badf2f2ae855e4ae",
   "migrations": [
     {
       "order": 0,
@@ -1317,6 +1317,24 @@
       "sourceRef": "message-board",
       "bytes": 7731,
       "sha256": "22713b970564bc59433026f70934758982b4cf7832be9c06197faa2d4ecc0040"
+    },
+    {
+      "order": 141,
+      "id": "20260924000100_agent_board_agent_liveness_denominator",
+      "filename": "20260924000100_agent_board_agent_liveness_denominator.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 10530,
+      "sha256": "deb58ead6c4d7bbda686b85191d5eb2f2771ae2a405933ffbfbaabd7ad0117d9"
+    },
+    {
+      "order": 142,
+      "id": "20260925000100_agent_board_ownerless_renew_ttl_cap",
+      "filename": "20260925000100_agent_board_ownerless_renew_ttl_cap.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 9981,
+      "sha256": "da312f43cabf07c6dfd10dbe2a119fb46f49f24155e21adce4f38e291a38103c"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 141)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 143)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(141);
+    expect(manifest.migrationCount).toBe(143);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -262,6 +262,21 @@ describe('manifest integrity', () => {
       // existing row; a first heartbeat still lands 'ready'/'{}'. Signature unchanged (parameter
       // defaults are not part of function identity), so the ACL and COMMENT survive.
       '20260923000100_agent_board_heartbeat_preserve.sql',
+      // #367 LIVENESSDENOM. v_ops_presence_heartbeats selects FROM presence, and presence has no
+      // row for an agent that never heartbeated -- so it detects only "was reporting, then
+      // stopped" and is structurally blind to "never reported". Measured on the canonical project
+      // the day #366 shipped the writer half: 0 presence rows, 8 active agents, and the view
+      // returned zero rows, which is byte-identical to a healthy fleet. v_agent_liveness selects
+      // FROM agents and LEFT JOINs presence so a never-reporting agent is NAMED, and
+      // agent_liveness_summary() always emits reporting_agents beside the stale count so a caller
+      // cannot render "0 stale" as "all clear".
+      '20260924000100_agent_board_agent_liveness_denominator.sql',
+      // #373 OWNERLESSRENEWTTL. _claimgate_ownerless_ttl_cap bounded a file/tool/custom lease at
+      // ACQUIRE and nowhere else, so an agent could renew past the 30-day cap indefinitely and the
+      // advertised bound did not exist. renew_claim now clamps (rather than raises -- a raise would
+      // kill a live lease) under acquire's own four conditions, so one operator flag governs both
+      // paths and an advisory board is exempt on both.
+      '20260925000100_agent_board_ownerless_renew_ttl_cap.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_agent_liveness.test.sql

@@ -0,0 +1,271 @@
+-- #367 — the reader must not be able to say "all clear" about a fleet it is not watching.
+--
+-- AL-3 IS THE ASSERTION THIS FILE EXISTS FOR, and it is written as a DIFFERENTIAL against the
+-- view it complements. Asserting only "v_agent_liveness names the never-reporting agent" would
+-- pass against a view that names everything and prove nothing about the defect; asserting only
+-- "v_ops_presence_heartbeats misses it" would be a test of code this migration does not change.
+-- Scoring BOTH surfaces on the SAME agent in the SAME transaction is what makes the assertion
+-- about the difference rather than about either one.
+--
+-- AL-6 IS THE OTHER HALF, and it is the one that would have caught the real incident. It builds
+-- the exact production shape — active agents, ZERO presence rows — and asserts the summary reports
+-- `0 stale of 0 reporting, of N active`. A reader that returned "0 stale" alone is byte-identical
+-- to a healthy fleet, which is what made the blind spot dangerous rather than merely incomplete.
+--
+-- SCOPING. Every assertion is scoped to THIS test's agents by handle prefix. An unscoped count
+-- over agent_board.agents is polluted by every fixture any other test left behind and fails
+-- looking like a real defect.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(17);
+
+-- ---------------------------------------------------------------------------
+-- Fixture: three ACTIVE agents in three distinct liveness states, plus one INACTIVE agent that
+-- must not appear at all.
