@consiliency/agent-board-schema 1.5.0 → 1.7.0

package/tests/agent_board_roomdeleg.test.sql

@@ -0,0 +1,167 @@
+-- ROOMDELEG Lane A pgTAP: owner-gated set_board_role_gate + R-DELEG-1 creator-identity
+-- gate-bypass fix on invite_board_member / resolve_board_request.
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- (''/service_role => true, 'authenticated' => false) and request.jwt.claim.sub picks
+-- the acting agent. Fixture style mirrors agent_board_roomown.test.sql.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(11);
+
+create temp table _roomdeleg_fixture (
+  board uuid,
+  alice uuid,          -- creator, seeded owner
+  bob uuid,            -- role 'member'
+  target uuid,         -- invite target (existing agent, no membership needed)
+  requester uuid,      -- has a pending 'requested' membership (resolve target)
+  nomember uuid,       -- existing agent, no membership on the board
+  suspended uuid,      -- suspended agent WITH a valid auth user
+  alice_user uuid,
+  bob_user uuid,
+  suspended_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_alice_user uuid;
+  v_bob_user uuid;
+  v_suspended_user uuid;
+  v_alice uuid := gen_random_uuid();
+  v_bob uuid := gen_random_uuid();
+  v_target uuid := gen_random_uuid();
+  v_requester uuid := gen_random_uuid();
+  v_nomember uuid := gen_random_uuid();
+  v_suspended uuid := gen_random_uuid();
+  v_board uuid;
+  v_slug text := 'roomdeleg-board-' || v_suffix;
+begin
+  v_alice_user := public.ensure_github_user('rd-alice-' || v_suffix, 'rd-alice-' || v_suffix || '@example.test', 'rd-alice-' || v_suffix, 'RD Alice');
+  v_bob_user := public.ensure_github_user('rd-bob-' || v_suffix, 'rd-bob-' || v_suffix || '@example.test', 'rd-bob-' || v_suffix, 'RD Bob');
+  v_suspended_user := public.ensure_github_user('rd-susp-' || v_suffix, 'rd-susp-' || v_suffix || '@example.test', 'rd-susp-' || v_suffix, 'RD Suspended');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_alice, 'agent', 'rd-alice-' || v_suffix, 'RD Alice', 'active', v_alice_user, v_alice_user),
+    (v_bob, 'agent', 'rd-bob-' || v_suffix, 'RD Bob', 'active', v_bob_user, v_bob_user),
+    -- Suspended agent WITH a valid auth user: current_agent_id() filters status='active'
+    -- so it resolves to null while auth.uid() still maps.
+    (v_suspended, 'agent', 'rd-susp-' || v_suffix, 'RD Suspended', 'suspended', v_suspended_user, v_suspended_user),
+    (v_target, 'agent', 'rd-target-' || v_suffix, 'RD Target', 'active', null, null),
+    (v_requester, 'agent', 'rd-requester-' || v_suffix, 'RD Requester', 'active', null, null),
+    (v_nomember, 'agent', 'rd-nomember-' || v_suffix, 'RD NoMember', 'active', null, null);
+
+  -- Alice creates board (service_role null-actor here -> supplied arg honored):
+  -- create_board seeds Alice's joined owner membership (ROOMOWN).
