@consiliency/agent-board-schema 1.48.0 → 1.51.0

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 146)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 150)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(146);
+    expect(manifest.migrationCount).toBe(150);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -304,6 +304,37 @@ describe('manifest integrity', () => {
       // ceiling is untouched. acquire's inline count is extracted into
       // _claimgate_active_ownerless_claims() so the two enforcement paths cannot drift.
       '20260928000100_agent_board_ownerless_quota_renew_convergence.sql',
+      // #400 ADVISORYREVERTRESET. claim_policy='advisory' skips both the ownerless TTL cap and
+      // #388's convergence clamp, and set_board_claim_policy is gated on the owner membership
+      // create_board seeds for the creator -- so an agent that creates a board can flip to
+      // advisory, renew its ownerless claims to an arbitrary horizon, flip back to inherit, and
+      // repeat, staying over quota forever while the census (which resolves policy at query time)
+      // reports no advisory share at all. The revert now RE-APPLIES the ownerless TTL cap to that
+      // board's active ownerless claims -- least(lease_expires_at, now()+cap), clamp only, never an
+      // extension -- so a horizon banked under the opt-out cannot be kept by handing the opt-out
+      // back. advisory->inherit only, governed by ownerless_guards. Bounded, not closed: a cycle
+      // still banks up to the cap.
+      '20260929000100_agent_board_advisory_revert_cap_reset.sql',
+      // #405 CLAIMPOLICYRACE. _claimgate_board_claim_policy took no lock on boards, so any
+      // operation whose snapshot predated a committed policy change acted on policy that was
+      // already gone -- renew_claim (read stale), acquire_claim (stale AND no row for #406's
+      // reset to clamp), and set_board_claim_policy itself (readers serialised on nothing).
+      // All three now take a board-scoped advisory xact lock BEFORE the policy decision --
+      // including acquire's 'advisory' path, which skips the block the agent-scoped lock lives
+      // in -- and re-read the policy as a separate statement; renew re-reads the whole CLAIM,
+      // because #400's reset clamps the very row whose pre-wait expiry is the convergence
+      // baseline. The lock helper REFUSES any isolation level but read committed, where the
+      // wait would not advance the snapshot and the lock would be silently inert.
+      '20260930000100_agent_board_claim_policy_race.sql',
+      '20261001000100_agent_board_claimpolicy_lock_grant_revoke.sql',
+      // F1: the per-key pending-challenge cap SUPERSEDES the oldest pending challenge
+      // instead of raising challenge_pending_cap. Refusing at the cap turned a resource
+      // bound into a lockout lever on the unauthenticated /session surface -- sixteen
+      // requests naming a directory-visible handle and key id denied that key every
+      // further challenge, and the client stopped its refresh loop on the 403. The bound
+      // is unchanged; mint_fleet_agent_session now names an eviction challenge_superseded
+      // so it is retryable without making nonce_replay retryable with it.
+      '20261002000100_agent_board_session_challenge_supersede.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_board_claim_policy.test.sql

@@ -17,6 +17,13 @@
 -- the kind of reasoning that stops being true when someone moves a line, and this file would
 -- otherwise be a set of tests that only ever prove the permissive direction.
 --
+-- BCP-11..21 ARE #400: THE ADVISORY-REVERT CAP RESET. The opt-out is a TOGGLE, and that made it an
+-- escape from every ownerless bound: flip to advisory, take an arbitrary horizon, flip back, repeat
+-- — self-service, because create_board seeds the creator's owner membership and this RPC is gated
+-- on exactly that. Reverting to inherit now re-applies the ownerless TTL cap to the board's active
+-- ownerless claims, clamp only. The section pins all four transitions, both bounds (kind and board),
+-- the operator flag, and the catalog class check that this RPC is the only writer of the column.
+--
 -- BCP-5 IS THE SECOND ONE THAT MATTERS. A claim reaches its board through its thread. So the
 -- obvious hole is a claim that simply omits the thread — if that inherited "no board, therefore no
 -- enforcement", any agent could opt itself out by passing null. It resolves to 'inherit' instead,
@@ -26,7 +33,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(13);
+select plan(30);
 
 -- ---------------------------------------------------------------------------
 -- Fixture: one board with an owner and a non-owner member, a board-linked thread, and a
@@ -193,6 +200,259 @@ select throws_ok(
   null,
   'BCP-9: an unknown policy is refused as a bad argument, naming the vocabulary — not as a raw CHECK violation');
 
+-- ===========================================================================
+-- BCP-11..21 (#400): THE ADVISORY-REVERT CAP RESET.
