@consiliency/agent-board-schema 1.44.0 → 1.48.0

package/tests/agent_board_ownerless_renew_ttl.test.sql

@@ -0,0 +1,226 @@
+-- #373 — the ownerless TTL cap must bind at RENEW, not only at acquire.
+--
+-- ORT-3 IS THE ASSERTION THIS FILE EXISTS FOR, and it is written as the ATTACK: acquire a lease
+-- inside the cap, then renew it far past the cap. Before this migration that succeeded and could
+-- be repeated forever, so the 30-day bound the cap advertised did not exist. The existing suite
+-- could not have caught its removal because it exercises acquire only — which is exactly how the
+-- gap survived.
+--
+-- ORT-4 IS THE TWIN, and without it ORT-3 is satisfiable by a function that simply refuses to
+-- renew anything. Clamping must still RENEW: a within-cap request has to pass through untouched.
+-- A guard that works by breaking the feature is the failure mode this repo has hit before.
+--
+-- WHY CLAMP AND NOT RAISE, asserted rather than assumed (ORT-3 checks the resulting timestamp, not
+-- an error): acquire RAISES on an over-cap request because nothing is lost by asking again, but a
+-- renew that raised would kill a lease the agent is actively holding. Renew already resolves the
+-- fleet-kind horizon the same way. If someone later "hardens" this into a raise, ORT-3 fails.
+--
+-- SCOPING. The guard flag is fleet-wide state shared with every other test, so this file SETS it
+-- explicitly rather than inheriting whatever ran before — an inherited `false` would make every
+-- assertion here pass vacuously against a completely unguarded function.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(11);
+
+-- ---------------------------------------------------------------------------
+-- Fixture: one agent, one board-linked thread, and the guard flag ON.
+-- ---------------------------------------------------------------------------
+create temp table _ort (agent uuid, auth_user uuid, thread uuid, board uuid) on commit drop;
+
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_agent uuid := gen_random_uuid();
+  v_user uuid;
+  v_thread uuid := gen_random_uuid();
+  v_board uuid;
+begin
+  v_user := public.ensure_github_user('ort-' || v_sfx, 'ort-' || v_sfx || '@example.test', 'ort-' || v_sfx, 'ORT Agent');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_agent, 'agent', 'ort-' || v_sfx, 'ORT Agent', 'active', v_user, v_user);
+
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', v_user::text, true);
+  select board_id into v_board
+    from agent_board.create_board(v_agent, 'ort-' || v_sfx, 'ORT Board', 'ownerless renew', '{}'::jsonb, 'private');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values (v_thread, 'coordination', v_agent, 'ORT thread', v_board);
+
+  insert into _ort values (v_agent, v_user, v_thread, v_board);
+end $$;
+
+-- The guard must be ON or every assertion below passes against an unguarded function.
+insert into agent_board.claimgate_enforcement_flags(scope_key, enabled)
+values ('ownerless_guards', true)
+on conflict (scope_key) do update set enabled = true;
+
+-- ---------------------------------------------------------------------------
+-- ORT-1/2: the acquire half still behaves — the baseline this migration must not disturb.
+-- ---------------------------------------------------------------------------
+select throws_ok(
+  format($$ select * from agent_board.acquire_claim(%L, 'file', 'ort-overcap-acquire', now() + interval '400 days', null, %L) $$,
+         (select agent from _ort)::text, (select thread from _ort)::text),
+  '22023',
+  null,
+  'ORT-1: acquire still REJECTS an over-cap ownerless lease (22023) — the half that already worked');
+
+select lives_ok(
+  format($$ select * from agent_board.acquire_claim(%L, 'file', 'ort-within-cap', now() + interval '1 day', null, %L) $$,
+         (select agent from _ort)::text, (select thread from _ort)::text),
+  'ORT-2: a within-cap acquire still succeeds');
+
+-- ---------------------------------------------------------------------------
+-- ORT-3: THE ATTACK. Renew that same lease far past the cap. Before this migration the renewed
+-- lease landed at +400 days; now it is clamped to the 30-day horizon.
