@consiliency/agent-board-schema 1.51.0 → 1.53.0

package/tests/agent_board_room_roster.test.sql

@@ -0,0 +1,466 @@
+-- ROOMCONTRACT pgTAP: owner/admin active roster RPC plus self-membership role.
+--
+-- Mutation controls (the assertion names are part of the evidence contract):
+--   * removing the owner/admin gate fails RC-32 (member denial);
+--   * filtering active state before latest-row selection fails RC-38 (stale row);
+--   * removing the id DESC tiebreak fails RC-39 (equal timestamp);
+--   * omitting role from v_board_memberships fails RC-12 (catalog ordinal);
+--   * removing the roster board predicate fails RC-37 (cross-board isolation).
+--
+-- HAND-COUNTED plan: RC-01..RC-44 = 44 assertions. The runner independently
+-- verifies the plan and emitted assertion counts, so a truncated file cannot pass.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(44);
+
+-- ---------------------------------------------------------------------------
+-- Catalog contract: exact signature, projection, posture, privileges, and view.
+-- ---------------------------------------------------------------------------
+select has_function(
+  'agent_board', 'list_board_members', array['uuid'],
+  'RC-01: list_board_members(uuid) exists');
+
+select is(
+  (select pg_get_function_identity_arguments(p.oid)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_board_members'),
+  'p_board_id uuid',
+  'RC-02: list_board_members has the exact named input argument');
+
+select is(
+  (select string_agg(u.arg_name || ' ' || format_type(u.type_oid, null), ', ' order by u.ord)
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     cross join lateral unnest(p.proallargtypes, p.proargnames, p.proargmodes)
+       with ordinality as u(type_oid, arg_name, arg_mode, ord)
+    where n.nspname = 'agent_board'
+      and p.proname = 'list_board_members'
+      and u.arg_mode = 't'),
+  'membership_id uuid, board_id uuid, agent_id uuid, handle text, display_name text, agent_type text, membership_state text, role text, created_by_agent_id uuid, membership_created_at timestamp with time zone, membership_updated_at timestamp with time zone',
+  'RC-03: list_board_members exposes only the frozen roster projection');
+
+select is(
+  (select l.lanname
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     join pg_language l on l.oid = p.prolang
+    where n.nspname = 'agent_board' and p.proname = 'list_board_members'),
+  'plpgsql',
+  'RC-04: list_board_members is implemented in plpgsql');
+
+select is(
+  (select p.provolatile::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_board_members'),
+  's',
+  'RC-05: list_board_members is STABLE');
+
+select is(
+  (select p.prosecdef
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_board_members'),
+  true,
+  'RC-06: list_board_members is SECURITY DEFINER');
+
+select is(
+  (select p.proconfig
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_board_members'),
+  array['search_path=agent_board, public']::text[],
+  'RC-07: list_board_members fixes search_path to agent_board, public');
+
+select is(
+  has_function_privilege('public', to_regprocedure('agent_board.list_board_members(uuid)'), 'EXECUTE'),
+  false,
+  'RC-08: PUBLIC cannot execute list_board_members');
+select is(
+  has_function_privilege('anon', to_regprocedure('agent_board.list_board_members(uuid)'), 'EXECUTE'),
+  false,
+  'RC-09: anon cannot execute list_board_members');
+select is(
+  has_function_privilege('authenticated', to_regprocedure('agent_board.list_board_members(uuid)'), 'EXECUTE'),
+  true,
+  'RC-10: authenticated can execute list_board_members');
+select is(
+  has_function_privilege('service_role', to_regprocedure('agent_board.list_board_members(uuid)'), 'EXECUTE'),
+  true,
+  'RC-11: service_role holds EXECUTE even though the user-facing gate denies its null actor');
+
+select is(
+  (select array_agg(c.column_name::text order by c.ordinal_position)
+     from information_schema.columns c