+--
+-- THE DEFECT. The advisory carve-out is resolved at ENFORCEMENT time against the board's CURRENT
+-- policy, so an owner could flip to 'advisory', let an ownerless claim take an arbitrary horizon
+-- (the carve-out skips both the #373 TTL cap and #388's convergence clamp), flip back to 'inherit',
+-- and repeat before expiry. `create_board` seeds the creator's owner membership and this RPC is
+-- gated on exactly that, so an agent that created a board holds the switch that exempts its own
+-- claims: no accomplice. And #393's census resolves policy at QUERY time (OQ-29), so after the
+-- revert the escaped claim contributes zero to `claims_on_advisory_boards` while its overage still
+-- counts.
+--
+-- THE FIX. Reverting to 'inherit' means accepting inherit's rules: the ownerless TTL cap is
+-- re-applied to this board's active ownerless claims, clamp only. The opt-out may be given back —
+-- but not after banking a lease longer than inherit allows.
+--
+-- BOUNDED, NOT CLOSED, and this file does not pretend otherwise: each advisory window still banks
+-- up to the cap, so an owner flipping every 29 days still defeats convergence. What is gone is the
+-- UNBOUNDED horizon. ORQ-11 pins that bound end-to-end through the real RPCs.
+--
+-- NUMBERED 11+ AND PLACED HERE, BEFORE BCP-10, because BCP-10 fleet-revokes the owner and every
+-- assertion below needs that owner to be able to call this RPC. Renumbering BCP-10 would break its
+-- citations for no gain.
+-- ===========================================================================
+do $$
+declare
+  v_b uuid := gen_random_uuid();
+  v_t uuid := gen_random_uuid();
+begin
+  -- Session: the owner. BCP-7/8/9 set their GUCs INSIDE throws_ok, whose exception block rolls
+  -- them back with the raise, so the state here is the fixture's — but inferring that is exactly
+  -- the reading rule 4 exists for, so it is set explicitly instead.
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', (select owner_user from _bcp)::text, true);
+
+  -- A SECOND BOARD, and it stays 'advisory' for the whole section. It is the scope witness for
+  -- BCP-14: reverting board A must not reach a board that never reverted. Advisory is also the
+  -- realistic shape — a board still coordinating through its own mutex, legitimately holding a
+  -- lease longer than our cap.
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, claim_policy)
+  values (v_b, 'bcp400-' || substr(v_b::text, 1, 8), 'BCP 400 Other Board', (select owner_agent from _bcp), 'advisory');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values (v_t, 'coordination', (select owner_agent from _bcp), 'BCP 400 other-board thread', v_b);
+
+  create temp table _bcp400 (other_board uuid, other_thread uuid) on commit drop;
+  insert into _bcp400 values (v_b, v_t);
+end $$;
+
+select lives_ok(
+  $$ select agent_board.set_board_claim_policy((select board from _bcp), 'advisory') $$,
+  'BCP-11a: the owner opts the board out again — this is the flip an over-quota holder makes to buy an unbounded horizon');
+
+-- The claims the advisory window buys. Inserted directly rather than acquired, because three of
+-- them are shapes acquire cannot produce in one call (a 'machine' kind needs a fleet fixture, one
+-- belongs to another board, one has no thread) — but they are all shapes the DATABASE can hold:
+-- an over-cap ownerless lease exists exactly where an advisory board, a grandfathered pre-flag
+-- claim, or a service_role extension put it. BCP-11 scores a fourth claim that WAS acquired
+-- through the real RPC under advisory, so the property is not proven only on synthetic rows.
