@consiliency/agent-board-schema 1.48.0 → 1.51.0

package/tests/isolation/expected/claimpolicy_isolation_refusal.out

@@ -0,0 +1,114 @@
+Parsed test spec with 5 sessions
+
+starting permutation: rr_begin rr_acq rr_rollback chk
+step rr_begin: BEGIN ISOLATION LEVEL REPEATABLE READ; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step rr_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-iso-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000050');
+
+ERROR:  claim policy enforcement requires transaction isolation level read committed (got repeatable read)
+step rr_rollback: ROLLBACK;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims
+------
+<none>
+(1 row)
+
+
+starting permutation: rc_begin rc_acq rc_commit chk
+step rc_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step rc_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-iso-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000050');
+
+resource_key
+------------
+cpr-iso-key 
+(1 row)
+
+step rc_commit: COMMIT;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims     
+-----------
+cpr-iso-key
+(1 row)
+
+
+starting permutation: rr_begin rr_machine rr_rollback chk
+step rr_begin: BEGIN ISOLATION LEVEL REPEATABLE READ; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step rr_machine: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'machine', 'cpr-iso-machine', now() + interval '1 hour',
+                                  null, null);
+
+resource_key   
+---------------
+cpr-iso-machine
+(1 row)
+
+step rr_rollback: ROLLBACK;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims
+------
+<none>
+(1 row)
+
+
+starting permutation: sz_begin sz_acq sz_rollback chk
+step sz_begin: BEGIN ISOLATION LEVEL SERIALIZABLE; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step sz_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-iso-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000050');
+
+ERROR:  claim policy enforcement requires transaction isolation level read committed (got serializable)
+step sz_rollback: ROLLBACK;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims
+------
+<none>
+(1 row)
+
+
+starting permutation: ru_begin ru_acq ru_rollback chk
+step ru_begin: BEGIN ISOLATION LEVEL READ UNCOMMITTED; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000d1';
+step ru_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-iso-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000050');
+
+ERROR:  claim policy enforcement requires transaction isolation level read committed (got read uncommitted)
+step ru_rollback: ROLLBACK;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000004'
+     and status = 'active' and released_at is null;
+
+claims
+------
+<none>
+(1 row)
+

package/tests/isolation/expected/claimpolicy_renew_revert_race.out

@@ -0,0 +1,66 @@
+Parsed test spec with 3 sessions
+
+starting permutation: w_begin w_flip w_mark r_begin r_renew w_commit r_commit chk
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000b1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-ren-board'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step w_mark: 
+  insert into public.cpr_renew_mark(lease)
+  select lease_expires_at from agent_board.claims where id = '40500000-0000-4000-8000-000000000030';
+
+step r_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000b1';
+step r_renew: 
+  select resource_key
+    from agent_board.renew_claim('40500000-0000-4000-8000-0000000000f1', now() + interval '400 days');
+ <waiting ...>
+step w_commit: COMMIT;
+step r_renew: <... completed>
+resource_key
+------------
+cpr-ren-key 
+(1 row)
+
+step r_commit: COMMIT;
+step chk: 
+  select (c.lease_expires_at > now() + interval '31 days') as over_cap_lease,
+         (c.lease_expires_at = (select m.lease from public.cpr_renew_mark m)) as lease_kept_by_revert
+    from agent_board.claims c
+   where c.id = '40500000-0000-4000-8000-000000000030';
+
+over_cap_lease|lease_kept_by_revert
+--------------+--------------------
+f             |t                   
+(1 row)
+
+
+starting permutation: r_begin r_renew r_commit chk
+step r_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000b1';
+step r_renew: 
+  select resource_key
