@consiliency/agent-board-schema 1.50.0 → 1.52.0

package/tests/agent_board_invite_no_downgrade.test.sql

@@ -392,12 +392,15 @@ select is(pg_temp.nd_state(), 'joined',
 --     cannot satisfy a claim (message-board#196/#199), and it RAISES rather than returning
 --     NULL for a body it cannot read, which a `where … ~ …` scan would drop silently.
 --
---   * The statement alternation and the optional-qualifier spelling are TAKEN VERBATIM from
---     agent_board_receipt_subject_gate.test.sql rather than written fresh. That file already
---     paid for this: it records `merge into`, `update only`, `delete from only`,
---     `agent_board."board_memberships"` and `"agent_board" . "board_memberships"` as
---     VERIFIED-LEGAL spellings that were each invisible to a narrower pattern. A second pattern
---     written here would be a second list to drift -- rule 1 applied to the predicate itself.
+--   * The write-family conjunct is `agent_board_test.write_re('board_memberships')`, the shared
+--     matcher in tests/fixtures/test-prereqs.sql, rather than a statement alternation written
+--     here (message-board#416/#417/#424). The hand-rolled alternation it replaced was copied
+--     VERBATIM from agent_board_receipt_subject_gate.test.sql, which had already paid for it:
+--     `merge into`, `update only`, `delete from only`, `agent_board."board_memberships"` and
+--     `"agent_board" . "board_memberships"` are each VERIFIED-LEGAL spellings that were
+--     invisible to a narrower pattern. A copy is still a second list to drift -- rule 1
+--     applied to the predicate itself -- so the family now lives in ONE place, behind a
+--     behaviour table (CPR-0) that pins every spelling above.
 --     The first draft of THIS file required `update agent_board.board_memberships` alone, and
 --     FOUR separate decoys each left it 19/19 green: `insert ... on conflict ... do update set`,
 --     `merge into`, an UNQUALIFIED `update board_memberships` under a search_path, and dynamic
@@ -410,8 +413,9 @@ select is(pg_temp.nd_state(), 'joined',
 --     so prose naming the pattern still cannot satisfy the claim. Keeping literals can only
 --     produce a LOUD false positive on an exact-set assertion, never a silent miss.
 --
---   * `lower(...)` with `~` rather than `~*`: same effect, and it matches the neighbouring file
---     so the two cannot drift on case handling.
+--   * Case handling belongs to the matcher (`ci_re` folds each keyword; the `(?c)` director in
+--     `re()` keeps identifiers exact-case when quoted), so no `lower(...)` / `~*` at this site --
+--     the column conjuncts below still spell their own, until they move too.
 --
 -- WHAT THIS SCAN CANNOT SEE, stated exactly rather than generously, because a scan that reports
 -- clean on its own boundary forms is worth less than one that says which forms it declines to
@@ -434,7 +438,8 @@ select is(pg_temp.nd_state(), 'joined',
 --
 --   * `prokind in ('f','p')`. A PROCEDURE writer is exempt under `prokind = 'f'`.
 --
---   * `\m` word boundaries. Without them the role canary below silently matched nothing.
+--   * `\m` word boundaries (the matcher's `lead_guard`/`trail_guard`, and the column
+--     conjuncts' own `\m`). Without them the role canary below silently matched nothing.
 --
 -- A `BEGIN ATOMIC` writer is covered too: stripped_body falls back to
 -- pg_get_function_sqlbody, verified with a BEGIN ATOMIC decoy that this assertion named.
@@ -445,8 +450,7 @@ select is(
     where n.nspname = 'agent_board'
       and p.prokind in ('f', 'p')
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and lower(agent_board_test.stripped_body(p.oid, true))
-          ~ '(insert\s+into|merge\s+into|update|delete\s+from|copy|truncate(\s+table)?)(\s+only)?\s+(("?agent_board"?\s*\.\s*)?board_memberships\M|("?agent_board"?\s*\.\s*)?"board_memberships")'),
+      and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.write_re('board_memberships')),
   array['_fedsession_autojoin_default_board', '_redeem_unbounded_invite_for_agent',
         '_upsert_board_membership_state', 'bootstrap_board_owner_memberships',
         'create_board', 'grant_board_role']::text[],
@@ -464,10 +468,12 @@ select is(
     where n.nspname = 'agent_board'
       and p.prokind in ('f', 'p')
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and lower(agent_board_test.stripped_body(p.oid, true))
-          ~ '(insert\s+into|merge\s+into|update|delete\s+from|copy|truncate(\s+table)?)(\s+only)?\s+(("?agent_board"?\s*\.\s*)?board_memberships\M|("?agent_board"?\s*\.\s*)?"board_memberships")'
-      and lower(agent_board_test.stripped_body(p.oid, true))
-          ~ '(set\s[^;]*\mmembership_state"?\s*=|set\s*\([^;()]*\mmembership_state"?[^;()]*\)\s*=)'),
+      and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.write_re('board_memberships')
+      -- the SET-clause arms of the family (UPDATE scalar/row form, MERGE then-update, INSERT …
+      -- ON CONFLICT DO UPDATE), relation-scoped; the INSERT column-list arm of col_write_re is
+      -- deliberately NOT here — a column list creates a row, it does not MOVE one
+      and agent_board_test.stripped_body(p.oid, true)
+          ~ agent_board_test.re(agent_board_test.col_assign_frag('board_memberships', 'membership_state', agent_board_test.bare_ok(p.oid)))),
   array['_upsert_board_membership_state']::text[],
   '#317: the shared sink is the ONLY writer that assigns membership_state IN A SET CLAUSE — i.e. the only one that can MOVE an existing row between states');
 
