@consiliency/agent-board-schema 1.48.0 → 1.50.0

package/tests/agent_board_ownerless_quota_census.test.sql

@@ -386,6 +386,12 @@ select is(
 -- membership to exercise it would be testing who may set the policy (BCP's subject) rather than
 -- what the reader does with it. updated_at is set as the RPC sets it, so the row is not a shape
 -- the RPC could never produce.
+--
+-- SINCE #400 THE TWO PATHS DIVERGE IN ONE RESPECT, recorded here rather than left as a silent
+-- premise: the RPC ALSO re-applies the ownerless TTL cap to this board's active ownerless claims on
+-- an advisory -> inherit revert, and a direct UPDATE does not. It changes nothing this assertion
+-- reads — a clamped 30-day lease is still active and still counted — but "the row is not a shape
+-- the RPC could never produce" is now a statement about the BOARD row only.
 update agent_board.boards
    set claim_policy = 'inherit', updated_at = now()
  where id = (select adv_board from _oq);

package/tests/agent_board_ownerless_renew_quota.test.sql

@@ -7,8 +7,16 @@
 -- SCOPED, AND THE SCOPE IS ASSERTED HERE RATHER THAN PROMISED IN PROSE. That convergence holds
 -- against an agent whose boards do not opt out. It does NOT hold against one whose board is flipped
 -- to `claim_policy = 'advisory'` and back, which an owner may do at will and which an agent that
--- created its own board may do to itself. ORQ-11/12 perform that flip-flop and pin both halves: the
--- horizon survives the revert, and the census cannot see that it was taken.
+-- created its own board may do to itself. ORQ-11/12 perform that flip-flop and pin what survives it.
+--
+-- #400 CHANGED WHAT SURVIVES, AND ORQ-11'S CONTRACT WITH IT. When this file shipped, the escape was
+-- UNBOUNDED: the horizon taken during the advisory window survived the revert intact, so one flip
+-- bought as much time as the agent asked for. Reverting to 'inherit' now re-applies the ownerless
+-- TTL cap to that board's active ownerless claims, so a cycle banks at most
+-- `_claimgate_ownerless_ttl_cap()` — what any claim on any inherit board may hold. ORQ-11 asserts
+-- the CLAMP where it used to assert the survival. The escape is BOUNDED, not closed: an owner
+-- flipping before each expiry still keeps an over-quota agent over quota, and ORQ-12 is unchanged
+-- because the census still cannot see that any of it happened.
 --
 -- ORQ-1 IS THE ASSERTION THIS FILE EXISTS FOR, and it is written as the attack #388 describes: an
 -- agent that is already over the ceiling asks for +400 days, which before this migration it got,
@@ -431,6 +439,21 @@ select is(
 -- monotone clamp guarantees convergence against an agent whose boards do not opt out; it guarantees
 -- NOTHING against one whose board owner cooperates, and the flip-flop can be repeated forever.
 --
+-- WHAT #400 TOOK AWAY IS THE HORIZON, NOT THE FLIP. The revert now re-applies the ownerless TTL cap
+-- (BCP-11 owns the mechanics), so ORQ-11b's +400 days does not survive ORQ-11c. ORQ-11 asserts that
+-- clamp. Its contract genuinely CHANGED — it used to assert `now() + 400 days` and now asserts
+-- `now() + _claimgate_ownerless_ttl_cap()` — and the change is legitimate because the BEHAVIOUR
+-- changed underneath it, not because a red test needed to go green: the migration is what makes the
+-- old value impossible, and this assertion is the one #399 deliberately left in place so that
+-- closing the escape could not be done in prose.
+--
+-- IT IS STILL AN ESCAPE, AND THIS ASSERTION STILL DOCUMENTS ONE. Each cycle banks up to the cap, so
+-- an owner flipping every 29 days keeps an over-quota agent over quota indefinitely; convergence is
+-- still defeatable by a board owner, just no longer by a single flip. To hold MORE than the cap the
+-- board must STAY advisory — and while it does, those claims are counted by the census's
+-- claims_on_advisory_boards, which is the column an operator reads. Above the cap the escape is
+-- ineffective or visible; below it, ORQ-12 still applies.
+--
 -- AND THE AGENT CAN BE ITS OWN OWNER, which is why the fixture builds this board through
 -- create_board rather than inserting it. create_board seeds the creator's owner membership and
 -- set_board_claim_policy is gated on exactly that, so no accomplice is required — an agent that
@@ -459,11 +482,12 @@ select lives_ok(
 