+  select board_id into v_board
+    from agent_board.create_board(v_alice, v_slug, 'ROOMDELEG Board', 'roomdeleg test', '{}'::jsonb, 'private');
+
+  -- Bob is a genuine NON-creator member (role member). Requester has a pending
+  -- 'requested' membership so resolve_board_request reaches the gate check.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_bob, 'joined', v_alice, 'member'),
+    (v_board, v_requester, 'requested', v_alice, 'member');
+
+  insert into _roomdeleg_fixture values
+    (v_board, v_alice, v_bob, v_target, v_requester, v_nomember, v_suspended,
+     v_alice_user, v_bob_user, v_suspended_user);
+end
+$$;
+
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- === Part A: set_board_role_gate authz (gate starts false) ========================
+-- 1. non-owner member (Bob) cannot flip the gate -> 42501 (gate unchanged) ----------
+select set_config('request.jwt.claim.sub', (select bob_user from _roomdeleg_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.set_board_role_gate(%L::uuid, true)$q$, board) from _roomdeleg_fixture),
+  '42501', 'only a board owner may set the role gate',
+  'set_board_role_gate: a non-owner member is rejected');
+
+-- 2. non-member cannot flip the gate -> 42501 --------------------------------------
+select set_config('request.jwt.claim.sub', gen_random_uuid()::text, true);
+select throws_ok(
+  (select format($q$select agent_board.set_board_role_gate(%L::uuid, true)$q$, board) from _roomdeleg_fixture),
+  '42501', 'only a board owner may set the role gate',
+  'set_board_role_gate: a non-member (unmapped sub) is rejected');
+
+-- 3. suspended principal (current_agent_id() null) cannot flip the gate -> 42501 ----
+select set_config('request.jwt.claim.sub', (select suspended_user from _roomdeleg_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.set_board_role_gate(%L::uuid, true)$q$, board) from _roomdeleg_fixture),
+  '42501', 'only a board owner may set the role gate',
+  'set_board_role_gate: a suspended principal (null actor) is rejected');
+
+-- 4. owner (Alice) flips false->true (pinned to a single assertion) -----------------
+select set_config('request.jwt.claim.sub', (select alice_user from _roomdeleg_fixture)::text, true);
+select is(
+  (select role_gate_enforced from agent_board.set_board_role_gate((select board from _roomdeleg_fixture), true)),
+  true, 'set_board_role_gate: the owner flips role_gate_enforced false->true');
+
+-- === Part B: the flipped gate restricts invite/resolve (gate now ON) ==============
+-- 5. gate ON -> non-owner/admin member (Bob) invite rejected -> 42501 ---------------
+select set_config('request.jwt.claim.sub', (select bob_user from _roomdeleg_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target, alice) from _roomdeleg_fixture),
+  '42501', 'board invite requires owner or admin role',
+  'gate ON: a role-member actor is denied invite');
+
+-- 6. gate ON -> non-owner/admin member (Bob) resolve rejected -> 42501 --------------
+select throws_ok(
+  (select format($q$select agent_board.resolve_board_request(%L::uuid, %L::uuid, 'joined', %L::uuid, '{}'::jsonb)$q$, board, requester, alice) from _roomdeleg_fixture),
+  '42501', 'board request resolution requires owner or admin role',
+  'gate ON: a role-member actor is denied resolve');
+
+-- === Part C: R-DELEG-1 creator-identity exemption dropped under an enforced gate ===
+-- 7. creator-who-is-still-owner (Alice) + gate ON -> invite still succeeds ----------
+select set_config('request.jwt.claim.sub', (select alice_user from _roomdeleg_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target, alice) from _roomdeleg_fixture),
+  'gate ON: the creator who still holds owner membership may invite');
+
+-- Demote the creator to member (bare statement, not an assertion). created_by is
+-- immutable, so this models a creator who has lost owner authority.
+update agent_board.board_memberships bm
+   set role = 'member'
+  from _roomdeleg_fixture f
+ where bm.board_id = f.board and bm.agent_id = f.alice;
+
+-- 8. demoted creator + gate ON -> invite rejected -> 42501 (R-DELEG-1) --------------
+select throws_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target, alice) from _roomdeleg_fixture),
+  '42501', 'board invite requires owner or admin role',
+  'gate ON: a DEMOTED creator no longer bypasses invite (creator-identity gate closed)');
+
+-- 9. demoted creator + gate ON -> resolve rejected -> 42501 (R-DELEG-1) -------------
+select throws_ok(
+  (select format($q$select agent_board.resolve_board_request(%L::uuid, %L::uuid, 'joined', %L::uuid, '{}'::jsonb)$q$, board, requester, alice) from _roomdeleg_fixture),
+  '42501', 'board request resolution requires owner or admin role',
+  'gate ON: a DEMOTED creator no longer bypasses resolve (creator-identity gate closed)');
+
+-- === Part D: gate OFF regression (creator/any active member bypass unchanged) ======
+-- Flip the gate back OFF via a direct update (demoted Alice can no longer use the RPC).