@@ -482,9 +488,9 @@ select is(
     where n.nspname = 'agent_board'
       and p.prokind in ('f', 'p')
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
-      and lower(agent_board_test.stripped_body(p.oid, true))
-          ~ '(insert\s+into|merge\s+into|update|delete\s+from|copy|truncate(\s+table)?)(\s+only)?\s+(("?agent_board"?\s*\.\s*)?board_memberships\M|("?agent_board"?\s*\.\s*)?"board_memberships")'
-      and lower(agent_board_test.stripped_body(p.oid, true)) ~ 'set\s[^;]*\mrole\s*='),
+      and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.write_re('board_memberships')
+      and agent_board_test.stripped_body(p.oid, true)
+          ~ agent_board_test.re(agent_board_test.col_assign_frag('board_memberships', 'role', agent_board_test.bare_ok(p.oid)))),
   array['_redeem_unbounded_invite_for_agent', '_upsert_board_membership_state',
         'bootstrap_board_owner_memberships', 'create_board', 'grant_board_role']::text[],
   '#317 canary: the SET-clause predicate still matches real SET clauses (these five assign `role`) — so an empty membership_state result means empty, not blind');

package/tests/agent_board_ledger_authority.test.sql

@@ -535,17 +535,17 @@ select is(
   (select string_agg(p.proname, ',' order by p.proname)
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
-      and (agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+agent_board\.board_memberships\M'
-        or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.board_memberships\M[^;]*\mset\M[^;]*\mrole\s*='
-        or agent_board_test.stripped_body(p.oid) ~* '(insert\s+into|update)\s+agent_board\.board_authority_ceilings\M'
-        or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.boards\M[^;]*\mset\M[^;]*\mrole_gate_enforced\s*='
+      and (agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into', 'board_memberships')
+        or agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('board_memberships', 'role')
+        or agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into|update', 'board_authority_ceilings')
+        or agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('boards', 'role_gate_enforced')
         -- BOARDCLAIMPOLICY: boards.claim_policy is the same SHAPE of authority as
         -- role_gate_enforced above -- a board-level switch deciding what a later gate does
         -- (there the creator-identity exemption, here whether our ownerless claim guards apply
         -- at all). Counting it as an authority write is what makes the pairing assertion below
         -- hold, and is why set_board_claim_policy carries the ledger check.
-        or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.boards\M[^;]*\mset\M[^;]*\mclaim_policy\s*='
-        or agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+agent_board\.board_invite_tokens\M')),
+        or agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('boards', 'claim_policy')
+        or agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into', 'board_invite_tokens'))),
   '_fedsession_autojoin_default_board,_redeem_unbounded_invite_for_agent,'
   || '_upsert_board_membership_state,bootstrap_board_owner_memberships,create_board,'
   || 'create_invite_link,grant_board_role,set_board_authority_ceiling,set_board_claim_policy,'
@@ -563,7 +563,9 @@ select is(
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and p.proname not in ('_assert_actor_not_fleet_revoked', '_actor_fleet_revoked')
-      and agent_board_test.stripped_body(p.oid) ~ '\m(_assert_actor_not_fleet_revoked|_actor_fleet_revoked)\s*\('),
+      and agent_board_test.stripped_body(p.oid)
+          ~ agent_board_test.re(agent_board_test.call_frag('_assert_actor_not_fleet_revoked')
+                                || '|' || agent_board_test.call_frag('_actor_fleet_revoked'))),
   '_redeem_unbounded_invite_for_agent,create_board,create_invite_link,grant_board_role,'
   || 'set_board_authority_ceiling,set_board_claim_policy,set_board_role_gate',
   'the functions that consult the fleet revocation ledger are exactly these seven (#280 added '
@@ -579,7 +581,9 @@ select is(
   (select string_agg(x.proname || ':' || x.why, '; ' order by x.proname)
      from (
        select p.proname,
-              case when agent_board_test.stripped_body(p.oid) ~ '\m(_assert_actor_not_fleet_revoked|_actor_fleet_revoked)\s*\('
+              case when agent_board_test.stripped_body(p.oid)
+                        ~ agent_board_test.re(agent_board_test.call_frag('_assert_actor_not_fleet_revoked')
+                                              || '|' || agent_board_test.call_frag('_actor_fleet_revoked'))