 select is(
   (select lease_expires_at from agent_board.claims where lease_token = (select tok from _tok where name = 'over-escape')),
-  now() + interval '400 days',
-  'ORQ-11 THE ESCAPE HATCH: reverting to inherit does NOT take the horizon back — the +400 day lease survives the revert, so an owner who flips advisory/inherit before each expiry keeps an over-quota agent over quota forever. Convergence is guaranteed only against an agent whose boards do not opt out');
+  now() + agent_board._claimgate_ownerless_ttl_cap(),
+  'ORQ-11 THE ESCAPE HATCH, BOUNDED (#400): reverting to inherit TAKES THE HORIZON BACK to the ownerless TTL cap — the +400 day lease does not survive the revert, so a flip-flop banks at most what any claim on any inherit board may hold. Still an escape (the owner may flip again before that expiry), no longer an unbounded one');
 
--- The second half, kept HERE rather than in the census file. The escape and its invisibility are
--- one defect: the census resolves board policy at QUERY time (OQ-29's subject), so once the board
+-- The second half, kept HERE rather than in the census file, and UNCHANGED by #400 — which is the
+-- point of keeping it. Bounding the horizon did nothing about the visibility: the escape and its
+-- invisibility are one defect: the census resolves board policy at QUERY time (OQ-29's subject), so once the board
 -- is back to 'inherit' this claim contributes ZERO to claims_on_advisory_boards while the overage
 -- it produced is still counted. An operator reading the census sees an agent over quota with no
 -- advisory share — the exact shape that says "this one is a squatter, act on it" — and the column
@@ -499,14 +523,19 @@ select is(
 -- text asserts "acquire_claim/renew_claim are the only SQL writers" — a recorded fact, which rule 5
 -- says is a claim about the moment it was written. Derived here instead, so a third writer that
 -- needs this guard fails a test and NAMES ITSELF rather than relying on someone remembering.
+--
+-- IT DID, one release later. #400's cap reset is exactly the third writer this assertion was built
+-- to catch, and it turned this test red before anyone wrote it down. The expected set is widened
+-- deliberately: the reset writes leases, only ever SHORTENING them to the ownerless TTL cap, and the
+-- mechanics are pinned in agent_board_board_claim_policy.test.sql (BCP-11..20).
 -- ---------------------------------------------------------------------------
 select is(
   (select string_agg(p.proname, ', ' order by p.proname)
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid, true) ~ '(lease_expires_at\s*=[^=]|insert into agent_board\.claims\s*\([^)]*lease_expires_at)'),
-  'acquire_claim, renew_claim',
-  'ORQ-14 CLASS: acquire_claim and renew_claim are the ONLY functions that write a claim lease — a new one names itself here instead of quietly inheriting an unconverged renewal path');
+  'acquire_claim, renew_claim, set_board_claim_policy',
+  'ORQ-14 CLASS: acquire_claim, renew_claim and (since #400) set_board_claim_policy''s advisory-revert cap reset are the ONLY functions that write a claim lease — a new one names itself here instead of quietly inheriting an unconverged renewal path');
 