+    from agent_board.renew_claim('40500000-0000-4000-8000-0000000000f1', now() + interval '400 days');
+
+resource_key
+------------
+cpr-ren-key 
+(1 row)
+
+step r_commit: COMMIT;
+step chk: 
+  select (c.lease_expires_at > now() + interval '31 days') as over_cap_lease,
+         (c.lease_expires_at = (select m.lease from public.cpr_renew_mark m)) as lease_kept_by_revert
+    from agent_board.claims c
+   where c.id = '40500000-0000-4000-8000-000000000030';
+
+over_cap_lease|lease_kept_by_revert
+--------------+--------------------
+t             |                    
+(1 row)
+

package/tests/isolation/expected/claimpolicy_writer_keyshare.out

@@ -0,0 +1,49 @@
+Parsed test spec with 3 sessions
+
+starting permutation: t_begin t_keyshare w_begin w_flip t_acq w_commit t_commit chk
+step t_begin: BEGIN;
+step t_keyshare: select slug from agent_board.boards where slug = 'cpr-ks-board' for key share;
+slug        
+------------
+cpr-ks-board
+(1 row)
+
+step w_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000e1';
+step w_flip: 
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-ks-board'), 'inherit');
+
+claim_policy
+------------
+inherit     
+(1 row)
+
+step t_acq: 
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000e1';
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-ks-key', now() + interval '1 hour',
+                                  null, '40500000-0000-4000-8000-000000000060');
+ <waiting ...>
+step w_commit: COMMIT;
+step t_acq: <... completed>
+resource_key
+------------
+cpr-ks-key  
+(1 row)
+
+step t_commit: COMMIT;
+step chk: 
+  select coalesce(string_agg(resource_key, ',' order by resource_key), '<none>') as claims,
+         (select claim_policy from agent_board.boards where slug = 'cpr-ks-board') as policy
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000005'
+     and status = 'active' and released_at is null;
+
+claims    |policy 
+----------+-------
+cpr-ks-key|inherit
+(1 row)
+

package/tests/isolation/specs/challenge_supersede_lock_order.spec

@@ -0,0 +1,183 @@
+# F1 (code-review-2026-09-01) — issue_signing_key_challenge must be ACYCLIC against
+# mint_fleet_agent_session once it supersedes at the pending-challenge cap.
+#
+# THE CYCLE THIS CHANGE WOULD HAVE INTRODUCED. Superseding at the cap makes
+# issue_signing_key_challenge WRITE a challenge row while it already holds the key row:
+#     agent_signing_keys(FOR UPDATE, 20260719000100 / this migration)
+#       -> agent_signing_key_challenges(UPDATE, the eviction)
+# mint_fleet_agent_session takes exactly that pair in the OPPOSITE order:
+#     agent_signing_key_challenges(FOR UPDATE, 20260718000600:73-76)
+#       -> agent_signing_keys(FOR UPDATE, 20260718000600:95-100)
+# That is an ABBA between two honest callers, and not a rare one: the traffic this change
+# is FOR — a flood driving evictions while legitimate agents mint — is precisely the
+# traffic that produces it. agent_board_fk_lock_edges.test.sql FKL-10 named the pair the
+# first time this migration was written without the fix; that assertion is a static
+# detector and cannot see the fix, which is why the proof lives here.
+#
+# THE FIX this spec pins: the eviction's row selection carries FOR UPDATE SKIP LOCKED, so
+# the issuing transaction NEVER WAITS on a challenge row. A row a mint already holds is
+# passed over for the next-oldest. A transaction that cannot wait cannot close a cycle.
+#
+# WHAT THE GOLDEN SHOWS, AND WHAT WOULD CHANGE IF THE CLAUSE WERE REMOVED. In permutation
+# 1 `mint_lock_challenge` takes the OLDEST pending row; `issue` then runs at the cap and
+# COMPLETES WITHOUT A `<waiting ...>` LINE, evicting the SECOND-oldest instead. Delete
+# `skip locked` and that step blocks — the trace gains `<waiting ...>`, and once
+# `mint_lock_key` runs the two transactions are in a cycle and the server reports
+# `ERROR: deadlock detected`. Either outcome is a byte diff against this golden.
+#
+# THE "mint" SESSION IS A LOCK-EQUIVALENT STAND-IN, and here is the equivalence.
+#   * It runs mint_fleet_agent_session's two cycle-relevant acquisitions, in its order and
+#     its modes: the challenge row FOR UPDATE (:73-76), then the key row FOR UPDATE
+#     (:95-100).
