@consiliency/agent-board-schema 1.48.0 → 1.51.0

package/tests/fixtures/test-prereqs.sql

@@ -859,3 +859,189 @@ COMMENT ON FUNCTION agent_board_test.lock_edges() IS
   'FK-aware per-function row-lock edge set: explicit locks, write locks, and the FOR KEY SHARE / child locks PostgreSQL takes through foreign keys. Test-only; see message-board#281.';
 
 GRANT USAGE ON SCHEMA agent_board_test TO PUBLIC;
+
+-- ---------------------------------------------------------------------------
+-- IDENTIFIER MATCHERS (Consiliency/message-board#405, #417). ONE definition of
+-- "does this body reference agent_board.<name>", used by every assertion that asks.
+--
+-- WHY THESE EXIST. The same lookup was hand-written at ~20 sites and drifted twice in
+-- opposite directions in consecutive review rounds: first too STRICT (an abutting-paren,
+-- schema-qualified, case-sensitive strpos missed `_claimgate_lock_board_policy (v)` and
+-- `"_claimgate_lock_board_policy"(v)`), then too TOLERANT (a `[^A-Za-z0-9_]` guard accepts `.`,
+-- so `other_schema."_claimgate_lock_board_policy"(v)` matched as though it named OUR helper, and
+-- blanket case-insensitivity folded `"AGENT_BOARD"` onto `agent_board` although PostgreSQL treats
+-- those as DISTINCT objects). The target is not "more tolerant" — it is EXACTLY as tolerant as
+-- PostgreSQL's identifier rules, which is a thing to encode once rather than to re-derive per site.
+--
+-- THE RULES ENCODED, verified against the server rather than recalled:
+--   * an UNQUOTED identifier folds to lower case, so any case spelling names the same object
+--     (`to_regclass('AGENT_BOARD.boards') is not distinct from to_regclass('agent_board.boards')`
+--     returns true);
+--   * a QUOTED identifier is case-SENSITIVE, so `"AGENT_BOARD".boards` is a different object
+--     (`to_regclass('"AGENT_BOARD".boards')` returns NULL);
+--   * a reference is ours only if it is UNQUALIFIED or qualified by exactly `agent_board` — any
+--     other qualifier names someone else's object.
+--
+-- CALLERS MUST USE `~` / regexp_instr WITHOUT THE 'i' FLAG. The case rules are inside these
+-- patterns; adding 'i' would fold the quoted alternative and reintroduce the second defect.
+-- Keywords that should stay case-insensitive get agent_board_test.ci_re() for the same reason.
+
+-- A SPACE IN p_text BECOMES `\s+`, because every space this is ever given separates the words of a
+-- multiword SQL keyword (`insert into`, `no key`, `key share`) and PostgreSQL accepts any whitespace
+-- run there. stmt_re used to do that rewrite on ci_re's OUTPUT — a caller textually transforming a
+-- shared matcher, which is the same shape as CPR-6 stripping a director, and fragile in the same
+-- way: it depended on ci_re never emitting a space for some other reason. The rule belongs in the
+-- matcher, so no call site edits what a matcher returns.
+create or replace function agent_board_test.ci_re(p_text text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select coalesce(string_agg(case when c ~ '[A-Za-z]' then '[' || upper(c) || lower(c) || ']'
+                                  when c = ' '        then '\s+'
+                                  else c end, ''), '')
+    from regexp_split_to_table(p_text, '') as c
+$$;
+
+create or replace function agent_board_test.ident_re(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  -- p_name is the object's real (lower-case) name: unquoted-any-case, or quoted-exactly.
+  select '(?:' || agent_board_test.ci_re(p_name) || '|"' || p_name || '")'
+$$;
+
+-- IDENT_CHARS is PostgreSQL's unquoted-identifier continuation set, and `$` IS IN IT: `$` is legal
+-- after the first character, so `x$boards` is a DISTINCT identifier whose suffix would otherwise
+-- satisfy a `boards` matcher, and `x$_claimgate_lock_board_policy(…)` a distinct FUNCTION whose
+-- suffix would be credited as the protected helper. Omitting `$` was a real over-tolerance, found
+-- by review and reproduced before fixing.
+create or replace function agent_board_test.ident_chars() returns text
+language sql immutable set search_path to pg_catalog as $$ select 'A-Za-z0-9_$' $$;
+
+-- THE BOUNDARY GUARDS. Three rejections, each a defect that shipped:
+--   * an ASCII identifier character or a quote immediately before/after — `dashboards`, `x$boards`;