 -- ---------------------------------------------------------------------------
 -- ORQ-15/14: CLASS, one definition of the count. Three hand-copies of a predicate across two

package/tests/catalog/p_metadata_parameters.json

@@ -73,10 +73,22 @@
       "signature": "_claimgate_board_claim_policy(p_thread_id uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_claimgate_board_claim_policy_of(p_board_id uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_claimgate_board_of_thread(p_thread_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_claimgate_kind_enforced(p_resource_kind text)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_claimgate_lock_board_policy(p_board_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_claimgate_max_lease_horizon()",
       "declares_p_metadata": false
@@ -85,6 +97,10 @@
       "signature": "_claimgate_ownerless_guards_enabled()",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_claimgate_ownerless_kinds()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_claimgate_ownerless_quota()",
       "declares_p_metadata": false

package/tests/fixtures/test-prereqs.sql

@@ -859,3 +859,189 @@ COMMENT ON FUNCTION agent_board_test.lock_edges() IS
   'FK-aware per-function row-lock edge set: explicit locks, write locks, and the FOR KEY SHARE / child locks PostgreSQL takes through foreign keys. Test-only; see message-board#281.';
 
 GRANT USAGE ON SCHEMA agent_board_test TO PUBLIC;
+
+-- ---------------------------------------------------------------------------
+-- IDENTIFIER MATCHERS (Consiliency/message-board#405, #417). ONE definition of
+-- "does this body reference agent_board.<name>", used by every assertion that asks.
+--
+-- WHY THESE EXIST. The same lookup was hand-written at ~20 sites and drifted twice in
+-- opposite directions in consecutive review rounds: first too STRICT (an abutting-paren,
+-- schema-qualified, case-sensitive strpos missed `_claimgate_lock_board_policy (v)` and
+-- `"_claimgate_lock_board_policy"(v)`), then too TOLERANT (a `[^A-Za-z0-9_]` guard accepts `.`,
+-- so `other_schema."_claimgate_lock_board_policy"(v)` matched as though it named OUR helper, and
+-- blanket case-insensitivity folded `"AGENT_BOARD"` onto `agent_board` although PostgreSQL treats
+-- those as DISTINCT objects). The target is not "more tolerant" — it is EXACTLY as tolerant as
+-- PostgreSQL's identifier rules, which is a thing to encode once rather than to re-derive per site.
+--
+-- THE RULES ENCODED, verified against the server rather than recalled:
+--   * an UNQUOTED identifier folds to lower case, so any case spelling names the same object
+--     (`to_regclass('AGENT_BOARD.boards') is not distinct from to_regclass('agent_board.boards')`
+--     returns true);
+--   * a QUOTED identifier is case-SENSITIVE, so `"AGENT_BOARD".boards` is a different object
+--     (`to_regclass('"AGENT_BOARD".boards')` returns NULL);
+--   * a reference is ours only if it is UNQUALIFIED or qualified by exactly `agent_board` — any
+--     other qualifier names someone else's object.
+--
+-- CALLERS MUST USE `~` / regexp_instr WITHOUT THE 'i' FLAG. The case rules are inside these
+-- patterns; adding 'i' would fold the quoted alternative and reintroduce the second defect.
+-- Keywords that should stay case-insensitive get agent_board_test.ci_re() for the same reason.
+
+-- A SPACE IN p_text BECOMES `\s+`, because every space this is ever given separates the words of a
+-- multiword SQL keyword (`insert into`, `no key`, `key share`) and PostgreSQL accepts any whitespace
+-- run there. stmt_re used to do that rewrite on ci_re's OUTPUT — a caller textually transforming a
+-- shared matcher, which is the same shape as CPR-6 stripping a director, and fragile in the same
+-- way: it depended on ci_re never emitting a space for some other reason. The rule belongs in the
+-- matcher, so no call site edits what a matcher returns.
+create or replace function agent_board_test.ci_re(p_text text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select coalesce(string_agg(case when c ~ '[A-Za-z]' then '[' || upper(c) || lower(c) || ']'
+                                  when c = ' '        then '\s+'
+                                  else c end, ''), '')
+    from regexp_split_to_table(p_text, '') as c
+$$;
+
+create or replace function agent_board_test.ident_re(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  -- p_name is the object's real (lower-case) name: unquoted-any-case, or quoted-exactly.
+  select '(?:' || agent_board_test.ci_re(p_name) || '|"' || p_name || '")'
+$$;
+
+-- IDENT_CHARS is PostgreSQL's unquoted-identifier continuation set, and `$` IS IN IT: `$` is legal