+insert into agent_board.claims(agent_id, thread_id, resource_kind, resource_key, lease_expires_at)
+values
+  ((select owner_agent from _bcp), (select thread from _bcp), 'file',    'bcp400-a-file',    now() + interval '400 days'),
+  ((select owner_agent from _bcp), (select thread from _bcp), 'tool',    'bcp400-a-tool',    now() + interval '400 days'),
+  ((select owner_agent from _bcp), (select thread from _bcp), 'custom',  'bcp400-a-custom',  now() + interval '400 days'),
+  -- an OWNED kind on the same board: governed by the fleet-authority gate, never by this cap
+  ((select owner_agent from _bcp), (select thread from _bcp), 'machine', 'bcp400-a-machine', now() + interval '400 days'),
+  -- already WITHIN the cap: the twin. A reset that assigned now()+cap would LENGTHEN this one
+  ((select owner_agent from _bcp), (select thread from _bcp), 'file',    'bcp400-a-under',   now() + interval '5 days'),
+  -- another board, still advisory
+  ((select owner_agent from _bcp), (select other_thread from _bcp400), 'file', 'bcp400-b-file', now() + interval '400 days'),
+  -- no thread at all, so no board to revert
+  ((select owner_agent from _bcp), null,                      'file',    'bcp400-free-file', now() + interval '400 days');
+
+-- Two DEAD rows on the reverting board, for BCP-21. They are inserted separately because they need
+-- columns the list above does not set.
+insert into agent_board.claims(agent_id, thread_id, resource_kind, resource_key, status, released_at, lease_expires_at, updated_at)
+values
+  -- released: least() would still shorten it, so this conjunct IS observable through the lease
+  ((select owner_agent from _bcp), (select thread from _bcp), 'file', 'bcp400-a-released', 'released', now(), now() + interval '400 days', now() - interval '3 days'),
+  -- active but LAPSED: least(now()-1h, now()+cap) is the lease it already has, so this conjunct is
+  -- observable ONLY through updated_at — which is why the row carries a distinctive one
+  ((select owner_agent from _bcp), (select thread from _bcp), 'file', 'bcp400-a-lapsed',   'active',   null,  now() - interval '1 hour',   now() - interval '3 days');
+
+select lives_ok(
+  $$ select agent_board.set_board_claim_policy((select board from _bcp), 'inherit') $$,
+  'BCP-11b: and hands the opt-out back — the step that used to cost the escaping agent nothing');
+
+-- ---------------------------------------------------------------------------
+-- BCP-11: THE POINT. Every active ownerless claim on the reverting board is clamped to the TTL cap.
+-- All three ownerless kinds are scored: every other assertion here drives `file`, and dropping
+-- 'tool' or 'custom' from the kind list is the mutation that passed ORT's entire battery (ORT-9).
+-- `rpc-acquired` is 'bcp-over-cap-advisory' from BCP-3b — taken through acquire_claim under
+-- advisory and clamped by this file's own earlier revert, so the property is pinned on a row a
+-- deployment can actually produce and not only on inserted fixtures.
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(l.label || '=' ||
+            (c.lease_expires_at = now() + agent_board._claimgate_ownerless_ttl_cap())::text, ', ' order by l.label)
+     from agent_board.claims c
+     join (values ('bcp400-a-file', 'file'),
+                  ('bcp400-a-tool', 'tool'),
+                  ('bcp400-a-custom', 'custom'),
+                  ('bcp-over-cap-advisory', 'rpc-acquired')) as l(key, label) on l.key = c.resource_key),
+  'custom=true, file=true, rpc-acquired=true, tool=true',
+  'BCP-11 THE POINT: reverting advisory -> inherit re-applies the ownerless TTL cap to this board''s active claims, all three kinds — so a horizon banked under the opt-out cannot be kept by handing the opt-out back');
+
+-- ---------------------------------------------------------------------------
+-- BCP-12: THE TWIN, and the reason the clamp is least(). A claim already within the cap must come
+-- back untouched: an assignment to now()+cap would satisfy BCP-11 and silently LENGTHEN this lease
+-- from five days to thirty. Asserts the lease only — the row's updated_at IS bumped, which is the
+-- documented cost of least() being the single mutation-visible clamp (see the migration header).
+-- ---------------------------------------------------------------------------
+select is(
+  (select lease_expires_at from agent_board.claims where resource_key = 'bcp400-a-under'),
+  now() + interval '5 days',
+  'BCP-12 THE TWIN: a lease already within the cap is preserved to the microsecond — the reset is least(held, now()+cap), not a rewrite to now()+cap, which would hand back time the claim never had');
+
+-- ---------------------------------------------------------------------------
+-- BCP-13: the kind bound. 'machine' is an OWNED kind, governed by the fleet-authority gate and by
+-- no ownerless cap at all, so the reset must not touch it — a reset that clamped every claim on the
+-- board would satisfy BCP-11 and quietly shorten fleet leases.