+    where c.table_schema = 'agent_board' and c.table_name = 'v_board_memberships'),
+  array[
+    'board_membership_id', 'board_id', 'board_slug', 'board_name', 'agent_id',
+    'agent_handle', 'agent_display_name', 'membership_state', 'created_by_agent_id',
+    'created_by_handle', 'left_at', 'created_at', 'updated_at', 'role'
+  ]::text[],
+  'RC-12: v_board_memberships preserves prior ordinals and appends role after updated_at');
+
+select is(
+  (select 'security_invoker=true' = any(coalesce(c.reloptions, '{}'::text[]))
+     from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = 'agent_board' and c.relname = 'v_board_memberships'),
+  true,
+  'RC-13: v_board_memberships remains security_invoker');
+
+select is(
+  has_table_privilege('authenticated', 'agent_board.v_board_memberships', 'SELECT'),
+  true,
+  'RC-14: authenticated retains SELECT on v_board_memberships');
+select is(
+  has_table_privilege('service_role', 'agent_board.v_board_memberships', 'SELECT'),
+  true,
+  'RC-15: service_role retains SELECT on v_board_memberships');
+
+select is(
+  (select count(*)::int
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+     cross join lateral unnest(coalesce(p.proargnames, '{}'::text[])) as a(arg_name)
+    where n.nspname = 'agent_board'
+      and p.proname = 'list_board_members'
+      and a.arg_name in (
+        'metadata', 'auth_user_id', 'owner_user_id', 'email', 'invite_code',
+        'token_hash', 'credential_id'
+      )),
+  0,
+  'RC-16: the roster contract exposes no metadata, auth, credential, email, or invite field');
+
+select (
+  to_regprocedure('agent_board.list_board_members(uuid)') is not null
+  and exists (
+    select 1
+      from information_schema.columns
+     where table_schema = 'agent_board'
+       and table_name = 'v_board_memberships'
+       and column_name = 'role'
+  )
+) as roomcontract_ready \gset
+
+\if :roomcontract_ready
+
+-- ---------------------------------------------------------------------------
+-- Fixture: two boards and distinct authority, denial, and history actors.
+-- ---------------------------------------------------------------------------
+create temp table _roomcontract_fixture (
+  board_a uuid,
+  board_b uuid,
+  creator uuid,
+  owner_agent uuid,
+  admin_agent uuid,
+  member_agent uuid,
+  observer_agent uuid,
+  stale_agent uuid,
+  tie_agent uuid,
+  board_b_agent uuid,
+  creator_user uuid,
+  owner_user uuid,
+  admin_user uuid,
+  member_user uuid,
+  observer_user uuid,
+  nonmember_user uuid,
+  suspended_user uuid
+) on commit drop;
+grant all on table _roomcontract_fixture to authenticated, service_role;
+
+do $$
+declare
+  v_creator_user uuid;
+  v_owner_user uuid;
+  v_admin_user uuid;
+  v_member_user uuid;
+  v_observer_user uuid;
+  v_nonmember_user uuid;
+  v_suspended_user uuid;
+begin
+  v_creator_user := public.ensure_github_user('rc-creator', 'rc-creator@example.test', 'rc-creator', 'RC Creator');
+  v_owner_user := public.ensure_github_user('rc-owner', 'rc-owner@example.test', 'rc-owner', 'RC Owner');
+  v_admin_user := public.ensure_github_user('rc-admin', 'rc-admin@example.test', 'rc-admin', 'RC Admin');
+  v_member_user := public.ensure_github_user('rc-member', 'rc-member@example.test', 'rc-member', 'RC Member');
+  v_observer_user := public.ensure_github_user('rc-observer', 'rc-observer@example.test', 'rc-observer', 'RC Observer');
+  v_nonmember_user := public.ensure_github_user('rc-nonmember', 'rc-nonmember@example.test', 'rc-nonmember', 'RC Nonmember');
+  v_suspended_user := public.ensure_github_user('rc-suspended', 'rc-suspended@example.test', 'rc-suspended', 'RC Suspended');
+
+  insert into agent_board.agents(
+    id, agent_type, handle, display_name, status, auth_user_id, owner_user_id
+  ) values
+    ('73000000-0000-4000-8000-000000000001', 'human', 'rc-creator', 'RC Creator', 'active', v_creator_user, v_creator_user),