+--   fresh   — heartbeated, lease in the future
+--   stale   — heartbeated, lease in the past
+--   never   — no presence row, which is the case the view exists to surface
+--   retired — status <> 'active'; a liveness reader must not name a decommissioned agent
+-- ---------------------------------------------------------------------------
+create temp table _al (sfx text, fresh uuid, stale uuid, never uuid, retired uuid) on commit drop;
+
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_fresh uuid := gen_random_uuid();
+  v_stale uuid := gen_random_uuid();
+  v_never uuid := gen_random_uuid();
+  v_retired uuid := gen_random_uuid();
+  v_u uuid;
+begin
+  foreach v_u in array array[v_fresh, v_stale, v_never, v_retired] loop
+    null;
+  end loop;
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status)
+  values (v_fresh,   'agent', 'al-fresh-'   || v_sfx, 'AL Fresh',   'active'),
+         (v_stale,   'agent', 'al-stale-'   || v_sfx, 'AL Stale',   'active'),
+         (v_never,   'agent', 'al-never-'   || v_sfx, 'AL Never',   'active'),
+         (v_retired, 'agent', 'al-retired-' || v_sfx, 'AL Retired', 'inactive');
+
+  -- Presence rows written DIRECTLY rather than through heartbeat(): this file is about the
+  -- reader, and going through the RPC would couple it to the actor-resolution path #366 owns.
+  insert into agent_board.presence(agent_id, availability, last_heartbeat_at, expires_at, metadata, updated_at)
+  values (v_fresh, 'busy', now() - interval '1 minute',  now() + interval '20 minutes', '{}'::jsonb, now()),
+         (v_stale, 'away', now() - interval '2 hours',   now() - interval '90 minutes', '{}'::jsonb, now());
+
+  insert into _al values (v_sfx, v_fresh, v_stale, v_never, v_retired);
+end $$;
+
+-- ---------------------------------------------------------------------------
+-- AL-1..3: the three states, and the differential that names the defect.
+-- ---------------------------------------------------------------------------
+select is(
+  (select liveness_state from agent_board.v_agent_liveness where agent_id = (select fresh from _al)),
+  'fresh',
+  'AL-1: an agent with an unexpired lease reads fresh');
+
+select is(
+  (select liveness_state from agent_board.v_agent_liveness where agent_id = (select stale from _al)),
+  'stale',
+  'AL-2: an agent whose lease has passed reads stale');
+
+select is(
+  (select liveness_state from agent_board.v_agent_liveness where agent_id = (select never from _al)),
+  'never_reported',
+  'AL-3 THE POINT: an agent with NO presence row is NAMED never_reported rather than being absent');
+
+-- The differential. Same agent, same transaction, the pre-existing surface — which selects FROM
+-- presence and therefore cannot see it. If this ever returns a row, the blind spot closed
+-- somewhere else and AL-3 has stopped being about anything.
+select is(
+  (select count(*)::int from agent_board.v_ops_presence_heartbeats where agent_id = (select never from _al)),
+  0,
+  'AL-3b DIFFERENTIAL: v_ops_presence_heartbeats CANNOT see that same agent — which is why AL-3 is a fix and not a restatement');
+
+-- ---------------------------------------------------------------------------
+-- AL-4: a decommissioned agent is not a liveness subject. Without the status filter every agent
+-- ever created accumulates in the never_reported bucket and the signal drowns.
+-- ---------------------------------------------------------------------------
+select is(
+  (select count(*)::int from agent_board.v_agent_liveness where agent_id = (select retired from _al)),
+  0,
+  'AL-4: an inactive agent does not appear at all — a liveness reader must not name a decommissioned agent');
+
+-- ---------------------------------------------------------------------------
+-- AL-5: the lag column. NULL for a never-reporting agent, because 0 would read as
+-- "reported just now" — the exact inversion of the truth.
+-- ---------------------------------------------------------------------------
+select is(
+  (select heartbeat_lag_minutes from agent_board.v_agent_liveness where agent_id = (select never from _al)),
+  null,
+  'AL-5: heartbeat_lag_minutes is NULL for a never-reporting agent, never 0 — a zero would read as "reported just now"');
+
+select ok(
+  (select heartbeat_lag_minutes > 100 from agent_board.v_agent_liveness where agent_id = (select stale from _al)),
+  'AL-5b: and it is a real elapsed figure for one that did report (2h ago reads as >100 minutes)');
+
+-- ---------------------------------------------------------------------------
+-- AL-6: THE DENOMINATOR, built as the production shape that motivated the issue.