+--   * a NON-ASCII letter, which PostgreSQL also admits in an unquoted identifier, so
+--     `é_claimgate_lock_board_policy` and `claim_policyé` are DISTINCT objects whose prefix/suffix
+--     would otherwise match. The `[A-Za-z0-9_$]` class alone cannot express this;
+--   * a DOT WITH ANY WHITESPACE before the name. `other . _claimgate_lock_board_policy()` is a
+--     different schema's call, and the single-character class let it through because the character
+--     immediately before the name was a SPACE — the round-9 schema-blindness defect reopened through
+--     whitespace. PostgreSQL accepts variable-length lookbehind, verified, so `(?<!\.\s*)` states
+--     it directly rather than approximating with a fixed number of spaces.
+create or replace function agent_board_test.lead_guard() returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?<![' || agent_board_test.ident_chars() || '."])(?<![^\x00-\x7F])(?<!\.\s*)'
+$$;
+
+create or replace function agent_board_test.trail_guard() returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?![' || agent_board_test.ident_chars() || '])(?![^\x00-\x7F])'
+$$;
+
+-- The un-prefixed fragments. Public matchers add the (?c) director exactly once; these exist so a
+-- matcher can embed another without producing a mid-pattern director, which PostgreSQL rejects.
+create or replace function agent_board_test.qname_frag(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.lead_guard() || '(?:' || agent_board_test.ident_re('agent_board')
+      || '\s*\.\s*)?' || agent_board_test.ident_re(p_name) || agent_board_test.trail_guard()
+$$;
+
+create or replace function agent_board_test.call_frag(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.lead_guard() || '(?:' || agent_board_test.ident_re('agent_board')
+      || '\s*\.\s*)?' || agent_board_test.ident_re(p_name) || '\s*\('
+$$;
+
+-- THE (?c) DIRECTOR IS THE ENFORCEMENT, not the comment above it. A caller that passes 'i' to
+-- regexp_instr/regexp_matches alongside one of these patterns would previously refold the quoted
+-- alternative and credit `"AGENT_BOARD"."claims"` as `agent_board.claims`. That discipline was
+-- DOCUMENTED and then violated in the same commit that documented it, at four call sites. `(?c)`
+-- forces case-sensitive matching from inside the pattern, so a stray 'i' is now overridden rather
+-- than obeyed — verified: regexp_instr(…, '(?c)"agent_board"', …, 'i') returns 0.
+-- And misuse fails LOUDLY: a director is only legal at the START of a regular expression, so a
+-- caller who prefixes anything gets `invalid regular expression` rather than a silent fold.
+--
+-- EXACTLY WHICH CALLERS THE DIRECTOR PROTECTS, stated narrowly because the first version of this
+-- paragraph claimed more: a pattern that BEGINS with qname_re/call_re/stmt_re is protected against a
+-- passed 'i' flag AND against the `~*` operator, because the director is inside the pattern. A
+-- caller that composes a *_frag directly is NOT protected — the frags carry no director by design,
+-- since one mid-pattern is a syntax error. They exist for embedding inside the _re matchers, and
+-- EXECUTE on them is revoked below so they are not casually reachable; a test author who calls a
+-- frag with `~*` deliberately is outside what any mechanism here can prevent, and that residue is
+-- named rather than papered over.
+create or replace function agent_board_test.qname_re(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.qname_frag(p_name)
+$$;
+
+create or replace function agent_board_test.call_re(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.call_frag(p_name)
+$$;
+
+-- A COLUMN token. Unquoted identifiers fold, so `SET CLAIM_POLICY = …` names the same column as
+-- `claim_policy` — the case discipline reached the qualifier and the keywords but not the column,
+-- so an upper-case column token was silently omitted from CPR-6 and CPR-12.
+create or replace function agent_board_test.col_frag(p_name text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.lead_guard() || agent_board_test.ident_re(p_name) || agent_board_test.trail_guard()
+$$;
+
+create or replace function agent_board_test.stmt_re(p_verbs text, p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  -- "a statement whose verb is one of p_verbs and whose target is agent_board.p_rel".