+#   * It omits that function's other work — _agent_principal_active's reads, the
+#     delegation_grants lookup, the auth_user_id read, the challenge consume UPDATE and the
+#     nonfleet_sessions insert. None of those touches agent_signing_keys, and the consume
+#     UPDATE re-writes a row this session already holds, so none can add an edge to the
+#     pair under test.
+#   * A real mint call was rejected only because it needs a valid PoP challenge, an
+#     auth_user_id-bearing principal and a live lineage inside a setup block, and because
+#     every one of its rejection paths RAISES, which would abort the session mid-permutation
+#     and turn a lock-order question into an error-message question. The claim under test is
+#     a LOCK ORDER, and these are the locks.
+#
+# THE ISSUE SESSION IS THE REAL FUNCTION, unmodified. That side is where the fix lives, so
+# a stand-in there would be testing the spec instead of the schema.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('f1a00000-0000-4000-8000-000000000001','agent','agent','f1iso-owner','F1 ISO Owner','active');
+
+  insert into agent_board.agent_signing_keys(
+    id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values ('f1b00000-0000-4000-8000-000000000001','f1a00000-0000-4000-8000-000000000001',
+          'primary', 1, public.test_pubkey('f1-iso'), 'raw_ed25519_base64url',
+          public.test_key_fingerprint('f1-iso'), 'active', 'proven');
+
+  -- Exactly sixteen pending challenges: the key is AT the cap, so the next issue must
+  -- evict. created_at is set explicitly so "oldest" and "second-oldest" are unambiguous
+  -- rather than depending on insert clock resolution.
+  insert into agent_board.agent_signing_key_challenges(
+    id, signing_key_id, agent_id, challenge_nonce, challenge_bytes, expires_at, created_at)
+  select
+    ('f1c00000-0000-4000-8000-0000000000' || lpad(i::text, 2, '0'))::uuid,
+    'f1b00000-0000-4000-8000-000000000001',
+    'f1a00000-0000-4000-8000-000000000001',
+    'f1-iso-nonce-' || i,
+    'agent-signing-key-proof.v1:f1-iso:' || i,
+    now() + interval '5 minutes',
+    now() - make_interval(secs => (17 - i))
+  from generate_series(1, 16) i;
+}
+
+teardown
+{
+  delete from agent_board.agent_signing_key_challenges
+   where agent_id = 'f1a00000-0000-4000-8000-000000000001';
+  delete from agent_board.agent_signing_keys
+   where agent_id = 'f1a00000-0000-4000-8000-000000000001';
+  delete from agent_board.agents where handle like 'f1iso-%';
+}
+
+# mint_fleet_agent_session's two cycle-relevant locks, in its order and modes.
+session "mint"
+step "mint_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+# The OLDEST pending row — the one the eviction would otherwise take.
+step "mint_lock_challenge" {
+  select count(*)::int as locked_challenges from (
+    select 1 from agent_board.agent_signing_key_challenges c
+     where c.id = 'f1c00000-0000-4000-8000-000000000001' for update) s;
+}
+# ALL sixteen pending rows at once. This is the adversary for the no-evictable-row branch:
+# SKIP LOCKED can only skip, so with every candidate held the eviction finds nothing.
+step "mint_lock_all" {
+  select count(*)::int as locked_challenges from (
+    select 1 from agent_board.agent_signing_key_challenges c
+     where c.signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+       and c.proof_state = 'pending'
+       and c.consumed_at is null
+     order by c.id
+     for update) s;
+}
+step "mint_lock_key" {
+  select count(*)::int as locked_keys from (
+    select 1 from agent_board.agent_signing_keys k
+     where k.id = 'f1b00000-0000-4000-8000-000000000001' for update) s;
+}
+step "mint_commit" { COMMIT; }
+
+# The real issuer, unmodified, at the cap. Only the deterministic columns are selected:
+# challenge_id and the nonce inside `challenge` are fresh random values per run and must
+# never reach a golden.