+-- ---------------------------------------------------------------------------
+create temp table _tok (lease_token uuid) on commit drop;
+insert into _tok
+select lease_token from agent_board.claims
+ where agent_id = (select agent from _ort) and resource_key = 'ort-within-cap' and status = 'active';
+
+do $$
+begin
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at <= now() + agent_board._claimgate_ownerless_ttl_cap() + interval '1 minute'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-3 THE POINT: a renew asking for +400 days is CLAMPED to the 30-day cap — before this it landed at 400 days and could be repeated forever');
+
+select ok(
+  (select lease_expires_at > now() + interval '29 days'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-3b: and it is clamped TO the cap, not to something arbitrarily short');
+
+-- ---------------------------------------------------------------------------
+-- ORT-4: THE TWIN. Clamping must not become refusing — a within-cap renew passes through exactly.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '2 days');
+end $$;
+
+select ok(
+  (select lease_expires_at between now() + interval '47 hours' and now() + interval '49 hours'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-4: a WITHIN-cap renew is untouched (+2 days lands at +2 days) — a guard that refused every renew would pass ORT-3 and be useless');
+
+-- ---------------------------------------------------------------------------
+-- ORT-5: the operator carve-out. service_role is exempt on renew exactly as on acquire, so an
+-- operator can still extend a lease deliberately.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  perform set_config('request.jwt.claims', '', true);
+  perform set_config('request.jwt.claim.sub', '', true);
+  perform set_config('request.jwt.claim.role', '', true);
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at > now() + interval '300 days'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-5: service_role is EXEMPT at renew, same carve-out as acquire — an operator extension is not clamped');
+
+-- ---------------------------------------------------------------------------
+-- ORT-6: the flag governs BOTH paths. With ownerless_guards off, renew stops clamping — so the
+-- operator switch means the same thing on each path rather than half-latching.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  update agent_board.claimgate_enforcement_flags set enabled = false where scope_key = 'ownerless_guards';
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', (select auth_user from _ort)::text, true);
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at > now() + interval '300 days'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-6: with ownerless_guards OFF the renew is NOT clamped — one flag governs acquire and renew alike');
+
+-- ---------------------------------------------------------------------------
+-- ORT-7: the board opt-out reaches renew too. A board coordinating its own locking
+-- (claim_policy='advisory') is not clamped on either path.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  update agent_board.claimgate_enforcement_flags set enabled = true where scope_key = 'ownerless_guards';
+  perform agent_board.set_board_claim_policy((select board from _ort), 'advisory');
+  perform agent_board.renew_claim((select lease_token from _tok), now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at > now() + interval '300 days'
+     from agent_board.claims where lease_token = (select lease_token from _tok)),
+  'ORT-7: a board with claim_policy=advisory is not clamped at renew either — the opt-out is not acquire-only, which would have been the same bug one layer down');
+
+-- ---------------------------------------------------------------------------
+-- ORT-8: CLASS. Catalog-derived, so the acquire/renew asymmetry that caused #373 fails a test if
+-- it ever returns. Scored on the pair rather than on renew alone: asserting only "renew has the
+-- cap" would pass if acquire silently LOST it.
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(p.proname || '=' || (agent_board_test.stripped_body(p.oid, true) ~ '_claimgate_ownerless_ttl_cap')::text, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname in ('acquire_claim', 'renew_claim')),
+  'acquire_claim=true, renew_claim=true',
+  'ORT-8 CLASS: BOTH acquire and renew reference the ownerless TTL cap — #373 was exactly this pair reading true/false');
+
+-- ---------------------------------------------------------------------------
+-- ORT-9: THE OTHER TWO KINDS. Every assertion above drives `file`, so dropping 'tool' or 'custom'
+-- from renew's kind list passed the entire battery — named independently by two review seats as
+-- the seventh mutation, and they were right. ORT-8's catalog scan cannot see it either: the helper
+-- reference stays present while two thirds of the class stop being covered.
+--
+-- Both kinds are exercised BEHAVIOURALLY rather than by widening the scan, because the defect is
+-- "this kind is not clamped", which only a clamp observation can catch.