+-- ---------------------------------------------------------------------------
+select is(
+  (select lease_expires_at from agent_board.claims where resource_key = 'bcp400-a-machine'),
+  now() + interval '400 days',
+  'BCP-13: a machine claim on the reverting board is untouched — the reset is scoped to the ownerless kinds, which are the only ones the TTL cap ever governed');
+
+-- ---------------------------------------------------------------------------
+-- BCP-14: the board bound. This board's revert is a statement about THIS board. A claim on another
+-- board — still advisory, legitimately holding a long lease — and a claim with no thread at all
+-- must both survive it. Dropping the board join would clamp every ownerless claim in the fleet on
+-- any revert anywhere, and every assertion above would still pass.
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(l.label || '=' || (c.lease_expires_at = now() + interval '400 days')::text, ', ' order by l.label)
+     from agent_board.claims c
+     join (values ('bcp400-b-file', 'other-board'),
+                  ('bcp400-free-file', 'no-thread')) as l(key, label) on l.key = c.resource_key),
+  'no-thread=true, other-board=true',
+  'BCP-14 SCOPE: a claim on a DIFFERENT board and a claim with no thread are both untouched by this board''s revert — the reset resolves through the claim''s thread to this board, the same path the policy resolver uses');
+
+-- ---------------------------------------------------------------------------
+-- BCP-21: THE DEAD ROWS. The reset is scoped to ACTIVE, unreleased, unexpired claims — the same
+-- three conjuncts the shared count predicate uses — so a revert does not rewrite history.
+--
+-- The two halves are scored differently on purpose. A RELEASED row still holds a future timestamp,
+-- so dropping `status = 'active' and released_at is null` shortens it and the LEASE moves. A LAPSED
+-- row's lease is already in the past, and least(past, now()+cap) is that same past value — so
+-- dropping `lease_expires_at > now()` is invisible in the lease and visible ONLY as a touched row.
+-- Both rows therefore carry a distinctive updated_at, and this assertion reads it.
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(l.label || '=' ||
+            (c.lease_expires_at = l.expected and c.updated_at = now() - interval '3 days')::text, ', ' order by l.label)
+     from agent_board.claims c
+     join (values ('bcp400-a-released', 'released', now() + interval '400 days'),
+                  ('bcp400-a-lapsed',   'lapsed',   now() - interval '1 hour')) as l(key, label, expected) on l.key = c.resource_key),
+  'lapsed=true, released=true',
+  'BCP-21: a RELEASED claim and a LAPSED one on the reverting board are not touched at all — same lease, same updated_at. The reset governs live leases, not the ledger of dead ones');
+
+-- ---------------------------------------------------------------------------
+-- BCP-15..17: THE TRANSITION CONDITION, all three non-triggering transitions. The rows below are
+-- inserted once, while the board is 'inherit', and each is read after its own transition.
+--
+-- BCP-17 (advisory -> advisory) is the one the other two cannot see: dropping the `= 'inherit'`
+-- conjunct leaves "was previously advisory", which still clamps nothing on either inherit-first
+-- case. Without it that mutation survives BCP-15 and BCP-16 untouched.
+-- ---------------------------------------------------------------------------
+insert into agent_board.claims(agent_id, thread_id, resource_kind, resource_key, lease_expires_at)
+values
+  ((select owner_agent from _bcp), (select thread from _bcp), 'file', 'bcp400-noop-ii',  now() + interval '400 days'),
+  ((select owner_agent from _bcp), (select thread from _bcp), 'file', 'bcp400-noop-ia',  now() + interval '400 days'),
+  ((select owner_agent from _bcp), (select thread from _bcp), 'file', 'bcp400-noop-aa',  now() + interval '400 days'),
+  ((select owner_agent from _bcp), (select thread from _bcp), 'file', 'bcp400-flag-off', now() + interval '400 days');
+
+select lives_ok(
+  $$ select agent_board.set_board_claim_policy((select board from _bcp), 'inherit') $$,
+  'BCP-15a: the owner re-sets inherit on a board that is already inherit');
+
+select is(
+  (select lease_expires_at from agent_board.claims where resource_key = 'bcp400-noop-ii'),
+  now() + interval '400 days',
+  'BCP-15: inherit -> inherit clamps NOTHING — a no-op re-set is not a policy change, and treating it as one would let any owner shorten their own board''s leases by calling the RPC twice');
+
+select lives_ok(
+  $$ select agent_board.set_board_claim_policy((select board from _bcp), 'advisory') $$,
+  'BCP-16a: the owner opts out');
+
+select is(
+  (select lease_expires_at from agent_board.claims where resource_key = 'bcp400-noop-ia'),
+  now() + interval '400 days',
+  'BCP-16: inherit -> advisory clamps nothing — the reset belongs to the REVERT, and clamping while opting OUT would be the opposite of what the opt-out promises');
+
+select lives_ok(
+  $$ select agent_board.set_board_claim_policy((select board from _bcp), 'advisory') $$,
+  'BCP-17a: and re-sets advisory on a board that is already advisory');
+
+select is(
+  (select lease_expires_at from agent_board.claims where resource_key = 'bcp400-noop-aa'),
+  now() + interval '400 days',
+  'BCP-17: advisory -> advisory clamps nothing — the discriminating case, because a guard that asked only "was it advisory?" passes BCP-15 and BCP-16 and would clamp a board that never came back');
+
+-- ---------------------------------------------------------------------------
+-- BCP-18: ONE OPERATOR FLAG. With ownerless_guards off, nothing enforces the TTL cap at acquire or
+-- at renew, so a revert must not enforce it either — the flag means the same thing on all three
+-- write paths or it means nothing.