+update agent_board.boards b
+   set role_gate_enforced = false
+ where b.id = (select board from _roomdeleg_fixture);
+
+-- 10. gate OFF + demoted creator -> invite still bypasses (creator exemption intact) -
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target, alice) from _roomdeleg_fixture),
+  'gate OFF: the demoted creator still bypasses (gate-OFF behavior unchanged)');
+
+-- 11. gate OFF + any active member (Bob) -> invite succeeds -------------------------
+select set_config('request.jwt.claim.sub', (select bob_user from _roomdeleg_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.invite_board_member(%L::uuid, %L::uuid, %L::uuid, '{}'::jsonb)$q$, board, target, alice) from _roomdeleg_fixture),
+  'gate OFF: any active member may invite (any-active-member behavior preserved)');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select finish();
+
+rollback;

package/tests/agent_board_roomlink.test.sql

@@ -0,0 +1,364 @@
+-- ROOMLINK pgTAP: shareable board invite links (create/redeem/revoke) + the
+-- enroll-on-redeem binding. Exercises the panel's correctness invariants:
+--   * grantor-bounded mint; owner-preset forbidden; admin-preset requires a use cap
+--     and a <=7d TTL (R-LINK-3),
+--   * create actor-guard (_resolved_actor_agent_id),
+--   * atomic rank-max redemption that never downgrades a higher role (R-LINK-1),
+--   * idempotent replay of a maxed link (M1) + exhaustion + expiry + revoked
+--     (uniform 42501),
+--   * suspended-creator refusal (R-LINK-2) + creator-ceiling re-bind,
+--   * kicked-agent ('removed') refusal (R-LINK-7),
+--   * redeem actor fail-closed on null (suspended principal),
+--   * _redeem_invite_for_agent is NOT authenticated-callable,
+--   * enroll_federated_identity(...,p_invite_code) soft-honors a code
+--     (invite_redeemed=true) and soft-fails a bad one (enroll still succeeds).
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- (''/service_role => true, 'authenticated' => false) and request.jwt.claim.sub picks
+-- the acting agent. Fixture style mirrors agent_board_roomown.test.sql. The two
+-- Ed25519 public keys + fingerprints are reused from agent_board_enroll_federated_identity.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(34);
+
+create temp table _lf (
+  board uuid,
+  alice uuid, bob uuid, carol uuid, carol2 uuid, carol3 uuid,
+  dave uuid, erin uuid, frank uuid, gus uuid, grimm uuid, harry uuid, mallory uuid,
+  alice_user uuid, bob_user uuid, carol_user uuid, mallory_user uuid,
+  code_member text, code_maxed text, code_public text, code_mallory text,
+  code_harry text, code_revoke text, code_revoke_authz text, code_enroll text,
+  code_expired text,
+  prov_iss text, prov_sub text, prov_slug text,
+  pub1 text, fp1 text, pub2 text, fp2 text
+) on commit drop;
+
+create temp table _er (label text, agent_id uuid, invite_redeemed boolean) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_alice_user uuid; v_bob_user uuid; v_carol_user uuid; v_mallory_user uuid;
+  v_alice uuid := gen_random_uuid();
+  v_bob uuid := gen_random_uuid();
+  v_carol uuid := gen_random_uuid();
+  v_carol2 uuid := gen_random_uuid();
+  v_carol3 uuid := gen_random_uuid();
+  v_dave uuid := gen_random_uuid();
+  v_erin uuid := gen_random_uuid();
+  v_frank uuid := gen_random_uuid();
+  v_gus uuid := gen_random_uuid();
+  v_grimm uuid := gen_random_uuid();
+  v_harry uuid := gen_random_uuid();
+  v_mallory uuid := gen_random_uuid();
+  v_board uuid;
+  v_code_member text; v_code_maxed text; v_code_public text; v_code_mallory text;
+  v_code_harry text; v_code_revoke text; v_code_revoke_authz text; v_code_enroll text;
+  v_code_expired text := 'expired-code-' || v_suffix;
+  v_prov_iss text := 'https://roomlink-fed-' || v_suffix || '.test';
+begin
+  v_alice_user := public.ensure_github_user('rl-alice-' || v_suffix, 'rl-alice-' || v_suffix || '@example.test', 'rl-alice-' || v_suffix, 'RL Alice');