+  -- SPACES INSIDE A MULTIWORD VERB BECOME `\s+`: `INSERT\nINTO` and `DELETE  FROM` are the same
+  -- statement to PostgreSQL. The hand-rolled expressions this consolidated used `\s+` and got that
+  -- right; the first shared version made the space literal and LOST a property the scattered
+  -- versions had — a consolidation is only safe if it is at least the union of what it replaces.
+  select '(?c)(?:' || (select string_agg(agent_board_test.ci_re(v), '|')
+                         from regexp_split_to_table(p_verbs, '\|') as v)
+      || ')\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+      || agent_board_test.qname_frag(p_rel)
+$$;
+
+revoke all on function agent_board_test.qname_frag(text) from public;
+revoke all on function agent_board_test.call_frag(text) from public;
+revoke all on function agent_board_test.col_frag(text) from public;
+
+-- THE INSERT-WITHOUT-COLUMN-LIST RULE, AS A NAMED OBJECT. It began as an expression inlined in
+-- CPR-6, and CPR-0's rows for it RECONSTRUCTED that expression instead of calling it — so the rows
+-- tested a copy, the copy could not diverge from itself, and mutating the production arm left them
+-- green. That is precisely the defect CPR-0 exists to catch, committed in CPR-0's own newest rows.
+-- A behaviour-table row must exercise THE SAME code object the production path compiles; anything
+-- else certifies a parallel implementation.
+--
+-- `insert into <rel> …` with no column list writes EVERY column, so for a sole-writer claim it is a
+-- writer of every column including the one being tracked. Three things this has to get right:
+--   * `(?!\s*\()` not `\s*(?!\()` — BACKTRACKING defeats the latter, since `\s*` may match zero
+--     characters and the lookahead then passes on the whitespace itself;
+--   * an ALIAS may sit between the relation and the column list, and it may be QUOTED
+--     (`insert into boards as "b"(slug, …)`), so the alias alternative admits both spellings;
+--   * VALUES / SELECT / DEFAULT / OVERRIDING are KEYWORDS, not aliases — treating them as aliases
+--     would exclude the genuine no-column-list forms this rule exists for.
+-- SPLIT INTO frag + re, matching qname/call/col, because CPR-6 embeds this rule INSIDE a larger
+-- alternation and a director is only legal at position 0. It used to embed
+-- `replace(insert_all_columns_re(...), '(?c)', '')` — so CPR-0's rows compiled X while production
+-- compiled a TEXTUAL TRANSFORMATION of X. Behaviourally identical today (CPR-6 matches with `~`,
+-- which is case-sensitive anyway, so the director is belt-and-braces there), but the rows would have
+-- stayed green if the rule ever became director-dependent, or if a `(?c)` appeared anywhere but
+-- position 0 and the replace stripped it silently. Two strings are not one object. Now CPR-6 embeds
+-- the frag and CPR-0's rows exercise the frag: the same object, no transformation at any call site.
+create or replace function agent_board_test.insert_all_columns_frag(p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select agent_board_test.ci_re('insert') || '\s+' || agent_board_test.ci_re('into')
+      || '\s+(?:' || agent_board_test.ci_re('only') || '\s+)?'
+      || agent_board_test.qname_frag(p_rel)
+      || '(?!(?:\s+(?:' || agent_board_test.ci_re('as') || '\s+)?(?!'
+      -- ONLY VALUES AND SELECT. `default` and `overriding` were excluded here too and were DEAD
+      -- CODE: an exclusion only matters if the keyword can be followed by `\s*\(` and so be mistaken
+      -- for an alias, and DEFAULT is only ever followed by VALUES, OVERRIDING by SYSTEM/USER.
+      -- Verified by reverting each: the two live exclusions change a verdict, the two dead ones do
+      -- not. Removed rather than kept with rows that cannot gate them.
+      || agent_board_test.ci_re('values')     || '(?![A-Za-z0-9_$])|'
+      || agent_board_test.ci_re('select')     || '(?![A-Za-z0-9_$]))'
+      || '(?:"[^"]*"|[A-Za-z_][A-Za-z0-9_$]*))?\s*\()'
+$$;
+
+create or replace function agent_board_test.insert_all_columns_re(p_rel text) returns text
+language sql immutable set search_path to pg_catalog as $$
+  select '(?c)' || agent_board_test.insert_all_columns_frag(p_rel)
+$$;
+
+revoke all on function agent_board_test.insert_all_columns_frag(text) from public;