                    then 'consults the ledger but writes no authority relation'
                    else 'writes an authority relation with NO ledger gate'
               end as why
@@ -591,13 +595,15 @@ select is(
                 '_fedsession_autojoin_default_board', 'bootstrap_board_owner_memberships',
                 -- ...and the two helpers, which ARE the gate rather than users of it
                 '_assert_actor_not_fleet_revoked', '_actor_fleet_revoked')
-          and ((agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+agent_board\.board_memberships\M'
-             or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.board_memberships\M[^;]*\mset\M[^;]*\mrole\s*='
-             or agent_board_test.stripped_body(p.oid) ~* '(insert\s+into|update)\s+agent_board\.board_authority_ceilings\M'
-             or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.boards\M[^;]*\mset\M[^;]*\mrole_gate_enforced\s*='
-            or agent_board_test.stripped_body(p.oid) ~* 'update\s+agent_board\.boards\M[^;]*\mset\M[^;]*\mclaim_policy\s*='
-             or agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+agent_board\.board_invite_tokens\M')
-              <> (agent_board_test.stripped_body(p.oid) ~ '\m(_assert_actor_not_fleet_revoked|_actor_fleet_revoked)\s*\('))
+          and ((agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into', 'board_memberships')
+             or agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('board_memberships', 'role')
+             or agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into|update', 'board_authority_ceilings')
+             or agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('boards', 'role_gate_enforced')
+             or agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('boards', 'claim_policy')
+             or agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into', 'board_invite_tokens'))
+              <> (agent_board_test.stripped_body(p.oid)
+                  ~ agent_board_test.re(agent_board_test.call_frag('_assert_actor_not_fleet_revoked')
+                                        || '|' || agent_board_test.call_frag('_actor_fleet_revoked'))))
      ) x),
   null,
   'no function writes an authority relation without the ledger gate, or vice versa');
@@ -681,7 +687,7 @@ select is(
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and p.proname <> '_upsert_board_membership_state'
-      and agent_board_test.stripped_body(p.oid) ~ '\m_upsert_board_membership_state\s*\('),
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_upsert_board_membership_state')),
   'invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)'
   || ' | join_board(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid, p_metadata jsonb)'
   || ' | request_join_board(p_board_id uuid, p_agent_id uuid, p_metadata jsonb)'
@@ -894,7 +900,7 @@ select is(
   (select string_agg(p.proname, ',' order by p.proname)
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
-      and agent_board_test.stripped_body(p.oid) ~ '\m_redeem_unbounded_invite_for_agent\s*\('),
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_redeem_unbounded_invite_for_agent')),
   '_redeem_fleet_invite_for_agent,_redeem_invite_for_agent',
   'and those are the only two callers of it, so no redemption route bypasses the gate');
 
@@ -906,7 +912,7 @@ select is(
   (select string_agg(p.proname, ',' order by p.proname)
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
-      and agent_board_test.stripped_body(p.oid) ~* '(insert\s+into|update)\s+agent_board\.fleet_revocation_events\M'),
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into|update', 'fleet_revocation_events')),
   '_revoke_agent_principal,revoke_fleet_subject',
   'the writers of the fleet revocation ledger are exactly these two');
 
@@ -958,9 +964,9 @@ select ok(
 -- stay unlocked — an `agents` lock reappearing in it is the deadlock the header enumerates.
 select ok(
   agent_board_test.stripped_body('agent_board._actor_fleet_revoked(uuid)'::regprocedure)
-    ~ 'agent_board\.fleet_revocation_events'
+    ~ agent_board_test.re(agent_board_test.qname_frag('fleet_revocation_events', false))
   and agent_board_test.stripped_body('agent_board._actor_fleet_revoked(uuid)'::regprocedure)
-    !~ '\mfor\s+(share|update|key\s+share|no\s+key\s+update)\M',
+    !~ agent_board_test.re(agent_board_test.row_lock_frag()),
   'the unlocked predicate reads the ledger and takes NO row lock — what makes it safe to call '
   'from the invite redeem path, which is reached holding a boards lock');
 