+-- ---------------------------------------------------------------------------
+do $$
+begin
+  update agent_board.claimgate_enforcement_flags set enabled = false where scope_key = 'ownerless_guards';
+end $$;
+
+select lives_ok(
+  $$ select agent_board.set_board_claim_policy((select board from _bcp), 'inherit') $$,
+  'BCP-18a: with the guards off the owner reverts to inherit');
+
+select is(
+  (select lease_expires_at from agent_board.claims where resource_key = 'bcp400-flag-off'),
+  now() + interval '400 days',
+  'BCP-18: with ownerless_guards OFF an advisory -> inherit revert clamps nothing — one flag governs the cap at acquire, at renew and at the revert alike');
+
+do $$
+begin
+  update agent_board.claimgate_enforcement_flags set enabled = true where scope_key = 'ownerless_guards';
+end $$;
+
+-- ---------------------------------------------------------------------------
+-- BCP-19/20: CLASS (rule 1). The hook can only close the escape if this RPC is the ONLY way
+-- boards.claim_policy changes. Derived from the catalog, not from a list: a second writer names
+-- itself here rather than silently inheriting a policy change that resets nothing.
+--
+-- Two independent bounds, because neither is sufficient alone. BCP-19 is a source scan and a source
+-- scan has a floor — it sees `set claim_policy` and not, say, a dynamic EXECUTE. BCP-20 is the
+-- privilege bound underneath it: NO role holds UPDATE on agent_board.boards, so the column cannot
+-- be written from a session at all, only from a SECURITY DEFINER function (which BCP-19 enumerates)
+-- or by the table owner. `boards` also carries no user triggers, so there is no third path.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid, true) ~ 'set\s+claim_policy'),
+  'set_board_claim_policy',
+  'BCP-19 CLASS: set_board_claim_policy is the ONLY function that writes boards.claim_policy — a second writer would need the same advisory-revert reset and fails here instead of being remembered');
+
+select is(
+  format('anon=%s, authenticated=%s, service_role=%s, user_triggers=%s',
+         has_table_privilege('anon',          'agent_board.boards', 'update')::text,
+         has_table_privilege('authenticated', 'agent_board.boards', 'update')::text,
+         has_table_privilege('service_role',  'agent_board.boards', 'update')::text,
+         (select count(*) from pg_trigger where tgrelid = 'agent_board.boards'::regclass and not tgisinternal)::text),
+  'anon=false, authenticated=false, service_role=false, user_triggers=0',
+  'BCP-20 CLASS: no role holds UPDATE on agent_board.boards and the table carries no user triggers — so the column is unreachable except through the definer function BCP-19 enumerates, which is the bound a source scan cannot give');
+
 -- ---------------------------------------------------------------------------
 -- BCP-10: A FLEET-REVOKED OWNER IS STILL AN OWNER BY MEMBERSHIP. This function shipped its first
 -- version WITHOUT this check while its own commit message claimed to mirror set_board_role_gate

package/tests/agent_board_claim_subject_gate.test.sql

@@ -850,14 +850,23 @@ select is(
 -- sides: the catalog function scan, and the effective-privilege assertions after it (no role
 -- holds a write privilege by ANY route, so a direct write is impossible and the SECURITY
 -- DEFINER bodies are the whole surface).