+  v_bob_user := public.ensure_github_user('rl-bob-' || v_suffix, 'rl-bob-' || v_suffix || '@example.test', 'rl-bob-' || v_suffix, 'RL Bob');
+  v_carol_user := public.ensure_github_user('rl-carol-' || v_suffix, 'rl-carol-' || v_suffix || '@example.test', 'rl-carol-' || v_suffix, 'RL Carol');
+  v_mallory_user := public.ensure_github_user('rl-mallory-' || v_suffix, 'rl-mallory-' || v_suffix || '@example.test', 'rl-mallory-' || v_suffix, 'RL Mallory');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_alice, 'agent', 'rl-alice-' || v_suffix, 'RL Alice', 'active', v_alice_user, v_alice_user),
+    (v_bob, 'agent', 'rl-bob-' || v_suffix, 'RL Bob', 'active', v_bob_user, v_bob_user),
+    (v_carol, 'agent', 'rl-carol-' || v_suffix, 'RL Carol', 'active', v_carol_user, v_carol_user),
+    -- mallory is SUSPENDED but still holds an admin membership + a valid auth user:
+    -- current_agent_id() filters status='active' (fail-closed redeem), and R-LINK-2
+    -- refuses redeeming her outstanding link.
+    (v_mallory, 'agent', 'rl-mallory-' || v_suffix, 'RL Mallory', 'suspended', v_mallory_user, v_mallory_user),
+    (v_carol2, 'agent', 'rl-carol2-' || v_suffix, 'RL Carol2', 'active', null, null),
+    (v_carol3, 'agent', 'rl-carol3-' || v_suffix, 'RL Carol3', 'active', null, null),
+    (v_dave, 'agent', 'rl-dave-' || v_suffix, 'RL Dave', 'active', null, null),
+    (v_erin, 'agent', 'rl-erin-' || v_suffix, 'RL Erin', 'active', null, null),
+    (v_frank, 'agent', 'rl-frank-' || v_suffix, 'RL Frank', 'active', null, null),
+    (v_gus, 'agent', 'rl-gus-' || v_suffix, 'RL Gus', 'active', null, null),
+    (v_grimm, 'agent', 'rl-grimm-' || v_suffix, 'RL Grimm', 'active', null, null),
+    (v_harry, 'agent', 'rl-harry-' || v_suffix, 'RL Harry', 'active', null, null);
+
+  -- Alice creates board B (service_role null-actor -> supplied arg honored): create_board
+  -- seeds Alice's joined owner membership.
+  select board_id into v_board
+    from agent_board.create_board(v_alice, 'roomlink-board-' || v_suffix, 'ROOMLINK Board', 'roomlink test', '{}'::jsonb, 'private');
+
+  -- Pre-existing memberships used by the redemption cases.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_dave, 'joined', v_alice, 'admin'),      -- no-downgrade target
+    (v_board, v_grimm, 'joined', v_alice, 'observer'),  -- too-low to mint member links
+    (v_board, v_harry, 'joined', v_alice, 'admin'),     -- mints an admin link, later demoted
+    (v_board, v_mallory, 'joined', v_alice, 'admin');   -- mints a link, agent suspended
+  -- Erin was kicked (removed): the active partial index does not cover this row, so a
+  -- redeem must explicitly refuse rather than seat a fresh joined row.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role, left_at)
+  values (v_board, v_erin, 'removed', v_alice, 'member', now());
+
+  -- Mint links (service_role context: default role '', session_user postgres).
+  select code into v_code_member
+    from agent_board.create_invite_link(v_board, 'member', 'joined', null, null, v_alice, '{}'::jsonb);
+  select code into v_code_maxed
+    from agent_board.create_invite_link(v_board, 'member', 'joined', 1, null, v_alice, '{}'::jsonb);
+  select code into v_code_public
+    from agent_board.create_invite_link(v_board, 'member', 'joined', null, null, v_alice, '{}'::jsonb);
+  select code into v_code_revoke
+    from agent_board.create_invite_link(v_board, 'member', 'joined', null, null, v_alice, '{}'::jsonb);
+  select code into v_code_revoke_authz
+    from agent_board.create_invite_link(v_board, 'member', 'joined', null, null, v_alice, '{}'::jsonb);
+  select code into v_code_enroll
+    from agent_board.create_invite_link(v_board, 'member', 'joined', null, null, v_alice, '{}'::jsonb);
+  -- Mallory (admin membership) mints a member link; her agent is suspended.