@@ -977,7 +983,9 @@ select is(
 -- would mean a machine reactivation could restore a revoked agent's authority.
 select ok(
   agent_board_test.stripped_body('agent_board._assert_actor_not_fleet_revoked(uuid,text)'::regprocedure)
-    !~ '\m(effective_at|reactivated_at)\M',
+    -- qualified or bare (col_ref_frag): `col_frag` alone rejects a preceding dot, so `e.effective_at`
+    -- would pass this absence (measured on evaluate_fleet_sender_policy, which only names it qualified).
+    !~ agent_board_test.re(agent_board_test.col_ref_frag('effective_at') || '|' || agent_board_test.col_ref_frag('reactivated_at')),
   'the gate has no supersession clause, matching the send path''s agent-subject predicate');
 
 -- ===========================================================================

package/tests/agent_board_mint_harden.test.sql

@@ -119,7 +119,7 @@ select is(
       where n.nspname = 'agent_board' and p.prokind = 'f')
    select coalesce(string_agg(proname, ', ' order by proname), '')
      from fns
-    where agent_board_test.stripped_body(oid) ~* 'insert[[:space:]]+into[[:space:]]+(agent_board\.)?agent_signing_keys'
+    where agent_board_test.stripped_body(oid) ~ agent_board_test.stmt_re('insert into', 'agent_signing_keys')
       -- CASE-INSENSITIVE, and that is load-bearing rather than tidiness. SQL folds
       -- unquoted identifiers, but `prosrc` is stored VERBATIM, so a writer spelling
       -- the same call `AGENT_BOARD.…` or the same column `FINGERPRINT` is identical
@@ -138,14 +138,14 @@ select is(
       -- offender set and the file stayed green. `\m` will not match inside
       -- `p_...` (both are word characters, so there is no boundary), and the
       -- trailing `\(` requires an actual call rather than a mention.
-      -- SCHEMA-QUALIFIED, because a bare-name anchor proves call SYNTAX, not callee
-      -- IDENTITY: `\m_raw_key_fingerprint\s*\(` also matches
+      -- SCHEMA-QUALIFIED (`bare_ok => false`), because a bare-name anchor proves call
+      -- SYNTAX, not callee IDENTITY: the old `\m_raw_key_fingerprint\s*\(` also matched
       -- `zz_other._raw_key_fingerprint(...)` (measured true). Every live call
       -- site in agent_board is `agent_board.`-qualified, so requiring the
       -- qualification costs nothing today and is fail-CLOSED if someone later writes
       -- an unqualified call (it reads as NOT calling). Overload count is pinned
       -- separately, so schema + name is the identity.
-      and agent_board_test.stripped_body(oid) !~* '\magent_board\._raw_key_fingerprint\s*\('),
+      and agent_board_test.stripped_body(oid) !~ agent_board_test.call_re('_raw_key_fingerprint', false)),
   '',
   'no agent_signing_keys.fingerprint writer bypasses _raw_key_fingerprint (catalog-derived; a new writer names itself)');
 
@@ -156,7 +156,7 @@ select ok(
        from pg_proc p join pg_namespace n on n.oid = p.pronamespace
       where n.nspname = 'agent_board' and p.prokind = 'f'
         and p.proname in ('mint_delegated_child', 'enroll_federated_identity'))
-   select bool_and(pg_get_functiondef(oid) ~ '_raw_key_fingerprint') from fns),
+   select bool_and(agent_board_test.stripped_body(oid) ~ agent_board_test.call_re('_raw_key_fingerprint', false)) from fns),
   'mint_delegated_child and enroll_federated_identity both derive via _raw_key_fingerprint');
 
 -- The helper derives over the RAW bytes, not the base64url string (revert => this flips).

package/tests/agent_board_outbox_wake_ordering.test.sql

@@ -99,7 +99,7 @@ select is(
       -- direction for a class filter. Missed by the round-3 sweep because that audit
       -- was LINE-anchored and this predicate's operator sits on the next line.
       and agent_board_test.stripped_body(p.oid)
-            ~* 'insert into agent_board\.callback_outbox_events'),
+            ~ agent_board_test.stmt_re('insert into', 'callback_outbox_events')),
   '_queue_board_post_callbacks, _queue_inbox_callbacks',
   'WO-3 CLASS: the catalog names exactly the two known outbox writers -- a new writer fails here and NAMES ITSELF');
 