+--
+-- Scored on a scoped recomputation rather than on the global summary, because the summary counts
+-- every active agent in the database and other fixtures pollute it. The PROPERTY under test is
+-- "the reader states reporting alongside stale", and it holds per-subset exactly as it holds
+-- globally.
+-- ---------------------------------------------------------------------------
+select is(
+  (select
+     count(*) filter (where liveness_state <> 'never_reported')::text || ' reporting of ' ||
+     count(*)::text || ' active, ' ||
+     count(*) filter (where liveness_state = 'stale')::text || ' stale'
+   from agent_board.v_agent_liveness
+   where agent_handle like 'al-%' || (select sfx from _al)),
+  '2 reporting of 3 active, 1 stale',
+  'AL-6: the reader states REPORTING alongside STALE, so a count can never be read without its denominator');
+
+-- The real incident shape: active agents, nothing reporting. Deleting this fixture's presence
+-- rows reproduces `presence_rows = 0, active_agents = 8` from the canonical project.
+delete from agent_board.presence
+ where agent_id in (select fresh from _al union all select stale from _al);
+
+select is(
+  (select
+     count(*) filter (where liveness_state = 'stale')::text || ' stale of ' ||
+     count(*) filter (where liveness_state <> 'never_reported')::text || ' reporting, of ' ||
+     count(*)::text || ' active'
+   from agent_board.v_agent_liveness
+   where agent_handle like 'al-%' || (select sfx from _al)),
+  '0 stale of 0 reporting, of 3 active',
+  'AL-6b THE INCIDENT SHAPE: with nothing reporting, the output says so — "0 stale" alone would be byte-identical to a healthy fleet');
+
+-- ---------------------------------------------------------------------------
+-- THE ASYMMETRY BELOW IS LOAD-BEARING FOR AL-7b AND AL-10, and neither had it at first.
+-- AL-6b has just deleted this fixture's presence rows, and the persistent seeds carry active
+-- agents with NO presence rows, so at this point the whole database is fresh=0 and stale=0. Every
+-- comparison downstream then scores 0-against-0 and reads as agreement: AL-7b reduced to
+-- `reporting_agents = 0` (so a `reporting_agents` hardcoded to 0 passed it), and AL-10 compared
+-- '0/0' to '0/0' (so swapping the fresh/stale predicates passed it). Two review seats found the
+-- first; the mutation battery found the second. Restoring exactly ONE fresh row is the minimum
+-- state in which either mutation is observable at all.
+insert into agent_board.presence(agent_id, availability, last_heartbeat_at, expires_at, metadata, updated_at)
+values ((select never from _al), 'ready', now(), now() + interval '20 minutes', '{}'::jsonb, now());
+
+-- AL-7: the summary function is TOTAL — the four state counts sum to active_agents. If a fourth
+-- state is ever added to the view's CASE without being added to the function, this fails.
+-- ---------------------------------------------------------------------------
+select is(
+  (select fresh + stale + never_reported from agent_board.agent_liveness_summary()),
+  (select active_agents from agent_board.agent_liveness_summary()),
+  'AL-7: the state counts sum to active_agents — a new state that the summary does not count fails here');
+
+-- ---------------------------------------------------------------------------
+-- AL-7b: THE SUMMARY'S OWN reporting_agents, and this assertion exists because the mutation
+-- battery found it missing. Corrupting `reporting_agents` to `count(*)` — so an entirely
+-- unmonitored fleet reports full participation — produced NO failure anywhere in this file.
+-- AL-6/AL-6b recompute the denominator FROM THE VIEW and never call the summary at all, and AL-7's
+-- sum is unaffected by that field. So the one column that makes the denominator mechanical was
+-- unasserted, while the migration's comment claimed it was the point of the function.
+--
+-- Scored as a RELATIONSHIP rather than a literal, because the summary is global and every other
+-- test's fixtures are in it: `reporting_agents` must equal `fresh + stale`. That holds under any
+-- amount of pollution, and it is discriminating here precisely because this file's fixture
+-- guarantees at least one never-reporting agent exists — so active_agents is strictly greater,
+-- and a reporting_agents that counted everyone fails.