+    ('73000000-0000-4000-8000-000000000002', 'human', 'rc-owner', 'RC Owner', 'active', v_owner_user, v_owner_user),
+    ('73000000-0000-4000-8000-000000000003', 'human', 'rc-admin', 'RC Admin', 'active', v_admin_user, v_admin_user),
+    ('73000000-0000-4000-8000-000000000004', 'agent', 'zulu-rc', 'Zulu RC', 'active', v_member_user, v_member_user),
+    ('73000000-0000-4000-8000-000000000005', 'agent', 'Alpha-rc', 'Alpha RC', 'active', null, null),
+    ('73000000-0000-4000-8000-000000000006', 'agent', 'same-rc', 'Same RC lower', 'active', null, null),
+    ('73000000-0000-4000-8000-000000000007', 'agent', 'SAME-rc', 'Same RC upper', 'active', null, null),
+    ('73000000-0000-4000-8000-000000000008', 'agent', 'rc-observer', 'RC Observer', 'active', v_observer_user, v_observer_user),
+    ('73000000-0000-4000-8000-000000000009', 'agent', 'rc-nonmember', 'RC Nonmember', 'active', v_nonmember_user, v_nonmember_user),
+    ('73000000-0000-4000-8000-00000000000a', 'agent', 'rc-suspended', 'RC Suspended', 'suspended', v_suspended_user, v_suspended_user),
+    ('73000000-0000-4000-8000-00000000000b', 'agent', 'rc-stale', 'RC Stale', 'active', null, null),
+    ('73000000-0000-4000-8000-00000000000c', 'agent', 'rc-tie', 'RC Tie', 'active', null, null),
+    ('73000000-0000-4000-8000-00000000000d', 'agent', 'rc-board-b', 'RC Board B', 'active', null, null);
+
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, status)
+  values
+    ('73010000-0000-4000-8000-000000000001', 'roomcontract-a', 'ROOMCONTRACT A', '73000000-0000-4000-8000-000000000001', 'active'),
+    ('73010000-0000-4000-8000-000000000002', 'roomcontract-b', 'ROOMCONTRACT B', '73000000-0000-4000-8000-000000000001', 'active');
+
+  -- Board A current active roster: owner, admin, four members, observer.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
+  values
+    ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000002', 'joined', 'owner', '73000000-0000-4000-8000-000000000001'),
+    ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000003', 'subscribed', 'admin', '73000000-0000-4000-8000-000000000002'),
+    ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000004', 'joined', 'member', '73000000-0000-4000-8000-000000000002'),
+    ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000005', 'joined', 'member', '73000000-0000-4000-8000-000000000002'),
+    ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000006', 'joined', 'member', '73000000-0000-4000-8000-000000000002'),
+    ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000007', 'joined', 'member', '73000000-0000-4000-8000-000000000002'),
+    ('73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000008', 'joined', 'observer', '73000000-0000-4000-8000-000000000002');
+
+  -- The board creator has historical owner standing but a newer departed row.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
+  ) values
+    ('73020000-0000-4000-8000-000000000001', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'joined', 'owner', '73000000-0000-4000-8000-000000000001', null, '2026-09-01 00:00:00+00', '2026-09-01 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000002', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-000000000001', 'left', 'member', '73000000-0000-4000-8000-000000000001', '2026-09-02 00:00:00+00', '2026-09-02 00:00:00+00', '2026-09-02 00:00:00+00');
+
+  -- Stale-row control: selecting active rows before choosing latest resurrects this actor.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
+  ) values
+    ('73020000-0000-4000-8000-000000000003', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000b', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-03 00:00:00+00', '2026-09-03 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000004', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000b', 'left', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00', '2026-09-04 00:00:00+00');
+
+  -- Total-order control: timestamps tie, so the larger removed-row id must win.