package/tests/isolation/expected/challenge_supersede_lock_order.out

@@ -0,0 +1,213 @@
+Parsed test spec with 3 sessions
+
+starting permutation: mint_begin mint_lock_challenge issue_begin issue_at_cap mint_lock_key issue_commit mint_commit check
+step mint_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step mint_lock_challenge: 
+  select count(*)::int as locked_challenges from (
+    select 1 from agent_board.agent_signing_key_challenges c
+     where c.id = 'f1c00000-0000-4000-8000-000000000001' for update) s;
+
+locked_challenges
+-----------------
+                1
+(1 row)
+
+step issue_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step issue_at_cap: 
+  select c.key_id, c.key_version
+    from agent_board.issue_signing_key_challenge(
+      'f1a00000-0000-4000-8000-000000000001', 'primary', interval '5 minutes') c;
+
+key_id |key_version
+-------+-----------
+primary|          1
+(1 row)
+
+step mint_lock_key: 
+  select count(*)::int as locked_keys from (
+    select 1 from agent_board.agent_signing_keys k
+     where k.id = 'f1b00000-0000-4000-8000-000000000001' for update) s;
+ <waiting ...>
+step issue_commit: COMMIT;
+step mint_lock_key: <... completed>
+locked_keys
+-----------
+          1
+(1 row)
+
+step mint_commit: COMMIT;
+step check: 
+  select
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000001') as oldest_state,
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000002') as second_oldest_state,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and metadata ? 'superseded_by') as evicted_rows,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and proof_state = 'pending' and consumed_at is null
+        and expires_at > now()) as pending_rows;
+
+oldest_state|second_oldest_state|evicted_rows|pending_rows
+------------+-------------------+------------+------------
+pending     |expired            |           1|          16
+(1 row)
+
+
+starting permutation: issue_begin issue_at_cap mint_begin mint_lock_challenge issue_commit mint_lock_key mint_commit check
+step issue_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step issue_at_cap: 
+  select c.key_id, c.key_version
+    from agent_board.issue_signing_key_challenge(
+      'f1a00000-0000-4000-8000-000000000001', 'primary', interval '5 minutes') c;
+
+key_id |key_version
+-------+-----------
+primary|          1
+(1 row)
+
+step mint_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step mint_lock_challenge: 
+  select count(*)::int as locked_challenges from (
+    select 1 from agent_board.agent_signing_key_challenges c
+     where c.id = 'f1c00000-0000-4000-8000-000000000001' for update) s;
+ <waiting ...>
+step issue_commit: COMMIT;
+step mint_lock_challenge: <... completed>
+locked_challenges
+-----------------
+                1
+(1 row)
+
+step mint_lock_key: 
+  select count(*)::int as locked_keys from (
+    select 1 from agent_board.agent_signing_keys k
+     where k.id = 'f1b00000-0000-4000-8000-000000000001' for update) s;
+
+locked_keys
+-----------
+          1
+(1 row)
+
+step mint_commit: COMMIT;
+step check: 
+  select
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000001') as oldest_state,
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000002') as second_oldest_state,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and metadata ? 'superseded_by') as evicted_rows,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and proof_state = 'pending' and consumed_at is null
+        and expires_at > now()) as pending_rows;
+
+oldest_state|second_oldest_state|evicted_rows|pending_rows
+------------+-------------------+------------+------------
+expired     |pending            |           1|          16
+(1 row)
+
+
+starting permutation: issue_begin issue_at_cap issue_commit mint_begin mint_lock_challenge mint_lock_key mint_commit check
+step issue_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step issue_at_cap: 
+  select c.key_id, c.key_version
+    from agent_board.issue_signing_key_challenge(
+      'f1a00000-0000-4000-8000-000000000001', 'primary', interval '5 minutes') c;
+
+key_id |key_version
+-------+-----------
+primary|          1
+(1 row)
+
+step issue_commit: COMMIT;
+step mint_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step mint_lock_challenge: 
+  select count(*)::int as locked_challenges from (
+    select 1 from agent_board.agent_signing_key_challenges c
+     where c.id = 'f1c00000-0000-4000-8000-000000000001' for update) s;
+
+locked_challenges
+-----------------
+                1
+(1 row)
+
+step mint_lock_key: 
+  select count(*)::int as locked_keys from (
+    select 1 from agent_board.agent_signing_keys k
+     where k.id = 'f1b00000-0000-4000-8000-000000000001' for update) s;
+
+locked_keys
+-----------
+          1
+(1 row)
+
+step mint_commit: COMMIT;
+step check: 
+  select
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000001') as oldest_state,
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000002') as second_oldest_state,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and metadata ? 'superseded_by') as evicted_rows,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and proof_state = 'pending' and consumed_at is null
+        and expires_at > now()) as pending_rows;
+
+oldest_state|second_oldest_state|evicted_rows|pending_rows
+------------+-------------------+------------+------------
+expired     |pending            |           1|          16
+(1 row)
+
+
+starting permutation: mint_begin mint_lock_all issue_begin issue_at_cap issue_commit mint_commit check
+step mint_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step mint_lock_all: 
+  select count(*)::int as locked_challenges from (
+    select 1 from agent_board.agent_signing_key_challenges c
+     where c.signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+       and c.proof_state = 'pending'
+       and c.consumed_at is null
+     order by c.id
+     for update) s;
+
+locked_challenges
+-----------------
+               16
+(1 row)
+
+step issue_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step issue_at_cap: 
+  select c.key_id, c.key_version
+    from agent_board.issue_signing_key_challenge(
+      'f1a00000-0000-4000-8000-000000000001', 'primary', interval '5 minutes') c;
+
+ERROR:  challenge_pending_cap: too many pending signing-key challenges for this key (max 16)
+step issue_commit: COMMIT;
+step mint_commit: COMMIT;
+step check: 
+  select
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000001') as oldest_state,
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000002') as second_oldest_state,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and metadata ? 'superseded_by') as evicted_rows,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and proof_state = 'pending' and consumed_at is null
+        and expires_at > now()) as pending_rows;
+
+oldest_state|second_oldest_state|evicted_rows|pending_rows
+------------+-------------------+------------+------------
+pending     |pending            |           0|          16
+(1 row)
+