+-- after the first character, so `x$boards` is a DISTINCT identifier whose suffix would otherwise
+-- satisfy a `boards` matcher, and `x$_claimgate_lock_board_policy(…)` a distinct FUNCTION whose
+-- suffix would be credited as the protected helper. Omitting `$` was a real over-tolerance, found
+-- by review and reproduced before fixing.
+create or replace function agent_board_test.ident_chars() returns text
+language sql immutable set search_path to pg_catalog as $$ select 'A-Za-z0-9_$' $$;
+
+-- THE BOUNDARY GUARDS. Three rejections, each a defect that shipped:
+--   * an ASCII identifier character or a quote immediately before/after — `dashboards`, `x$boards`;
+--   * a NON-ASCII letter, which PostgreSQL also admits in an unquoted identifier, so
+--     `é_claimgate_lock_board_policy` and `claim_policyé` are DISTINCT objects whose prefix/suffix
+--     would otherwise match. The `[A-Za-z0-9_$]` class alone cannot express this;
+--   * a DOT WITH ANY WHITESPACE before the name. `other . _claimgate_lock_board_policy()` is a
+--     different schema's call, and the single-character class let it through because the character
+--     immediately before the name was a SPACE — the round-9 schema-blindness defect reopened through
+--     whitespace. PostgreSQL accepts variable-length lookbehind, verified, so `(?<!\.\s*)` states
+--     it directly rather than approximating with a fixed number of spaces.
+create or replace function agent_board_test.lead_guard() returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?<![' || agent_board_test.ident_chars() || '."])(?<![^\x00-\x7F])(?<!\.\s*)'
+$$;
+
+create or replace function agent_board_test.trail_guard() returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?![' || agent_board_test.ident_chars() || '])(?![^\x00-\x7F])'
+$$;
+
+-- The un-prefixed fragments. Public matchers add the (?c) director exactly once; these exist so a
+-- matcher can embed another without producing a mid-pattern director, which PostgreSQL rejects.
+create or replace function agent_board_test.qname_frag(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.lead_guard() || '(?:' || agent_board_test.ident_re('agent_board')
+      || '\s*\.\s*)?' || agent_board_test.ident_re(p_name) || agent_board_test.trail_guard()
+$$;
+
+create or replace function agent_board_test.call_frag(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.lead_guard() || '(?:' || agent_board_test.ident_re('agent_board')
+      || '\s*\.\s*)?' || agent_board_test.ident_re(p_name) || '\s*\('
+$$;
+
+-- THE (?c) DIRECTOR IS THE ENFORCEMENT, not the comment above it. A caller that passes 'i' to
+-- regexp_instr/regexp_matches alongside one of these patterns would previously refold the quoted
+-- alternative and credit `"AGENT_BOARD"."claims"` as `agent_board.claims`. That discipline was
+-- DOCUMENTED and then violated in the same commit that documented it, at four call sites. `(?c)`
+-- forces case-sensitive matching from inside the pattern, so a stray 'i' is now overridden rather
+-- than obeyed — verified: regexp_instr(…, '(?c)"agent_board"', …, 'i') returns 0.
+-- And misuse fails LOUDLY: a director is only legal at the START of a regular expression, so a
+-- caller who prefixes anything gets `invalid regular expression` rather than a silent fold.
+--
+-- EXACTLY WHICH CALLERS THE DIRECTOR PROTECTS, stated narrowly because the first version of this
+-- paragraph claimed more: a pattern that BEGINS with qname_re/call_re/stmt_re is protected against a
+-- passed 'i' flag AND against the `~*` operator, because the director is inside the pattern. A
+-- caller that composes a *_frag directly is NOT protected — the frags carry no director by design,
+-- since one mid-pattern is a syntax error. They exist for embedding inside the _re matchers, and
+-- EXECUTE on them is revoked below so they are not casually reachable; a test author who calls a
+-- frag with `~*` deliberately is outside what any mechanism here can prevent, and that residue is
+-- named rather than papered over.
+create or replace function agent_board_test.qname_re(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.qname_frag(p_name)
+$$;
+
+create or replace function agent_board_test.call_re(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.call_frag(p_name)
+$$;
+
+-- A COLUMN token. Unquoted identifiers fold, so `SET CLAIM_POLICY = …` names the same column as
+-- `claim_policy` — the case discipline reached the qualifier and the keywords but not the column,
+-- so an upper-case column token was silently omitted from CPR-6 and CPR-12.