+session "issue"
+step "issue_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "issue_at_cap" {
+  select c.key_id, c.key_version
+    from agent_board.issue_signing_key_challenge(
+      'f1a00000-0000-4000-8000-000000000001', 'primary', interval '5 minutes') c;
+}
+step "issue_commit" { COMMIT; }
+
+session "check"
+# WHICH row was evicted is the observable that distinguishes skipping from waiting: with
+# SKIP LOCKED the mint-held oldest row is untouched and the SECOND-oldest carries the
+# marker. The pending count proves the bound still holds.
+step "check" {
+  select
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000001') as oldest_state,
+    (select proof_state from agent_board.agent_signing_key_challenges
+      where id = 'f1c00000-0000-4000-8000-000000000002') as second_oldest_state,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and metadata ? 'superseded_by') as evicted_rows,
+    (select count(*)::int from agent_board.agent_signing_key_challenges
+      where signing_key_id = 'f1b00000-0000-4000-8000-000000000001'
+        and proof_state = 'pending' and consumed_at is null
+        and expires_at > now()) as pending_rows;
+}
+
+# 1. THE CYCLE, in the order that would produce the deadlock. mint holds the oldest
+#    challenge row; issue then runs at the cap. It must NOT wait (no `<waiting ...>`), and
+#    mint's key lock must then be the only thing that blocks.
+permutation "mint_begin" "mint_lock_challenge" "issue_begin" "issue_at_cap" "mint_lock_key" "issue_commit" "mint_commit" "check"
+
+# 2. The reverse arrival order: issue arrives FIRST, evicts the true oldest, and mint then
+#    blocks on that row and proceeds once issue commits. This is the direction in which the
+#    eviction DOES cost a mint a wait, and it pins that the cost is a wait-then-proceed and
+#    not a deadlock.
+#
+#    `issue_commit` MUST precede `mint_lock_key`. The first version of this permutation put
+#    the commit last, which does not test the schema at all: mint blocks on the challenge
+#    row, isolationtester will not run a blocked session's next step, and nothing in the
+#    permutation can release the lock — so the tester sat out its own 300-second cancel and
+#    baked `canceling step mint_lock_challenge after 300 seconds` into the golden. That is a
+#    property of the spec's step order, not of the lock order, and it made every iteration
+#    cost five minutes.
+permutation "issue_begin" "issue_at_cap" "mint_begin" "mint_lock_challenge" "issue_commit" "mint_lock_key" "mint_commit" "check"
+
+# 3. Fully serial: issue commits before mint starts. The baseline the two concurrent
+#    permutations are read against.
+permutation "issue_begin" "issue_at_cap" "issue_commit" "mint_begin" "mint_lock_challenge" "mint_lock_key" "mint_commit" "check"
+
+# 4. EVERY candidate locked -- the branch that exists only because SKIP LOCKED can skip.
+#
+#    With all sixteen pending rows held by another session the eviction's
+#    `for update skip locked limit 1` returns NO ROW, so `v_evicted` is null. The function
+#    must then REFUSE (challenge_pending_cap) rather than issue: inserting a seventeenth
+#    would push the pending set past the bound the cap exists to hold, and the count that
+#    said the set was full was correct. This is the ONE path where the pre-change refusal
+#    survives, and the PR describes it as "confined to a window in which sixteen mints for
+#    one key are in flight at once" -- a claim that was visible in the SQL and asserted
+#    nowhere until this permutation.
+#
+#    Three things the golden shows, and all three matter:
+#      * issue_at_cap ERRORS. It does not wait -- SKIP LOCKED means no `<waiting ...>`.
+#      * `evicted_rows = 0`. Nothing was superseded, so no legitimate challenge was
+#        destroyed on the way to refusing.
+#      * `pending_rows = 16`. No seventeenth row was inserted.
+#
+#    MUTATION: delete the `if v_evicted is null then raise` guard and this permutation's
+#    golden changes -- the refusal disappears and pending_rows becomes 17, which is the
+#    bound being exceeded, i.e. exactly the failure the guard is there to prevent.