+  select code into v_code_mallory
+    from agent_board.create_invite_link(v_board, 'member', 'joined', null, null, v_mallory, '{}'::jsonb);
+  -- Harry (admin) mints an ADMIN link (use cap required); harry is then demoted.
+  select code into v_code_harry
+    from agent_board.create_invite_link(v_board, 'admin', 'joined', 2, null, v_harry, '{}'::jsonb);
+  update agent_board.board_memberships bm set role = 'member'
+   where bm.board_id = v_board and bm.agent_id = v_harry;
+
+  -- An already-expired token (direct insert; create_invite_link rejects a past TTL).
+  insert into agent_board.board_invite_tokens(code, board_id, preset_role, preset_membership_state, expires_at, created_by_agent_id)
+  values (v_code_expired, v_board, 'member', 'joined', now() - interval '1 day', v_alice);
+
+  -- Approved identity provider for the enroll-binding cases.
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values (v_prov_iss, 'message-board', true, true, '{}', '{}', '{agent,human}');
+
+  insert into _lf values (
+    v_board, v_alice, v_bob, v_carol, v_carol2, v_carol3, v_dave, v_erin, v_frank,
+    v_gus, v_grimm, v_harry, v_mallory,
+    v_alice_user, v_bob_user, v_carol_user, v_mallory_user,
+    v_code_member, v_code_maxed, v_code_public, v_code_mallory, v_code_harry,
+    v_code_revoke, v_code_revoke_authz, v_code_enroll, v_code_expired,
+    v_prov_iss, 'portal|' || v_suffix, 'rl-enrollee-' || v_suffix,
+    'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
+    'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA'
+  );
+end
+$$;
+
+-- === A. create validation ============================================== (7)
+-- 1
+select throws_ok(
+  (select format($q$select agent_board.create_invite_link(%L::uuid, 'owner', 'joined', 1, null, %L::uuid)$q$, board, alice) from _lf),
+  '22023', 'owner presets are not invite-linkable',
+  'create_invite_link forbids the owner preset (R-LINK-3)');
+-- 2
+select throws_ok(
+  (select format($q$select agent_board.create_invite_link(%L::uuid, 'admin', 'joined', null, null, %L::uuid)$q$, board, alice) from _lf),
+  '22023', 'admin invite links require a bounded p_max_uses',
+  'admin preset requires a use cap (R-LINK-3)');
+-- 3
+select throws_ok(
+  (select format($q$select agent_board.create_invite_link(%L::uuid, 'admin', 'joined', 5, now() + interval '10 days', %L::uuid)$q$, board, alice) from _lf),
+  '22023', 'admin invite links require a TTL of at most 7 days',
+  'admin preset requires a <=7d TTL (R-LINK-3)');
+-- 4
+select throws_ok(
+  (select format($q$select agent_board.create_invite_link(%L::uuid, 'member', 'joined', null, null, %L::uuid)$q$, board, grimm) from _lf),
+  '42501', 'preset role exceeds creator role or board authority ceiling',
+  'create is grantor-bounded: an observer cannot mint a member link');
+-- 5
+select is((select length(code_member) from _lf), 43, 'the minted code is a 43-char base64url (256-bit) string');
+-- 6
+select is(
+  (select preset_role from agent_board.board_invite_tokens t join _lf f on t.code = f.code_member),
+  'member', 'the minted member link stores preset_role=member');
+-- 7
+select isnt((select code_member from _lf), (select code_maxed from _lf), 'distinct mints produce distinct codes (uniqueness)');
+
+-- === B. create actor-guard ============================================= (1)
+-- 8
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select bob_user from _lf)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.create_invite_link(%L::uuid, 'member', 'joined', null, null, %L::uuid)$q$, board, alice) from _lf),
+  '42501', 'p_created_by_agent_id must match current_agent_id()',
+  'actor-guard: authenticated Bob cannot mint a link as Alice');
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- === C. redeem basics ================================================== (3)
+-- 9
+select is(
+  (select role from agent_board._redeem_invite_for_agent((select code_member from _lf), (select carol from _lf))),