+-- ---------------------------------------------------------------------------
+select is(
+  (select reporting_agents from agent_board.agent_liveness_summary()),
+  (select fresh + stale from agent_board.agent_liveness_summary()),
+  'AL-7b: the summary''s OWN reporting_agents equals fresh + stale — a denominator that counted never-reporting agents as reporting would say an unmonitored fleet was fully participating');
+
+-- ---------------------------------------------------------------------------
+-- AL-8: security_invoker, asserted from the catalog. A definer view here would hand every caller
+-- a fleet-wide roster regardless of what RLS says they may see.
+-- ---------------------------------------------------------------------------
+select ok(
+  (select 'security_invoker=true' = any(c.reloptions)
+     from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = 'agent_board' and c.relname = 'v_agent_liveness'),
+  'AL-8: the view is security_invoker — RLS applies to the reader, not to the view owner');
+
+select ok(
+  (select not p.prosecdef
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'agent_liveness_summary'),
+  'AL-8b: the SUMMARY is not SECURITY DEFINER either — AL-8 inspects only the view, so a definer function over an invoker view would silently restore the fleet-wide read this design refuses');
+
+-- ---------------------------------------------------------------------------
+-- AL-9: SERVICE_ROLE ONLY. The blocking finding of this PR's review.
+--
+-- The first version granted both surfaces to `authenticated` too, on the reasoning that
+-- security_invoker made it safe. RLS does not just limit what an authenticated caller sees here —
+-- it changes what the answer MEANS. `agents` is readable by any agent; `presence` is own-row only.
+-- So the LEFT JOIN turns "invisible to you" into `never_reported`, and the view FABRICATES the
+-- alarm it exists to report. Measured with two genuinely healthy agents: service_role saw
+-- fresh=2/never=0, an authenticated caller saw fresh=1/never=1.
+--
+-- Asserted via has_*_privilege rather than by reading pg_class.relacl, because that resolves
+-- inherited and PUBLIC-default grants which a direct ACL read cannot see.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(string_agg(r, ', ' order by r), '')
+     from unnest(array['anon','authenticated','service_role']) r
+    where has_table_privilege(r, 'agent_board.v_agent_liveness', 'select')),
+  'service_role',
+  'AL-9 SECURITY: only service_role may read the view — granted to authenticated it would report never_reported for every agent whose presence row RLS hides, fabricating alarms about healthy agents');
+
+select is(
+  (select coalesce(string_agg(r, ', ' order by r), '')
+     from unnest(array['anon','authenticated','service_role']) r
+    where has_function_privilege(r, 'agent_board.agent_liveness_summary()', 'execute')),
+  'service_role',
+  'AL-9b: and the summary is service_role only for the same reason — its denominator is per-caller under RLS, so two readers would disagree with no way to say which was right');
+
+-- ---------------------------------------------------------------------------
+-- AL-10: the summary's fresh/stale are the VIEW's fresh/stale. AL-7/7b assert only SUMS, and a
+-- review seat pointed out that swapping the two predicates inside agent_liveness_summary() leaves
+-- every one of them green: both identities still hold and nothing checked the values themselves.
+-- Scored as an identity against the view so it is immune to other fixtures' pollution.
+--
+-- THE ASYMMETRY BELOW IS LOAD-BEARING, and the first version of this assertion did not have it.
+-- AL-6b has just deleted this fixture's presence rows, so at this point fresh = 0 and stale = 0 --
+-- and '0/0' equals '0/0' whichever way round the two predicates are. The assertion scored a
+-- VACUOUS MATCH and read as agreement; the swap mutation ran clean against it. Restoring exactly
+-- ONE fresh row makes the two counts differ, which is the minimum condition under which a swap is
+-- observable at all. Measured, not reasoned: the mutation fails this line now and did not before.