+permutation "mint_begin" "mint_lock_all" "issue_begin" "issue_at_cap" "issue_commit" "mint_commit" "check"

package/tests/isolation/specs/claimpolicy_acquire_revert_race.spec

@@ -0,0 +1,118 @@
+# Consiliency/message-board#405 — an acquire whose snapshot predates a committed
+# advisory -> inherit revert must NOT bank a full-horizon ownerless lease.
+#
+# WHY ACQUIRE IS THE WORSE HALF OF THIS FAMILY. #406's cap reset clamps the
+# board's EXISTING ownerless claims on a revert. On this path there is no claim
+# yet: the acquire inserts AFTER the revert committed, so there is nothing for
+# the reset to reach even in principle. Whatever horizon a stale 'advisory' read
+# lets through is banked outright.
+#
+# AND IT IS THE PATH THE FIRST DESIGN MISSED. That design said the board lock
+# goes "before the agent-scoped lock". acquire_claim's agent-scoped quota lock
+# lives INSIDE the branch that a stale 'advisory' read SKIPS ENTIRELY, so on the
+# dangerous path it is never reached and ordering against it means nothing. This
+# spec drives exactly that branch: the acquirer reads 'advisory' unless it is
+# made to wait, and if it reads 'advisory' it takes no lock at all.
+#
+# THE INTERLEAVE. w (the board owner) opens a transaction and reverts the board
+# to 'inherit', holding the board-scoped advisory lock until commit. a then asks
+# for a 400-day 'file' lease. Under READ COMMITTED a's snapshot at that moment
+# still shows 'advisory'.
+#
+# WHAT THE FIX PRODUCES (this golden): a's acquire prints `<waiting ...>` on w's
+# lock; after w commits, a RE-READS the policy in a fresh statement, sees
+# 'inherit', and the ownerless TTL cap rejects the 400-day horizon with
+# `ERROR: ownerless claim lease horizon exceeds cap`. The checker sees ZERO
+# claims.
+#
+# MUTATION SIGNAL (verified in the PR): delete the `perform
+# agent_board._claimgate_lock_board_policy(v_board_id)` line from acquire_claim
+# -> a never waits, resolves the stale 'advisory', skips the whole ownerless
+# block and INSERTS. The golden diverges on the missing `<waiting ...>`, on the
+# missing error, and on the checker (1 claim, over-cap lease = t).
+#
+# THE TWIN IS NOT OPTIONAL. A guard that simply over-serialises — or one that
+# resolved every board to 'inherit' — would pass the race permutation and break
+# the feature. The second permutation runs the SAME acquire with no writer at
+# all: the board is still 'advisory', so the 400-day lease must be GRANTED, with
+# no wait anywhere in the trace.
+#
+# Sessions run as `authenticated` (service_role is exempt from these guards
+# entirely, so a service_role probe would prove nothing).
+
+setup
+{
+  insert into agent_board.claimgate_enforcement_flags(scope_key, enabled) values ('ownerless_guards', true)
+    on conflict (scope_key) do update set enabled = true;
+  insert into auth.users (id) values ('40500000-0000-4000-8000-0000000000a1');
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('40500000-0000-4000-8000-000000000001', 'agent', 'agent',
+          'cpr-acq-owner', 'CPR Acquire Owner', 'active',
+          '40500000-0000-4000-8000-0000000000a1', '40500000-0000-4000-8000-0000000000a1');
+  select count(*) from agent_board.create_board(
+    '40500000-0000-4000-8000-000000000001',
+    'cpr-acq-board', 'CPR Acquire Board',
+    'message-board#405 acquire stale-policy probe', jsonb_build_object(), 'private');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values ('40500000-0000-4000-8000-000000000010', 'coordination',
+          '40500000-0000-4000-8000-000000000001', 'CPR acquire thread',
+          (select id from agent_board.boards where slug = 'cpr-acq-board'));
+  -- The board starts OPTED OUT. Written directly rather than through the RPC so the setup does not
+  -- depend on the very gate this spec exercises; the RPC's own transitions are BCP's job.