+-- ---------------------------------------------------------------------------
+do $$
+declare k text; tok uuid;
+begin
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', (select auth_user from _ort)::text, true);
+  perform agent_board.set_board_claim_policy((select board from _ort), 'inherit');
+  foreach k in array array['tool', 'custom'] loop
+    select lease_token into tok
+      from agent_board.acquire_claim((select agent from _ort), k, 'ort-' || k, now() + interval '1 day', null, (select thread from _ort));
+    perform agent_board.renew_claim(tok, now() + interval '400 days');
+  end loop;
+end $$;
+
+select is(
+  (select string_agg(resource_kind || '=' ||
+            (lease_expires_at <= now() + agent_board._claimgate_ownerless_ttl_cap() + interval '1 minute')::text, ', ' order by resource_kind)
+     from agent_board.claims
+    where agent_id = (select agent from _ort) and resource_kind in ('tool', 'custom') and status = 'active'),
+  'custom=true, tool=true',
+  'ORT-9: tool and custom are clamped at renew too — every other assertion drives `file`, so dropping either from the kind list passed the whole battery');
+
+-- ---------------------------------------------------------------------------
+-- ORT-10: A CLAIM WITH NO THREAD IS STILL CLAMPED. The renew-side twin of BCP-5: the board opt-out
+-- is resolved from the claim's thread, and a claim with no thread must fall back to `inherit`
+-- rather than escaping the guard by omission. Named by a third seat as its own seventh mutation —
+-- adding `and v_thread_id is not null` to the renew guard would let an agent acquire a within-cap
+-- threadless lease and then renew it to +400 days.
+-- ---------------------------------------------------------------------------
+do $$
+declare tok uuid;
+begin
+  select lease_token into tok
+    from agent_board.acquire_claim((select agent from _ort), 'file', 'ort-nothread', now() + interval '1 day', null, null);
+  perform agent_board.renew_claim(tok, now() + interval '400 days');
+end $$;
+
+select ok(
+  (select lease_expires_at <= now() + agent_board._claimgate_ownerless_ttl_cap() + interval '1 minute'
+     from agent_board.claims where agent_id = (select agent from _ort) and resource_key = 'ort-nothread' and status = 'active'),
+  'ORT-10: a claim with NO thread is still clamped at renew — the board opt-out cannot be obtained by omitting the thread');
+
+select * from finish();
+rollback;

package/tests/catalog/p_metadata_parameters.json

@@ -65,6 +65,10 @@
       "signature": "_check_and_bump_child_mint_rate(p_root_agent_id uuid, p_limit integer, p_window interval)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_claimgate_active_ownerless_claims(p_agent_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_claimgate_board_claim_policy(p_thread_id uuid)",
       "declares_p_metadata": false
@@ -161,6 +165,10 @@
       "signature": "_fleet_onboarding_bounds_immutable()",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_fleet_trust_domain_approval_rank(p_lifecycle_state text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_grant_within_ceiling(p_grantor_agent_id uuid, p_board_id uuid, p_grantee_role text)",
       "declares_p_metadata": false
@@ -473,6 +481,10 @@
       "signature": "onboard_federated_fleet_agent(p_issuer text, p_audience text, p_subject text, p_human_identity_claim jsonb, p_slug text, p_agent_public_key text, p_agent_public_key_format text, p_agent_public_key_fingerprint text, p_pop_verified boolean, p_actor_sub text, p_agent_kind text, p_requested_scopes text[], p_requested_board_scopes text[], p_invite_code text, p_board_id uuid, p_machine_id uuid, p_harness_kind text, p_harness_label text, p_repo_slug text, p_repo_fingerprint text, p_repo_scope_role text, p_agent_role text, p_expected_agent_handle text)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "ownerless_quota_census()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "post_board_message(p_thread_id uuid, p_author_agent_id uuid, p_board_id uuid, p_subject text, p_body text, p_message_type text, p_priority text, p_idempotency_key text, p_metadata jsonb)",
       "declares_p_metadata": true