+-- ---------------------------------------------------------------------------
+select is(
+  (select fresh || '/' || stale from agent_board.agent_liveness_summary()),
+  (select
+     (count(*) filter (where liveness_state = 'fresh'))::text || '/' ||
+     (count(*) filter (where liveness_state = 'stale'))::text
+   from agent_board.v_agent_liveness),
+  'AL-10: the summary''s fresh and stale ARE the view''s fresh and stale — swapping the two predicates inside the function keeps every sum identity true and is invisible without this');
+
+-- ---------------------------------------------------------------------------
+-- AL-11: THE CLASS, from the catalog rather than from a list written here (rule 1).
+--
+-- The claim this migration makes is "v_ops_presence_heartbeats is the surface with the blind
+-- spot". That was checked by enumerating pg_views rather than by reading the diff, and the answer
+-- was yes — but a claim checked once is a claim about the moment it was checked. This asserts the
+-- membership so a NEW view over presence fails here and NAMES ITSELF, forcing whoever adds it to
+-- state its join direction.
+--
+-- Each member's claim is asserted POSITIVELY in the message rather than by absence from a list:
+--   v_agent_dashboard        FROM agents LEFT JOIN presence  — correct direction, no blind spot
+--   v_agent_liveness         FROM agents LEFT JOIN presence  — this migration
+--   v_ops_presence_heartbeats FROM presence JOIN agents      — the blind spot, kept deliberately
+--   v_ops_table_growth       names 'presence' as a row-count subject, not a liveness reader
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(c.relname, ', ' order by c.relname)
+     from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = 'agent_board' and c.relkind = 'v'
+      and pg_get_viewdef(c.oid) ~ 'presence'),
+  'v_agent_dashboard, v_agent_liveness, v_ops_presence_heartbeats, v_ops_table_growth',
+  'AL-11 CLASS: exactly these four agent_board views read presence — a new one fails here and names itself, so its join direction gets stated instead of assumed');
+
+select * from finish();
+rollback;

package/tests/agent_board_ownerless_renew_ttl.test.sql

@@ -0,0 +1,226 @@
+-- #373 — the ownerless TTL cap must bind at RENEW, not only at acquire.
+--
+-- ORT-3 IS THE ASSERTION THIS FILE EXISTS FOR, and it is written as the ATTACK: acquire a lease
+-- inside the cap, then renew it far past the cap. Before this migration that succeeded and could
+-- be repeated forever, so the 30-day bound the cap advertised did not exist. The existing suite
+-- could not have caught its removal because it exercises acquire only — which is exactly how the
+-- gap survived.
+--
+-- ORT-4 IS THE TWIN, and without it ORT-3 is satisfiable by a function that simply refuses to
+-- renew anything. Clamping must still RENEW: a within-cap request has to pass through untouched.
+-- A guard that works by breaking the feature is the failure mode this repo has hit before.
+--
+-- WHY CLAMP AND NOT RAISE, asserted rather than assumed (ORT-3 checks the resulting timestamp, not
+-- an error): acquire RAISES on an over-cap request because nothing is lost by asking again, but a
+-- renew that raised would kill a lease the agent is actively holding. Renew already resolves the
+-- fleet-kind horizon the same way. If someone later "hardens" this into a raise, ORT-3 fails.
+--
+-- SCOPING. The guard flag is fleet-wide state shared with every other test, so this file SETS it
+-- explicitly rather than inheriting whatever ran before — an inherited `false` would make every
+-- assertion here pass vacuously against a completely unguarded function.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(11);
+
+-- ---------------------------------------------------------------------------
+-- Fixture: one agent, one board-linked thread, and the guard flag ON.
+-- ---------------------------------------------------------------------------
+create temp table _ort (agent uuid, auth_user uuid, thread uuid, board uuid) on commit drop;
+
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_agent uuid := gen_random_uuid();
+  v_user uuid;
+  v_thread uuid := gen_random_uuid();
+  v_board uuid;
+begin
+  v_user := public.ensure_github_user('ort-' || v_sfx, 'ort-' || v_sfx || '@example.test', 'ort-' || v_sfx, 'ORT Agent');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_agent, 'agent', 'ort-' || v_sfx, 'ORT Agent', 'active', v_user, v_user);
+
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', v_user::text, true);
+  select board_id into v_board
+    from agent_board.create_board(v_agent, 'ort-' || v_sfx, 'ORT Board', 'ownerless renew', '{}'::jsonb, 'private');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values (v_thread, 'coordination', v_agent, 'ORT thread', v_board);
+
+  insert into _ort values (v_agent, v_user, v_thread, v_board);
+end $$;
+
+-- The guard must be ON or every assertion below passes against an unguarded function.