@@ -114,9 +114,10 @@ select is(
       and p.prokind = 'f'
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
       and agent_board_test.stripped_body(p.oid)
-            ~* 'insert into agent_board\.callback_outbox_events'
+            ~ agent_board_test.stmt_re('insert into', 'callback_outbox_events')
       and agent_board_test.stripped_body(p.oid)
-            ~* 'overriding\s+(system|user)\s+value'),
+            ~ agent_board_test.re('\m' || agent_board_test.ci_re('overriding') || '\s+(?:' || agent_board_test.ci_re('system') || '|' || agent_board_test.ci_re('user') || ')\s+'
+                                  || agent_board_test.ci_re('value') || '\M')),
   '',
   'WO-3 CLASS: no outbox writer uses OVERRIDING SYSTEM VALUE -- the identity bypass stays closed');
 

package/tests/agent_board_ownerless_renew_quota.test.sql

@@ -533,7 +533,10 @@ select is(
   (select string_agg(p.proname, ', ' order by p.proname)
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
-      and agent_board_test.stripped_body(p.oid, true) ~ '(lease_expires_at\s*=[^=]|insert into agent_board\.claims\s*\([^)]*lease_expires_at)'),
+      -- every write form of claims.lease_expires_at (UPDATE/MERGE/ON CONFLICT assignment, INSERT
+      -- column list, ...) -- the old hand form was `lease_expires_at =` anywhere plus one INSERT
+      -- shape, which also read as a WHERE comparison; measured: the same three, in either strip mode
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('claims', 'lease_expires_at')),
   'acquire_claim, renew_claim, set_board_claim_policy',
   'ORQ-14 CLASS: acquire_claim, renew_claim and (since #400) set_board_claim_policy''s advisory-revert cap reset are the ONLY functions that write a claim lease — a new one names itself here instead of quietly inheriting an unconverged renewal path');
 
@@ -549,7 +552,9 @@ select is(
   (select string_agg(p.proname, ', ' order by p.proname)
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
-      and agent_board_test.stripped_body(p.oid, true) ~ 'count\(\*\)[^;]*from agent_board\.claims'),
+      and agent_board_test.stripped_body(p.oid)
+            ~ agent_board_test.re('\m' || agent_board_test.ci_re('count') || '\s*\(\s*\*\s*\)' || agent_board_test.same_stmt()
+                                  || agent_board_test.stmt_frag('from', 'claims', agent_board_test.bare_ok(p.oid)))),
   '_claimgate_active_ownerless_claims',
   'ORQ-15 CLASS: exactly ONE function counts rows of agent_board.claims — an enforcement path that re-derives the ownerless count instead of asking the helper fails here and names itself');
 

package/tests/agent_board_portal_offline_invariant.test.sql

@@ -119,25 +119,26 @@ select isnt(
 -- Grep (paired supplement): the DB write/session path references no Portal string. --
 select is(
   (select count(*)::int from (
-     select pg_get_functiondef(p.oid) as def
+     -- literals KEPT (a Portal reference IS a string); comments dropped (prose is not a reference)
+     select agent_board_test.stripped_body(p.oid, true) as def
        from pg_proc p join pg_namespace n on n.oid = p.pronamespace
       where n.nspname = 'agent_board'
         and p.proname in (
           'mint_fleet_agent_session', 'post_board_message', 'send_direct_message',
           'send_multicast_message', 'create_tasking_delivery')
    ) d
-   where lower(d.def) ~ '(portal|jwks|\.well-known|openid|oidc)'),
+   where d.def ~* '(portal|jwks|\.well-known|openid|oidc)'),
   0, 'no write/session-path RPC body references a Portal issuer/JWKS/OIDC string');
 select is(
   (select count(*)::int from (
-     select pg_get_functiondef(p.oid) as def
+     select agent_board_test.stripped_body(p.oid, true) as def
        from pg_proc p join pg_namespace n on n.oid = p.pronamespace
       where n.nspname = 'agent_board'
         and p.proname in (
           'mint_fleet_agent_session', 'post_board_message', 'send_direct_message',
           'send_multicast_message', 'create_tasking_delivery')
    ) d
-   where lower(d.def) ~ '(enroll_federated_identity|/enroll)'),
+   where d.def ~* '(enroll_federated_identity|/enroll)'),
   0, 'no write/session-path RPC body references the /enroll enrollment surface');
 
 select finish();

package/tests/agent_board_receipt_subject_gate.test.sql

@@ -477,8 +477,7 @@ select is(
   (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
-      and lower(agent_board_test.stripped_body(p.oid, true))
-          ~ '(insert\s+into|merge\s+into|update|delete\s+from)(\s+only)?\s+(("?agent_board"?\s*\.\s*)?read_receipts\M|("?agent_board"?\s*\.\s*)?"read_receipts")'),
+      and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.write_re('read_receipts')),
   'mark_read',
   'catalog: mark_read is the ONLY agent_board function that writes read_receipts -- a new writer names itself here');
 