package/tests/isolation/expected/claimpolicy_acquire_revert_race.out

@@ -0,0 +1,66 @@
+Parsed test spec with 3 sessions
+
+starting permutation: w_begin w_flip a_begin a_acq w_commit a_commit chk
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-acq-board'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1';
+step a_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-acq-key', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000010');
+ <waiting ...>
+step w_commit: COMMIT;
+step a_acq: <... completed>
+ERROR:  ownerless claim lease horizon exceeds cap (30 days)
+step a_commit: COMMIT;
+step chk: 
+  select count(*)::int as active_claims,
+         coalesce(bool_or(lease_expires_at > now() + interval '31 days'), false) as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000001'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null;
+
+active_claims|over_cap_lease
+-------------+--------------
+            0|f             
+(1 row)
+
+
+starting permutation: a_begin a_acq a_commit chk
+step a_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1';
+step a_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-acq-key', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000010');
+
+resource_key
+------------
+cpr-acq-key 
+(1 row)
+
+step a_commit: COMMIT;
+step chk: 
+  select count(*)::int as active_claims,
+         coalesce(bool_or(lease_expires_at > now() + interval '31 days'), false) as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000001'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null;
+
+active_claims|over_cap_lease
+-------------+--------------
+            1|t             
+(1 row)
+