+insert into agent_board.claimgate_enforcement_flags(scope_key, enabled)
+values ('ownerless_guards', true)
+on conflict (scope_key) do update set enabled = true;
+
+-- ---------------------------------------------------------------------------
+-- ORT-1/2: the acquire half still behaves — the baseline this migration must not disturb.
+-- ---------------------------------------------------------------------------
+select throws_ok(
+  format($$ select * from agent_board.acquire_claim(%L, 'file', 'ort-overcap-acquire', now() + interval '400 days', null, %L) $$,
+         (select agent from _ort)::text, (select thread from _ort)::text),
+  '22023',
+  null,
+  'ORT-1: acquire still REJECTS an over-cap ownerless lease (22023) — the half that already worked');
+
+select lives_ok(
+  format($$ select * from agent_board.acquire_claim(%L, 'file', 'ort-within-cap', now() + interval '1 day', null, %L) $$,
+         (select agent from _ort)::text, (select thread from _ort)::text),
+  'ORT-2: a within-cap acquire still succeeds');
+
+-- ---------------------------------------------------------------------------
+-- ORT-3: THE ATTACK. Renew that same lease far past the cap. Before this migration the renewed
+-- lease landed at +400 days; now it is clamped to the 30-day horizon.
+-- ---------------------------------------------------------------------------
+create temp table _tok (lease_token uuid) on commit drop;
+insert into _tok
+select lease_token from agent_board.claims
+ where agent_id = (select agent from _ort) and resource_key = 'ort-within-cap' and status = 'active';
+
+do $$
+begin
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at <= now() + agent_board._claimgate_ownerless_ttl_cap() + interval '1 minute'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-3 THE POINT: a renew asking for +400 days is CLAMPED to the 30-day cap — before this it landed at 400 days and could be repeated forever');
+
+select ok(
+  (select lease_expires_at > now() + interval '29 days'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-3b: and it is clamped TO the cap, not to something arbitrarily short');
+
+-- ---------------------------------------------------------------------------
+-- ORT-4: THE TWIN. Clamping must not become refusing — a within-cap renew passes through exactly.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '2 days');
+end $$;
+
+select ok(
+  (select lease_expires_at between now() + interval '47 hours' and now() + interval '49 hours'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-4: a WITHIN-cap renew is untouched (+2 days lands at +2 days) — a guard that refused every renew would pass ORT-3 and be useless');
+
+-- ---------------------------------------------------------------------------
+-- ORT-5: the operator carve-out. service_role is exempt on renew exactly as on acquire, so an
+-- operator can still extend a lease deliberately.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  perform set_config('request.jwt.claims', '', true);
+  perform set_config('request.jwt.claim.sub', '', true);
+  perform set_config('request.jwt.claim.role', '', true);
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at > now() + interval '300 days'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-5: service_role is EXEMPT at renew, same carve-out as acquire — an operator extension is not clamped');
+
+-- ---------------------------------------------------------------------------
+-- ORT-6: the flag governs BOTH paths. With ownerless_guards off, renew stops clamping — so the
+-- operator switch means the same thing on each path rather than half-latching.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  update agent_board.claimgate_enforcement_flags set enabled = false where scope_key = 'ownerless_guards';
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', (select auth_user from _ort)::text, true);
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at > now() + interval '300 days'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-6: with ownerless_guards OFF the renew is NOT clamped — one flag governs acquire and renew alike');
+
+-- ---------------------------------------------------------------------------
+-- ORT-7: the board opt-out reaches renew too. A board coordinating its own locking
+-- (claim_policy='advisory') is not clamped on either path.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  update agent_board.claimgate_enforcement_flags set enabled = true where scope_key = 'ownerless_guards';
+  perform agent_board.set_board_claim_policy((select board from _ort), 'advisory');
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at > now() + interval '300 days'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-7: a board with claim_policy=advisory is not clamped at renew either — the opt-out is not acquire-only, which would have been the same bug one layer down');
+
+-- ---------------------------------------------------------------------------
+-- ORT-8: CLASS. Catalog-derived, so the acquire/renew asymmetry that caused #373 fails a test if
+-- it ever returns. Scored on the pair rather than on renew alone: asserting only "renew has the
+-- cap" would pass if acquire silently LOST it.