@@ -486,10 +485,10 @@ select is(
   (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
-      and lower(agent_board_test.stripped_body(p.oid, true))
-          ~ '(insert\s+into|merge\s+into|update|delete\s+from)(\s+only)?\s+(("?agent_board"?\s*\.\s*)?read_receipts\M|("?agent_board"?\s*\.\s*)?"read_receipts")'
-      and lower(agent_board_test.stripped_body(p.oid))
-          !~ 'not\s+agent_board\._agent_can_access_thread\s*\('),
+      and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.write_re('read_receipts')
+      and agent_board_test.stripped_body(p.oid)
+          !~ agent_board_test.re('\m' || agent_board_test.ci_re('not') || '\s+'
+                                 || agent_board_test.call_frag('_agent_can_access_thread', false))),
   '(none)',
   'catalog: every read_receipts writer contains a REFUSING reference to _agent_can_access_thread (source shape only -- assertion 2 is what proves it refuses)');
 
@@ -512,8 +511,8 @@ select is(
   (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
-      and lower(agent_board_test.stripped_body(p.oid, true))
-          ~ '(delete\s+from|merge\s+into|truncate)(\s+table)?(\s+only)?\s+(("?agent_board"?\s*\.\s*)?read_receipts\M|("?agent_board"?\s*\.\s*)?"read_receipts")'),
+      and agent_board_test.stripped_body(p.oid, true)
+          ~ agent_board_test.stmt_re('delete from|merge into|truncate|truncate table', 'read_receipts')),
   '(none)',
   'catalog: no agent_board function deletes or truncates a read receipt -- the grandfather is permanent by construction');
 

package/tests/agent_board_rolereset.test.sql

@@ -143,7 +143,7 @@ select ok(
       -- qualification costs nothing today and is fail-CLOSED if someone later writes
       -- an unqualified call (it reads as NOT calling). Overload count is pinned
       -- separately, so schema + name is the identity.
-  (select agent_board_test.stripped_body(p.oid) !~* '\magent_board\._upsert_board_membership_state\s*\('
+  (select agent_board_test.stripped_body(p.oid) !~ agent_board_test.call_re('_upsert_board_membership_state', false)
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = '_redeem_invite_for_agent'
     limit 1),
@@ -268,8 +268,10 @@ select is(
 select ok(
   (select (
      select count(*) from regexp_matches(
-       pg_get_functiondef(p.oid),
-       'membership_state\s+in\s*\(\s*''joined''\s*,\s*''subscribed''\s*\)',
+       agent_board_test.stripped_body(p.oid, true),
+       -- the column qualified or bare (`bm.membership_state` is the UPDATE's spelling)
+       agent_board_test.re(agent_board_test.col_ref_frag('membership_state')
+                           || '\s+' || agent_board_test.ci_re('in') || '\s*\(\s*''joined''\s*,\s*''subscribed''\s*\)'),
        'g')) >= 2
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board' and p.proname = 'grant_board_role'