+create or replace function agent_board_test.col_frag(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.lead_guard() || agent_board_test.ident_re(p_name) || agent_board_test.trail_guard()
+$$;
+
+create or replace function agent_board_test.stmt_re(p_verbs text, p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  -- "a statement whose verb is one of p_verbs and whose target is agent_board.p_rel".
+  -- SPACES INSIDE A MULTIWORD VERB BECOME `\s+`: `INSERT\nINTO` and `DELETE  FROM` are the same
+  -- statement to PostgreSQL. The hand-rolled expressions this consolidated used `\s+` and got that
+  -- right; the first shared version made the space literal and LOST a property the scattered
+  -- versions had — a consolidation is only safe if it is at least the union of what it replaces.
+  select '(?c)(?:' || (select string_agg(agent_board_test.ci_re(v), '|')
+                         from regexp_split_to_table(p_verbs, '\|') as v)
+      || ')\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+      || agent_board_test.qname_frag(p_rel)
+$$;
+
+revoke all on function agent_board_test.qname_frag(text) from public;
+revoke all on function agent_board_test.call_frag(text) from public;
+revoke all on function agent_board_test.col_frag(text) from public;
+
+-- THE INSERT-WITHOUT-COLUMN-LIST RULE, AS A NAMED OBJECT. It began as an expression inlined in
+-- CPR-6, and CPR-0's rows for it RECONSTRUCTED that expression instead of calling it — so the rows
+-- tested a copy, the copy could not diverge from itself, and mutating the production arm left them
+-- green. That is precisely the defect CPR-0 exists to catch, committed in CPR-0's own newest rows.
+-- A behaviour-table row must exercise THE SAME code object the production path compiles; anything
+-- else certifies a parallel implementation.
+--
+-- `insert into <rel> …` with no column list writes EVERY column, so for a sole-writer claim it is a
+-- writer of every column including the one being tracked. Three things this has to get right:
+--   * `(?!\s*\()` not `\s*(?!\()` — BACKTRACKING defeats the latter, since `\s*` may match zero
+--     characters and the lookahead then passes on the whitespace itself;
+--   * an ALIAS may sit between the relation and the column list, and it may be QUOTED
+--     (`insert into boards as "b"(slug, …)`), so the alias alternative admits both spellings;
+--   * VALUES / SELECT / DEFAULT / OVERRIDING are KEYWORDS, not aliases — treating them as aliases
+--     would exclude the genuine no-column-list forms this rule exists for.
+-- SPLIT INTO frag + re, matching qname/call/col, because CPR-6 embeds this rule INSIDE a larger
+-- alternation and a director is only legal at position 0. It used to embed
+-- `replace(insert_all_columns_re(...), '(?c)', '')` — so CPR-0's rows compiled X while production
+-- compiled a TEXTUAL TRANSFORMATION of X. Behaviourally identical today (CPR-6 matches with `~`,
+-- which is case-sensitive anyway, so the director is belt-and-braces there), but the rows would have
+-- stayed green if the rule ever became director-dependent, or if a `(?c)` appeared anywhere but
+-- position 0 and the replace stripped it silently. Two strings are not one object. Now CPR-6 embeds
+-- the frag and CPR-0's rows exercise the frag: the same object, no transformation at any call site.
+create or replace function agent_board_test.insert_all_columns_frag(p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.ci_re('insert') || '\s+' || agent_board_test.ci_re('into')
+      || '\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+      || agent_board_test.qname_frag(p_rel)
+      || '(?!(?:\s+(?:' || agent_board_test.ci_re('as') || '\s+)?(?!'
+      -- ONLY VALUES AND SELECT. `default` and `overriding` were excluded here too and were DEAD
+      -- CODE: an exclusion only matters if the keyword can be followed by `\s*\(` and so be mistaken
+      -- for an alias, and DEFAULT is only ever followed by VALUES, OVERRIDING by SYSTEM/USER.
+      -- Verified by reverting each: the two live exclusions change a verdict, the two dead ones do
+      -- not. Removed rather than kept with rows that cannot gate them.
+      || agent_board_test.ci_re('values')     || '(?![A-Za-z0-9_$])|'
+      || agent_board_test.ci_re('select')     || '(?![A-Za-z0-9_$]))'
+      || '(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_$]*))?\s*\()'
+$$;
+
+create or replace function agent_board_test.insert_all_columns_re(p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.insert_all_columns_frag(p_rel)
+$$;
+
+revoke all on function agent_board_test.insert_all_columns_frag(text) from public;