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(p.proname || '=' || (agent_board_test.stripped_body(p.oid, true) ~ '_claimgate_ownerless_ttl_cap')::text, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname in ('acquire_claim', 'renew_claim')),
+  'acquire_claim=true, renew_claim=true',
+  'ORT-8 CLASS: BOTH acquire and renew reference the ownerless TTL cap — #373 was exactly this pair reading true/false');
+
+-- ---------------------------------------------------------------------------
+-- ORT-9: THE OTHER TWO KINDS. Every assertion above drives `file`, so dropping 'tool' or 'custom'
+-- from renew's kind list passed the entire battery — named independently by two review seats as
+-- the seventh mutation, and they were right. ORT-8's catalog scan cannot see it either: the helper
+-- reference stays present while two thirds of the class stop being covered.
+--
+-- Both kinds are exercised BEHAVIOURALLY rather than by widening the scan, because the defect is
+-- "this kind is not clamped", which only a clamp observation can catch.
+-- ---------------------------------------------------------------------------
+do $$
+declare k text; tok uuid;
+begin
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', (select auth_user from _ort)::text, true);
+  perform agent_board.set_board_claim_policy((select board from _ort), 'inherit');
+  foreach k in array array['tool', 'custom'] loop
+    select lease_token into tok
+      from agent_board.acquire_claim((select agent from _ort), k, 'ort-' || k, now() + interval '1 day', null, (select thread from _ort));
+    perform agent_board.renew_claim(tok, now() + interval '400 days');
+  end loop;
+end $$;
+
+select is(
+  (select string_agg(resource_kind || '=' ||
+            (lease_expires_at <= now() + agent_board._claimgate_ownerless_ttl_cap() + interval '1 minute')::text, ', ' order by resource_kind)
+     from agent_board.claims
+    where agent_id = (select agent from _ort) and resource_kind in ('tool', 'custom') and status = 'active'),
+  'custom=true, tool=true',
+  'ORT-9: tool and custom are clamped at renew too — every other assertion drives `file`, so dropping either from the kind list passed the whole battery');
+
+-- ---------------------------------------------------------------------------
+-- ORT-10: A CLAIM WITH NO THREAD IS STILL CLAMPED. The renew-side twin of BCP-5: the board opt-out
+-- is resolved from the claim's thread, and a claim with no thread must fall back to `inherit`
+-- rather than escaping the guard by omission. Named by a third seat as its own seventh mutation —
+-- adding `and v_thread_id is not null` to the renew guard would let an agent acquire a within-cap
+-- threadless lease and then renew it to +400 days.
+-- ---------------------------------------------------------------------------
+do $$
+declare tok uuid;
+begin
+  select lease_token into tok
+    from agent_board.acquire_claim((select agent from _ort), 'file', 'ort-nothread', now() + interval '1 day', null, null);
+  perform agent_board.renew_claim(tok, now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at <= now() + agent_board._claimgate_ownerless_ttl_cap() + interval '1 minute'
+     from agent_board.claims where agent_id = (select agent from _ort) and resource_key = 'ort-nothread' and status = 'active'),
+  'ORT-10: a claim with NO thread is still clamped at renew — the board opt-out cannot be obtained by omitting the thread');
+
+select * from finish();
+rollback;

package/tests/catalog/p_metadata_parameters.json

@@ -321,6 +321,10 @@
       "signature": "add_artifact(p_created_by_agent_id uuid, p_uri text, p_artifact_type text, p_storage_kind text, p_thread_id uuid, p_task_id uuid, p_message_id uuid, p_task_event_id uuid, p_metadata jsonb)",
       "declares_p_metadata": true
     },
+    {
+      "signature": "agent_liveness_summary()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "append_task_event(p_task_id uuid, p_actor_agent_id uuid, p_event_type text, p_payload jsonb, p_status text, p_assigned_agent_id uuid, p_completed_at timestamp with time zone)",
       "declares_p_metadata": false