package/tests/agent_board_rowid.test.sql

@@ -48,7 +48,8 @@ statements as (
     proname,
     args,
     statement_ordinality::int as statement_ordinality,
-    statement
+    -- bound through `def` so the source-scan lint can follow `statement` to its producer
+    split.statement as statement
   from defs
   cross join lateral regexp_split_to_table(def, ';')
     with ordinality as split(statement, statement_ordinality)
@@ -57,33 +58,45 @@ select
   proname,
   args,
   statement_ordinality,
+  -- `from <rel>` through stmt_re: the verb is a word, the relation is schema-qualified
+  -- (`bare_ok => false`, as the hand-rolled `agent_board\.` was), case folded by the family
+  -- rather than by `~*`. The ORDER BY operands are `created_at` and `id`, qualified or bare
+  -- (col_ref_frag: `m.created_at desc` is the common spelling).
   case
-    when statement ~* 'from\s+agent_board\.board_memberships'
+    when statement ~ agent_board_test.stmt_re('from', 'board_memberships', false)
       then 'board_memberships'
-    when statement ~* 'from\s+agent_board\.tasks'
+    when statement ~ agent_board_test.stmt_re('from', 'tasks', false)
       then 'tasks'
-    when statement ~* 'from\s+agent_board\.messages'
+    when statement ~ agent_board_test.stmt_re('from', 'messages', false)
       then 'messages'
   end as source_relation,
   (select count(*)::int
-     from regexp_matches(statement, 'created_at\s+desc', 'gi')) as created_at_desc_count,
+     from regexp_matches(statement,
+            agent_board_test.re(agent_board_test.col_ref_frag('created_at')
+                                || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard()),
+            'g')) as created_at_desc_count,
   (select count(*)::int
      from regexp_matches(
        statement,
-       'created_at\s+desc\s*,\s*(?:[a-z_][a-z_0-9]*\.)?id\s+desc',
-       'gi'
+       agent_board_test.re(agent_board_test.col_ref_frag('created_at')
+                           || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard() || '\s*,\s*'
+                           || agent_board_test.col_ref_frag('id')
+                           || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard()),
+       'g'
      )) as total_order_count
 from statements
-where statement ~* 'order\s+by.*created_at\s+desc'
+where statement ~ agent_board_test.re('\m' || agent_board_test.ci_re('order by') || '\M.*'
+                                      || agent_board_test.col_ref_frag('created_at')
+                                      || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard())
   and (
-    statement ~* 'from\s+agent_board\.board_memberships'
+    statement ~ agent_board_test.stmt_re('from', 'board_memberships', false)
     or (
       proname = 'create_tasking_delivery'
-      and statement ~* 'from\s+agent_board\.tasks'
+      and statement ~ agent_board_test.stmt_re('from', 'tasks', false)
     )
     or (
       proname = 'post_board_message'
-      and statement ~* 'from\s+agent_board\.messages'
+      and statement ~ agent_board_test.stmt_re('from', 'messages', false)
     )
   );
 
@@ -564,7 +577,7 @@ select is(
 
 -- 11. The live view is catalog-derived too; its last definer uses DROP + CREATE.
 with d as (
-  select pg_get_viewdef(c.oid, true) as def
+  select agent_board_test.stripped_viewdef(c.oid) as def
   from pg_class c
   join pg_namespace n on n.oid = c.relnamespace
   where n.nspname = 'agent_board'
@@ -572,12 +585,18 @@ with d as (
     and c.relkind = 'v'
 )
 select is(
-  (select count(*)::int from d, regexp_matches(def, 'created_at\s+desc', 'gi')),
+  (select count(*)::int from d, regexp_matches(def,
+     agent_board_test.re(agent_board_test.col_ref_frag('created_at')
+                         || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard()),
+     'g')),
   (select count(*)::int
      from d, regexp_matches(
        def,
-       'created_at\s+desc\s*,\s*(?:[a-z_][a-z_0-9]*\.)?id\s+desc',
-       'gi'
+       agent_board_test.re(agent_board_test.col_ref_frag('created_at')
+                           || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard() || '\s*,\s*'
+                           || agent_board_test.col_ref_frag('id')
+                           || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard()),
+       'g'
      )),
   'v_board_directory live catalog definition gives its membership read the id DESC tiebreak');
 

package/tests/agent_board_signer_lifecycle.test.sql

@@ -463,7 +463,9 @@ select is(
     where n.nspname = 'agent_board'
       and p.proname like 'signed\_%'
       and agent_board_test.stripped_body(p.oid)
-          ~ '\m(grant_board_role|set_board_authority_ceiling|set_board_role_gate)\s*\('),
+          ~ agent_board_test.re(agent_board_test.call_frag('grant_board_role')
+                                || '|' || agent_board_test.call_frag('set_board_authority_ceiling')
+                                || '|' || agent_board_test.call_frag('set_board_role_gate'))),
   'signed_grant_board_role,signed_set_board_authority_ceiling',
   'the signed wrappers that perform an AUTHORITY write are exactly these two');
 
@@ -474,7 +476,7 @@ select is(
     where n.nspname = 'agent_board'
       and p.proname like 'signed\_%'
       and agent_board_test.stripped_body(p.oid)
-          ~ '\m_assert_signed_authority_signer_live\s*\('),
+          ~ agent_board_test.call_re('_assert_signed_authority_signer_live')),
   'signed_grant_board_role,signed_set_board_authority_ceiling',
   'the signed wrappers that revalidate the signer are exactly these two');
 