+  'member', 'redeem seats Carol with the member role');
+-- 10
+select is(
+  (select count(*)::int from agent_board.board_memberships bm join _lf f on bm.board_id = f.board and bm.agent_id = f.carol
+     where bm.membership_state in ('joined','subscribed')),
+  1, 'Carol holds exactly one active membership after redeem');
+-- 11
+select is(
+  (select uses_count from agent_board.board_invite_tokens t join _lf f on t.code = f.code_member),
+  1, 'the member link uses_count incremented to 1');
+
+-- === D. idempotency + exhaustion (maxed link) ========================== (5)
+-- 12
+select is(
+  (select role from agent_board._redeem_invite_for_agent((select code_maxed from _lf), (select frank from _lf))),
+  'member', 'first redeem of the maxed link seats Frank');
+-- 13
+select is(
+  (select uses_count from agent_board.board_invite_tokens t join _lf f on t.code = f.code_maxed),
+  1, 'the maxed link uses_count is 1 after Frank');
+-- 14
+select lives_ok(
+  (select format($q$select agent_board._redeem_invite_for_agent(%L, %L::uuid)$q$, code_maxed, frank) from _lf),
+  'replay by the same agent on a maxed link is an idempotent no-op (M1), not 42501');
+-- 15
+select is(
+  (select uses_count from agent_board.board_invite_tokens t join _lf f on t.code = f.code_maxed),
+  1, 'the idempotent replay did NOT inflate uses_count');
+-- 16
+select throws_ok(
+  (select format($q$select agent_board._redeem_invite_for_agent(%L, %L::uuid)$q$, code_maxed, gus) from _lf),
+  '42501', 'invite is not usable',
+  'a DIFFERENT agent redeeming the exhausted link is refused (uniform 42501)');
+
+-- === E. no-downgrade (rank-max) ======================================== (2)
+-- 17
+select is(
+  (select role from agent_board._redeem_invite_for_agent((select code_member from _lf), (select dave from _lf))),
+  'admin', 'redeeming a member link never downgrades Dave''s existing admin role (R-LINK-1)');
+-- 18
+select is(
+  (select role from agent_board.board_memberships bm join _lf f on bm.board_id = f.board and bm.agent_id = f.dave
+     where bm.membership_state in ('joined','subscribed')),
+  'admin', 'Dave''s stored membership role remains admin');
+
+-- === F. kicked-agent refusal (R-LINK-7) ================================ (1)
+-- 19
+select throws_ok(
+  (select format($q$select agent_board._redeem_invite_for_agent(%L, %L::uuid)$q$, code_member, erin) from _lf),
+  '42501', 'invite is not usable',
+  'a removed (kicked) agent cannot re-enter via an invite link (R-LINK-7)');
+
+-- === G. suspended-creator refusal (R-LINK-2) =========================== (1)
+-- 20
+select throws_ok(
+  (select format($q$select agent_board._redeem_invite_for_agent(%L, %L::uuid)$q$, code_mallory, carol2) from _lf),
+  '42501', 'invite is not usable',
+  'a suspended creator''s outstanding link stops minting (R-LINK-2)');
+
+-- === H. creator-ceiling re-bind ======================================== (1)
+-- 21
+select throws_ok(
+  (select format($q$select agent_board._redeem_invite_for_agent(%L, %L::uuid)$q$, code_harry, carol3) from _lf),
+  '42501', 'invite is not usable',
+  'a demoted creator''s admin link auto-degrades at redeem (re-bound ceiling)');
+
+-- === I. expired ======================================================== (1)
+-- 22
+select throws_ok(
+  (select format($q$select agent_board._redeem_invite_for_agent(%L, %L::uuid)$q$, code_expired, gus) from _lf),
+  '42501', 'invite is not usable',
+  'an expired link is refused (uniform 42501)');
+
+-- === J. revoke RPC ===================================================== (3)
+-- 23
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select alice_user from _lf)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.revoke_invite_link(%L)$q$, code_revoke) from _lf),
+  'the creator (Alice) revokes her own link');
+-- 24
+select ok(
+  (select revoked_at is not null from agent_board.board_invite_tokens t join _lf f on t.code = f.code_revoke),