package/tests/isolation/expected/claimpolicy_board_scope.out

@@ -0,0 +1,73 @@
+Parsed test spec with 4 sessions
+
+starting permutation: w_begin w_flip a1_begin a1_acq w_commit a1_commit chk
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-scope-b1'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step a1_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1';
+step a1_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-scope-key-b1', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000041');
+ <waiting ...>
+step w_commit: COMMIT;
+step a1_acq: <... completed>
+ERROR:  ownerless claim lease horizon exceeds cap (30 days)
+step a1_commit: COMMIT;
+step chk: 
+  select resource_key, (lease_expires_at > now() + interval '31 days') as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000003'
+     and status = 'active' and released_at is null
+   order by resource_key;
+
+resource_key|over_cap_lease
+------------+--------------
+(0 rows)
+
+
+starting permutation: w_begin w_flip a2_begin a2_acq w_commit a2_commit chk
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-scope-b1'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step a2_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1';
+step a2_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-scope-key-b2', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000042');
+
+resource_key    
+----------------
+cpr-scope-key-b2
+(1 row)
+
+step w_commit: COMMIT;
+step a2_commit: COMMIT;
+step chk: 
+  select resource_key, (lease_expires_at > now() + interval '31 days') as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000003'
+     and status = 'active' and released_at is null
+   order by resource_key;
+
+resource_key    |over_cap_lease
+----------------+--------------
+cpr-scope-key-b2|t             
+(1 row)
+

package/tests/isolation/expected/claimpolicy_claimrow_lock_order.out

@@ -0,0 +1,80 @@
+Parsed test spec with 4 sessions
+
+starting permutation: rc_begin rc_reclaim w_begin w_flip rc_commit w_commit chk
+step rc_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rc_reclaim: 
+  select owner_agent_id
+    from agent_board.reclaim_fleet_machine(
+      '40500000-0000-4000-8000-0000000000c0', '40500000-0000-4000-8000-00000000000b',
+      '40500000-0000-4000-8000-00000000000a', 'message-board#405 lock-order probe');
+
+owner_agent_id                      
+------------------------------------
+40500000-0000-4000-8000-00000000000b
+(1 row)
+
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000f9';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-inv-board'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step rc_commit: COMMIT;
+step w_commit: COMMIT;
+step chk: 
+  select (select claim_policy from agent_board.boards where slug = 'cpr-inv-board') as policy,
+         (select owner_agent_id from agent_board.fleet_machines
+           where id = '40500000-0000-4000-8000-0000000000c0') as machine_owner;
+
+policy |machine_owner                       
+-------+------------------------------------
+inherit|40500000-0000-4000-8000-00000000000b
+(1 row)
+
+
+starting permutation: x_begin x_rowlock w_begin w_flip x_renew w_commit x_commit chk
+step x_begin: BEGIN;
+step x_rowlock: select resource_key from agent_board.claims where id = '40500000-0000-4000-8000-000000000091' for update;
+resource_key
+------------
+cpr-inv-key 
+(1 row)
+
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000f9';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-inv-board'), 'inherit');
+ <waiting ...>
+step x_renew: 
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000f9';
+  select resource_key
+    from agent_board.renew_claim('40500000-0000-4000-8000-0000000000f8', now() + interval '400 days');
+ <waiting ...>
+step w_flip: <... completed>
+ERROR:  deadlock detected
+step x_renew: <... completed>
+resource_key
+------------
+cpr-inv-key 
+(1 row)
+
+step w_commit: COMMIT;
+step x_commit: COMMIT;
+step chk: 
+  select (select claim_policy from agent_board.boards where slug = 'cpr-inv-board') as policy,
+         (select owner_agent_id from agent_board.fleet_machines
+           where id = '40500000-0000-4000-8000-0000000000c0') as machine_owner;
+
+policy  |                       machine_owner
+--------+------------------------------------
+advisory|40500000-0000-4000-8000-000000000009
+(1 row)
+