package/tests/isolation/expected/claimpolicy_acquire_revert_race.out

@@ -0,0 +1,66 @@
+Parsed test spec with 3 sessions
+
+starting permutation: w_begin w_flip a_begin a_acq w_commit a_commit chk
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-acq-board'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1';
+step a_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-acq-key', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000010');
+ <waiting ...>
+step w_commit: COMMIT;
+step a_acq: <... completed>
+ERROR:  ownerless claim lease horizon exceeds cap (30 days)
+step a_commit: COMMIT;
+step chk: 
+  select count(*)::int as active_claims,
+         coalesce(bool_or(lease_expires_at > now() + interval '31 days'), false) as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000001'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null;
+
+active_claims|over_cap_lease
+-------------+--------------
+            0|f             
+(1 row)
+
+
+starting permutation: a_begin a_acq a_commit chk
+step a_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1';
+step a_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-acq-key', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000010');
+
+resource_key
+------------
+cpr-acq-key 
+(1 row)
+
+step a_commit: COMMIT;
+step chk: 
+  select count(*)::int as active_claims,
+         coalesce(bool_or(lease_expires_at > now() + interval '31 days'), false) as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000001'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null;
+
+active_claims|over_cap_lease
+-------------+--------------
+            1|t             
+(1 row)
+

package/tests/isolation/expected/claimpolicy_board_scope.out

@@ -0,0 +1,73 @@
+Parsed test spec with 4 sessions
+
+starting permutation: w_begin w_flip a1_begin a1_acq w_commit a1_commit chk
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-scope-b1'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step a1_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1';
+step a1_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-scope-key-b1', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000041');
+ <waiting ...>
+step w_commit: COMMIT;
+step a1_acq: <... completed>
+ERROR:  ownerless claim lease horizon exceeds cap (30 days)
+step a1_commit: COMMIT;
+step chk: 
+  select resource_key, (lease_expires_at > now() + interval '31 days') as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000003'
+     and status = 'active' and released_at is null
+   order by resource_key;
+
+resource_key|over_cap_lease
+------------+--------------
+(0 rows)
+
+
+starting permutation: w_begin w_flip a2_begin a2_acq w_commit a2_commit chk
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-scope-b1'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step a2_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1';
+step a2_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-scope-key-b2', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000042');
+
+resource_key    
+----------------
+cpr-scope-key-b2
+(1 row)
+
+step w_commit: COMMIT;
+step a2_commit: COMMIT;
+step chk: 
+  select resource_key, (lease_expires_at > now() + interval '31 days') as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000003'
+     and status = 'active' and released_at is null
+   order by resource_key;
+
+resource_key    |over_cap_lease
+----------------+--------------
+cpr-scope-key-b2|t             
+(1 row)
+