+  update agent_board.boards set claim_policy = 'advisory' where slug = 'cpr-acq-board';
+}
+
+teardown
+{
+  delete from agent_board.claims where agent_id = '40500000-0000-4000-8000-000000000001';
+  delete from agent_board.threads where id = '40500000-0000-4000-8000-000000000010';
+  delete from agent_board.board_membership_events where board_id in (
+    select id from agent_board.boards where slug = 'cpr-acq-board');
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug = 'cpr-acq-board');
+  delete from agent_board.boards where slug = 'cpr-acq-board';
+  delete from agent_board.agents where id = '40500000-0000-4000-8000-000000000001';
+  delete from auth.users where id = '40500000-0000-4000-8000-0000000000a1';
+  delete from agent_board.claimgate_enforcement_flags where scope_key = 'ownerless_guards';
+}
+
+# w: the board owner reverting the opt-out. Holds the board policy lock until commit.
+session "w"
+step "w_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1'; }
+step "w_flip"   {
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-acq-board'), 'inherit');
+}
+step "w_commit" { COMMIT; }
+
+# a: the in-flight acquire. 400 days is far past the 30-day ownerless TTL cap, so the horizon it
+# gets is a direct readout of which policy it resolved.
+session "a"
+step "a_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000a1'; }
+step "a_acq"    {
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-acq-key', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000010');
+}
+step "a_commit" { COMMIT; }
+
+# checker: a count and a boolean, never a timestamp — a golden with a clock in it is not a golden.
+session "chk"
+step "chk" {
+  select count(*)::int as active_claims,
+         coalesce(bool_or(lease_expires_at > now() + interval '31 days'), false) as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000001'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null;
+}
+
+# THE RACE: the acquire is issued while the revert is uncommitted.
+permutation "w_begin" "w_flip" "a_begin" "a_acq" "w_commit" "a_commit" "chk"
+
+# THE TWIN: no revert at all. The board is advisory, so the opt-out must still WORK — the 400-day
+# lease is granted and nothing waits. A guard that over-serialises, or one that resolved every
+# board to 'inherit', fails here and passes the permutation above.
+permutation "a_begin" "a_acq" "a_commit" "chk"

package/tests/isolation/specs/claimpolicy_board_scope.spec

@@ -0,0 +1,115 @@
+# Consiliency/message-board#405 — the policy lock is BOARD-SCOPED. Two boards
+# must not serialise against each other.
+#
+# WHY THIS IS ITS OWN SPEC. Every other spec in this family passes just as well
+# with a GLOBAL lock key, and a global key would be a fleet-wide serialisation
+# point on the hottest write path in the schema — every ownerless acquire and
+# every renew queued behind every other board's policy flip. "It waits when it
+# should" and "it does not wait when it should not" are different claims, and
+# only the second one fails on a constant key.
+#
+# BOTH DIRECTIONS IN ONE FILE, so the probe is discriminating rather than merely
+# green:
+#
+#   permutation 1 (SAME board)      — the acquirer must WAIT on the flip.
+#   permutation 2 (DIFFERENT board) — the acquirer must NOT wait, and its board
+#                                     is still 'advisory', so its 400-day lease
+#                                     is granted.
+#
+# MUTATION SIGNAL (measured, not predicted): replace the board id in
+# `_claimgate_lock_board_policy`'s key with a constant -> permutation 2 gains a
+# `<waiting ...>` line and the golden diverges. Permutation 1 is UNCHANGED by that
+# mutation, which is exactly why it cannot stand alone.
+#
+# w COMMITS BEFORE a2 in permutation 2, and that ordering is about the mutant rather
+# than the fix: with a constant key and a2 committing first, nothing ever releases the
+# lock a2 is queued on and isolationtester spends its full 300-second cancel timeout
+# before producing the diff. Committing w first leaves the independence claim intact --
+# a2 still runs its whole acquire while w's flip is uncommitted -- and makes the mutant
+# fail in a second.