+--
+-- set_board_claim_policy (#400) is the FIFTH member, and it named itself here rather than being
+-- remembered -- which is what this assertion is for. It creates no claims row and re-keys nothing:
+-- its only claims write is the advisory -> inherit cap reset, `set lease_expires_at =
+-- least(lease_expires_at, now() + cap), updated_at = now()`, on the reverting board's active
+-- ownerless claims. That EXEMPTION IS ASSERTED POSITIVELY, not by absence: BCP-11/13/14 look those
+-- claims up BY resource_key and score the resulting timestamps, so a reset that re-keyed or
+-- inserted a row fails them by name, and assertion 51 below (every function that CREATES a claims
+-- row refuses without thread access) still holds because this one creates none.
 select is(
   (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
       and lower(agent_board_test.stripped_body(p.oid, true))
           ~ '(insert\s+into|merge\s+into|update|delete\s+from|truncate)(\s+table)?(\s+only)?\s+(("?agent_board"?\s*\.\s*)?claims\M|("?agent_board"?\s*\.\s*)?"claims")'),
-  'acquire_claim,reclaim_fleet_machine,release_claim,renew_claim',
-  'catalog: these four are the ONLY agent_board functions that write claims (insert/merge/update/delete/TRUNCATE) -- a new writer names itself here');
+  'acquire_claim,reclaim_fleet_machine,release_claim,renew_claim,set_board_claim_policy',
+  'catalog: these five are the ONLY agent_board functions that write claims (insert/merge/update/delete/TRUNCATE) -- a new writer names itself here');
 
 select is(
   (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')

package/tests/agent_board_claimkey.test.sql

@@ -211,8 +211,14 @@ select set_eq(
   -- active machine claim(s) on the reclaimed fingerprint so the new owner can acquire. It routes the
   -- key through _canonical_claim_key (assertion 25 stays 0); its positive state claim (status set to
   -- 'released') is pinned in agent_board_fleet_machine_reclaim.test.sql.
-  array['acquire_claim', 'renew_claim', 'release_claim', 'reclaim_fleet_machine'],
-  'exactly acquire/renew/release/reclaim write agent_board.claims (catalog-enumerated writer class)');
+  -- set_board_claim_policy (#400) is a fifth writer: an advisory -> inherit revert re-applies the
+  -- ownerless TTL cap to that board's active ownerless claims. It is EXEMPT FROM ASSERTION 25 by a
+  -- DERIVED property and not by name -- its claims UPDATE sets only lease_expires_at/updated_at and
+  -- its body never mentions resource_key at all, so there is no key for the normalizer to canonicalize.
+  -- The exemption's positive claim (the reset moves lease timestamps and nothing else) is scored in
+  -- agent_board_board_claim_policy.test.sql BCP-11/13/14, which look the claims up BY resource_key.
+  array['acquire_claim', 'renew_claim', 'release_claim', 'reclaim_fleet_machine', 'set_board_claim_policy'],
+  'exactly acquire/renew/release/reclaim/set_board_claim_policy write agent_board.claims (catalog-enumerated writer class)');
 select is(
   (select count(*)::int
      from pg_proc p
@@ -220,6 +226,15 @@ select is(
     where n.nspname = 'agent_board'
       and p.prokind = 'f'
       and agent_board_test.stripped_body(p.oid) ~* '(insert\s+into|update)\s+(agent_board\.)?claims\M'
+      -- #400: SCOPED TO WRITERS THAT HAVE A KEY TO NORMALIZE. A claims writer whose body never
+      -- mentions resource_key cannot set one -- an UPDATE must name the column in its SET list and
+      -- an INSERT must name it in its column list (resource_key is NOT NULL) -- so requiring it to
+      -- call the normalizer would be dead code added to satisfy a check, which is the anti-pattern
+      -- rule 2 names. DERIVED, not a name exemption: a new writer that touches resource_key at all
+      -- is still in the population and still fails closed. STATED HOLE: `insert into claims select *
+      -- from ...` names no column and would slip past, which is the same shape assertion 24's regex
+      -- already cannot see.
+      and agent_board_test.stripped_body(p.oid) ~* '\mresource_key\M'
       -- message-board#196 Bucket B: read RAW, one comment naming _canonical_claim_key
       -- dropped a bypass writer out of this set and the count went to 0 green.
       -- anchored to the CALL shape: a bare-substring `!~` is satisfied by any