@@ -485,7 +487,9 @@ select is(
      from (
        select p.proname,
               case when agent_board_test.stripped_body(p.oid)
-                        ~ '\m(grant_board_role|set_board_authority_ceiling|set_board_role_gate)\s*\('
+                        ~ agent_board_test.re(agent_board_test.call_frag('grant_board_role')
+                                              || '|' || agent_board_test.call_frag('set_board_authority_ceiling')
+                                              || '|' || agent_board_test.call_frag('set_board_role_gate'))
                    then 'authority write with NO signer revalidation'
                    else 'revalidates a signer but performs no authority write'
               end as why
@@ -494,9 +498,11 @@ select is(
         where n.nspname = 'agent_board'
           and p.proname like 'signed\_%'
           and (agent_board_test.stripped_body(p.oid)
-                 ~ '\m(grant_board_role|set_board_authority_ceiling|set_board_role_gate)\s*\(')
+                 ~ agent_board_test.re(agent_board_test.call_frag('grant_board_role')
+                                       || '|' || agent_board_test.call_frag('set_board_authority_ceiling')
+                                       || '|' || agent_board_test.call_frag('set_board_role_gate')))
               <> (agent_board_test.stripped_body(p.oid)
-                 ~ '\m_assert_signed_authority_signer_live\s*\(')
+                 ~ agent_board_test.call_re('_assert_signed_authority_signer_live'))
      ) x),
   null,
   'no signed wrapper is on one side of the authority/revalidation pairing without the other');
@@ -511,7 +517,12 @@ select is(
     where n.nspname = 'agent_board'
       and p.proname like 'signed\_%'
       and agent_board_test.stripped_body(p.oid)
-          ~ '\m(send_direct_message|send_multicast_message|post_board_message|_?append_task_event|create_tasking_delivery)\s*\('),
+          ~ agent_board_test.re(agent_board_test.call_frag('send_direct_message')
+                                || '|' || agent_board_test.call_frag('send_multicast_message')
+                                || '|' || agent_board_test.call_frag('post_board_message')
+                                || '|' || agent_board_test.call_frag('append_task_event')
+                                || '|' || agent_board_test.call_frag('_append_task_event')
+                                || '|' || agent_board_test.call_frag('create_tasking_delivery'))),
   'signed_append_task_event,signed_create_tasking_delivery,signed_post_board_message,'
   || 'signed_send_direct_message,signed_send_multicast_message',
   'the five exempt wrappers each perform a message/task write, which is why they are exempt');
@@ -524,7 +535,7 @@ select is(
      join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and p.proname like 'signed\_%'
-      and agent_board_test.stripped_body(p.oid) ~ '\m_signed_write_actor_id\s*\('),
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_signed_write_actor_id')),
   'signed_append_task_event,signed_create_tasking_delivery,signed_grant_board_role,'
   || 'signed_post_board_message,signed_send_direct_message,signed_send_multicast_message,'
   || 'signed_set_board_authority_ceiling',
@@ -532,7 +543,7 @@ select is(
 
 select ok(
   agent_board_test.stripped_body('agent_board._signed_write_actor_id(jsonb,jsonb,text)'::regprocedure)
-    !~ '\m(agents|agent_signing_keys)\M',
+    !~ agent_board_test.re(agent_board_test.qname_frag('agents') || '|' || agent_board_test.qname_frag('agent_signing_keys')),
   'the shared actor chokepoint reads no lifecycle table: the five message wrappers are unchanged');
 
 -- ===========================================================================
@@ -690,17 +701,17 @@ select is(
    ), edges as (
      select f.proname as caller, g.proname as callee
        from fns f join fns g on g.proname <> f.proname
-      where f.b ~ ('\m' || g.proname || '\s*\(')
+      where f.b ~ agent_board_test.call_re(g.proname)
    ), closure as (
      select proname as root, proname as reached from fns
      union
      select c.root, e.callee from closure c join edges e on e.caller = c.reached
    ), direct as (
      select proname,
-            (b ~ 'agent_board\.agents[^;]*for (update|share)') as locks_agents,
-            (b ~ 'agent_board\.board_memberships[^;]*for (update|share)'
-             or b ~ 'update agent_board\.board_memberships') as locks_memberships,
-            (b ~ '\magent_board\._lock_board_authority_ceiling\s*\(') as takes_advisory
+            (b ~ agent_board_test.row_lock_re('agents')) as locks_agents,
+            (b ~ agent_board_test.row_lock_re('board_memberships')
+             or b ~ agent_board_test.stmt_re('update', 'board_memberships')) as locks_memberships,
+            (b ~ agent_board_test.call_re('_lock_board_authority_ceiling')) as takes_advisory
        from fns
    ), agg as (
      select c.root,