+
+setup
+{
+  insert into agent_board.claimgate_enforcement_flags(scope_key, enabled) values ('ownerless_guards', true)
+    on conflict (scope_key) do update set enabled = true;
+  insert into auth.users (id) values ('40500000-0000-4000-8000-0000000000c1');
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('40500000-0000-4000-8000-000000000003', 'agent', 'agent',
+          'cpr-scope-owner', 'CPR Scope Owner', 'active',
+          '40500000-0000-4000-8000-0000000000c1', '40500000-0000-4000-8000-0000000000c1');
+  select count(*) from agent_board.create_board(
+    '40500000-0000-4000-8000-000000000003', 'cpr-scope-b1', 'CPR Scope B1',
+    'message-board#405 board-scope probe (flipped board)', jsonb_build_object(), 'private');
+  select count(*) from agent_board.create_board(
+    '40500000-0000-4000-8000-000000000003', 'cpr-scope-b2', 'CPR Scope B2',
+    'message-board#405 board-scope probe (untouched board)', jsonb_build_object(), 'private');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id)
+  values ('40500000-0000-4000-8000-000000000041', 'coordination',
+          '40500000-0000-4000-8000-000000000003', 'CPR scope thread b1',
+          (select id from agent_board.boards where slug = 'cpr-scope-b1')),
+         ('40500000-0000-4000-8000-000000000042', 'coordination',
+          '40500000-0000-4000-8000-000000000003', 'CPR scope thread b2',
+          (select id from agent_board.boards where slug = 'cpr-scope-b2'));
+  update agent_board.boards set claim_policy = 'advisory' where slug in ('cpr-scope-b1', 'cpr-scope-b2');
+}
+
+teardown
+{
+  delete from agent_board.claims where agent_id = '40500000-0000-4000-8000-000000000003';
+  delete from agent_board.threads where id in ('40500000-0000-4000-8000-000000000041',
+                                               '40500000-0000-4000-8000-000000000042');
+  delete from agent_board.board_membership_events where board_id in (
+    select id from agent_board.boards where slug in ('cpr-scope-b1', 'cpr-scope-b2'));
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug in ('cpr-scope-b1', 'cpr-scope-b2'));
+  delete from agent_board.boards where slug in ('cpr-scope-b1', 'cpr-scope-b2');
+  delete from agent_board.agents where id = '40500000-0000-4000-8000-000000000003';
+  delete from auth.users where id = '40500000-0000-4000-8000-0000000000c1';
+  delete from agent_board.claimgate_enforcement_flags where scope_key = 'ownerless_guards';
+}
+
+# w reverts board 1, and holds its policy lock until commit.
+session "w"
+step "w_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1'; }
+step "w_flip"   {
+  select claim_policy
+    from agent_board.set_board_claim_policy(
+           (select id from agent_board.boards where slug = 'cpr-scope-b1'), 'inherit');
+}
+step "w_commit" { COMMIT; }
+
+# a1 acquires on the FLIPPED board: it must wait, then be refused by the TTL cap.
+session "a1"
+step "a1_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1'; }
+step "a1_acq"    {
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-scope-key-b1', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000041');
+}
+step "a1_commit" { COMMIT; }
+
+# a2 acquires on the OTHER board: it must not wait at all, and its opt-out still stands.
+session "a2"
+step "a2_begin"  { BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '40500000-0000-4000-8000-0000000000c1'; }
+step "a2_acq"    {
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cpr-scope-key-b2', now() + interval '400 days',
+                                  null, '40500000-0000-4000-8000-000000000042');
+}
+step "a2_commit" { COMMIT; }
+
+session "chk"
+step "chk" {
+  select resource_key, (lease_expires_at > now() + interval '31 days') as over_cap_lease
+    from agent_board.claims
+   where agent_id = '40500000-0000-4000-8000-000000000003'
+     and status = 'active' and released_at is null
+   order by resource_key;
+}
+
+# SAME BOARD: waits, then the revert's 'inherit' refuses the 400-day horizon.
+permutation "w_begin" "w_flip" "a1_begin" "a1_acq" "w_commit" "a1_commit" "chk"
+
+# DIFFERENT BOARD: no wait anywhere, and board 2's opt-out grants the 400-day lease while board 1's
+# flip is still in flight. A constant lock key turns this into a wait and fails the golden.
+permutation "w_begin" "w_flip" "a2_begin" "a2_acq" "w_commit" "a2_commit" "chk"