package/tests/isolation/expected/claimpolicy_claimrow_lock_order.out

@@ -0,0 +1,80 @@
+Parsed test spec with 4 sessions
+
+starting permutation: rc_begin rc_reclaim w_begin w_flip rc_commit w_commit chk
+step rc_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rc_reclaim: 
+  select owner_agent_id
+    from agent_board.reclaim_fleet_machine(
+      '40500000-0000-4000-8000-0000000000c0', '40500000-0000-4000-8000-00000000000b',
+      '40500000-0000-4000-8000-00000000000a', 'message-board#405 lock-order probe');
+
+owner_agent_id                      
+------------------------------------
+40500000-0000-4000-8000-00000000000b
+(1 row)
+
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000f9';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-inv-board'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step rc_commit: COMMIT;
+step w_commit: COMMIT;
+step chk: 
+  select (select claim_policy from agent_board.boards where slug = 'cpr-inv-board') as policy,
+         (select owner_agent_id from agent_board.fleet_machines
+           where id = '40500000-0000-4000-8000-0000000000c0') as machine_owner;
+
+policy |machine_owner                       
+-------+------------------------------------
+inherit|40500000-0000-4000-8000-00000000000b
+(1 row)
+
+
+starting permutation: x_begin x_rowlock w_begin w_flip x_renew w_commit x_commit chk
+step x_begin: BEGIN;
+step x_rowlock: select resource_key from agent_board.claims where id = '40500000-0000-4000-8000-000000000091' for update;
+resource_key
+------------
+cpr-inv-key 
+(1 row)
+
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000f9';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-inv-board'), 'inherit');
+ <waiting ...>
+step x_renew: 
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000f9';
+  select resource_key
+    from agent_board.renew_claim('40500000-0000-4000-8000-0000000000f8', now() + interval '400 days');
+ <waiting ...>
+step w_flip: <... completed>
+ERROR:  deadlock detected
+step x_renew: <... completed>
+resource_key
+------------
+cpr-inv-key 
+(1 row)
+
+step w_commit: COMMIT;
+step x_commit: COMMIT;
+step chk: 
+  select (select claim_policy from agent_board.boards where slug = 'cpr-inv-board') as policy,
+         (select owner_agent_id from agent_board.fleet_machines
+           where id = '40500000-0000-4000-8000-0000000000c0') as machine_owner;
+
+policy  |                       machine_owner
+--------+------------------------------------
+advisory|40500000-0000-4000-8000-000000000009
+(1 row)
+

package/tests/isolation/expected/claimpolicy_isolation_refusal.out

@@ -0,0 +1,114 @@
+Parsed test spec with 5 sessions
+
+starting permutation: rr_begin rr_acq rr_rollback chk
+step rr_begin: BEGIN ISOLATION LEVEL REPEATABLE READ; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step rr_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-iso-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000050');
+
+ERROR:  claim policy enforcement requires transaction isolation level read committed (got repeatable read)
+step rr_rollback: ROLLBACK;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims
+------
+<none>
+(1 row)
+
+
+starting permutation: rc_begin rc_acq rc_commit chk
+step rc_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step rc_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-iso-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000050');
+
+resource_key
+------------
+cpr-iso-key 
+(1 row)
+
+step rc_commit: COMMIT;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims     
+-----------
+cpr-iso-key
+(1 row)
+
+
+starting permutation: rr_begin rr_machine rr_rollback chk
+step rr_begin: BEGIN ISOLATION LEVEL REPEATABLE READ; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step rr_machine: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'machine', 'cpr-iso-machine', now() + interval '1 hour',
+                                  null, null);
+
+resource_key   
+---------------
+cpr-iso-machine
+(1 row)
+
+step rr_rollback: ROLLBACK;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims
+------
+<none>
+(1 row)
+
+
+starting permutation: sz_begin sz_acq sz_rollback chk
+step sz_begin: BEGIN ISOLATION LEVEL SERIALIZABLE; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step sz_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-iso-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000050');
+
+ERROR:  claim policy enforcement requires transaction isolation level read committed (got serializable)
+step sz_rollback: ROLLBACK;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims
+------
+<none>
+(1 row)
+
+
+starting permutation: ru_begin ru_acq ru_rollback chk
+step ru_begin: BEGIN ISOLATION LEVEL READ UNCOMMITTED; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step ru_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-iso-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000050');
+
+ERROR:  claim policy enforcement requires transaction isolation level read committed (got read uncommitted)
+step ru_rollback: ROLLBACK;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims
+------
+<none>
+(1 row)
+