+  'the revoked link carries a revoked_at timestamp');
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+-- 25
+select throws_ok(
+  (select format($q$select agent_board._redeem_invite_for_agent(%L, %L::uuid)$q$, code_revoke, carol2) from _lf),
+  '42501', 'invite is not usable',
+  'a revoked link is refused at redeem (uniform 42501)');
+
+-- === K. revoke authz =================================================== (1)
+-- 26
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select carol_user from _lf)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.revoke_invite_link(%L)$q$, code_revoke_authz) from _lf),
+  '42501', 'not authorized to revoke this invite',
+  'a plain member (Carol) cannot revoke someone else''s link');
+
+-- === L. public redeem happy path ======================================= (1)
+-- 27
+select is(
+  (select role from agent_board.redeem_invite_link((select code_public from _lf))),
+  'member', 'the public redeem_invite_link resolves the actor via current_agent_id() and seats Carol');
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- === M. redeem actor fail-closed ======================================= (1)
+-- 28
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select mallory_user from _lf)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.redeem_invite_link(%L)$q$, code_public) from _lf),
+  '42501', 'current agent principal not resolved',
+  'a suspended principal (current_agent_id() null) cannot redeem-as-nobody');
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- === N. internal core is not authenticated-callable ==================== (1)
+-- 29
+select function_privs_are(
+  'agent_board', '_redeem_invite_for_agent', array['text', 'uuid'],
+  'authenticated', array[]::text[],
+  '_redeem_invite_for_agent execute is revoked from authenticated (service_role-only core)');
+
+-- === O. enroll-on-redeem binding ======================================= (5)
+do $$
+declare v_aid uuid; v_red boolean;
+begin
+  -- Valid code: the enrollee lands in the board and invite_redeemed=true.
+  select e.agent_id, e.invite_redeemed into v_aid, v_red
+    from _lf f, agent_board.enroll_federated_identity(
+      f.prov_iss, 'message-board', f.prov_sub,
+      jsonb_build_object('sub', f.prov_sub), f.prov_slug,
+      f.pub1, 'raw_ed25519_base64url', f.fp1, true, null, 'agent', '{}', '{}', f.code_enroll) e;
+  insert into _er values ('X', v_aid, v_red);
+
+  -- Bad code: enrollment still succeeds, invite_redeemed=false, no membership.
+  select e.agent_id, e.invite_redeemed into v_aid, v_red
+    from _lf f, agent_board.enroll_federated_identity(
+      f.prov_iss, 'message-board', f.prov_sub || '-2',
+      jsonb_build_object('sub', f.prov_sub || '-2'), f.prov_slug || '-2',
+      f.pub2, 'raw_ed25519_base64url', f.fp2, true, null, 'agent', '{}', '{}', 'bogus-code-nonexistent') e;
+  insert into _er values ('Y', v_aid, v_red);
+end
+$$;
+-- 30
+select is((select invite_redeemed from _er where label = 'X'), true, 'enroll with a valid invite_code reports invite_redeemed=true');
+-- 31
+select is(
+  (select count(*)::int from agent_board.board_memberships bm, _lf f, _er r
+     where r.label = 'X' and bm.agent_id = r.agent_id and bm.board_id = f.board
+       and bm.membership_state in ('joined','subscribed')),
+  1, 'the enrollee was seated on the board by the redeemed code');
+-- 32
+select is(
+  (select status from agent_board.agents a join _er r on a.id = r.agent_id where r.label = 'Y'),
+  'active', 'enroll with a BAD invite_code still creates an active agent (soft-fail)');
+-- 33
+select is((select invite_redeemed from _er where label = 'Y'), false, 'a bad invite_code reports invite_redeemed=false');
+-- 34
+select is(
+  (select count(*)::int from agent_board.board_memberships bm, _lf f, _er r
+     where r.label = 'Y' and bm.agent_id = r.agent_id and bm.board_id = f.board),
+  0, 'the soft-failed enrollee gained no membership');
+
+select finish();
+
+rollback;