+  insert into agent_board.board_memberships(
+    id, board_id, agent_id, membership_state, role, created_by_agent_id, left_at, created_at, updated_at
+  ) values
+    ('73020000-0000-4000-8000-000000000010', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000c', 'joined', 'member', '73000000-0000-4000-8000-000000000002', null, '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00'),
+    ('73020000-0000-4000-8000-000000000011', '73010000-0000-4000-8000-000000000001', '73000000-0000-4000-8000-00000000000c', 'removed', 'member', '73000000-0000-4000-8000-000000000002', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00', '2026-09-05 00:00:00+00');
+
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
+  values
+    ('73010000-0000-4000-8000-000000000002', '73000000-0000-4000-8000-00000000000d', 'joined', 'member', '73000000-0000-4000-8000-000000000001');
+
+  insert into _roomcontract_fixture values (
+    '73010000-0000-4000-8000-000000000001',
+    '73010000-0000-4000-8000-000000000002',
+    '73000000-0000-4000-8000-000000000001',
+    '73000000-0000-4000-8000-000000000002',
+    '73000000-0000-4000-8000-000000000003',
+    '73000000-0000-4000-8000-000000000004',
+    '73000000-0000-4000-8000-000000000008',
+    '73000000-0000-4000-8000-00000000000b',
+    '73000000-0000-4000-8000-00000000000c',
+    '73000000-0000-4000-8000-00000000000d',
+    v_creator_user, v_owner_user, v_admin_user, v_member_user, v_observer_user,
+    v_nonmember_user, v_suspended_user
+  );
+end
+$$;
+
+-- ---------------------------------------------------------------------------
+-- Real authenticated posture and security-invoker self-view behavior.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select member_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+
+select is(current_setting('request.jwt.claim.role', true), 'authenticated',
+  'RC-17: authenticated probe carries request.jwt.claim.role=authenticated');
+select is(current_setting('request.jwt.claim.sub', true), (select member_user::text from _roomcontract_fixture),
+  'RC-18: authenticated probe carries request.jwt.claim.sub for the selected principal');
+select is(agent_board.current_agent_id(), (select member_agent from _roomcontract_fixture),
+  'RC-19: current_agent_id resolves the selected active member');
+reset role;
+select is(agent_board._is_service_role(), false,
+  'RC-20: the authenticated JWT posture is not classified as service_role');
+set local role authenticated;
+select is((select count(*)::int from agent_board.v_board_memberships), 1,
+  'RC-21: v_board_memberships remains self-scoped to one caller row');
+select is((select agent_id from agent_board.v_board_memberships), (select member_agent from _roomcontract_fixture),
+  'RC-22: the self-scoped membership row belongs to the caller');
+select is((select role from agent_board.v_board_memberships), 'member',
+  'RC-23: the appended self-membership role is readable');
+
+reset role;
+
+-- ---------------------------------------------------------------------------
+-- Owner/admin roster access and exact active current-row result semantics.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+
+select lives_ok(
+  (select format($q$select * from agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
+  'RC-24: an active owner may list the roster');
+select is(
+  (select count(*)::int from agent_board.list_board_members((select board_a from _roomcontract_fixture))),
+  7,
+  'RC-25: owner sees exactly seven current active members');
+select is(
+  (select jsonb_build_object(
+            'joined', count(*) filter (where membership_state = 'joined'),
+            'subscribed', count(*) filter (where membership_state = 'subscribed')
+          )
+     from agent_board.list_board_members((select board_a from _roomcontract_fixture))),
+  '{"joined": 6, "subscribed": 1}'::jsonb,
+  'RC-26: joined and subscribed rows are both included, and no other state is returned');
+select is(
+  (select count(*)::int
+     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
+    where board_id <> (select board_a from _roomcontract_fixture)),
+  0,
+  'RC-27: every returned row belongs to the requested board');
+select is(
+  (select array_agg(r.agent_id::text order by r.ordinality)
+     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
+       with ordinality as r),
+  array[
+    '73000000-0000-4000-8000-000000000002',
+    '73000000-0000-4000-8000-000000000003',
+    '73000000-0000-4000-8000-000000000005',
+    '73000000-0000-4000-8000-000000000006',
+    '73000000-0000-4000-8000-000000000007',
+    '73000000-0000-4000-8000-000000000004',
+    '73000000-0000-4000-8000-000000000008'
+  ]::text[],
+  'RC-28: roster order is owner, admin, member, observer then lower(handle), agent_id');
+select ok(
+  (select bool_and(
+            membership_id is not null
+            and board_id is not null
+            and agent_id is not null
+            and handle is not null
+            and display_name is not null
+            and agent_type is not null
+            and membership_state is not null
+            and role is not null
+            and created_by_agent_id is not null
+            and membership_created_at is not null
+            and membership_updated_at is not null
+          )
+     from agent_board.list_board_members((select board_a from _roomcontract_fixture))),
+  'RC-29: every frozen roster projection field is populated for the fixture');
+select ok(
+  (select bool_and(not (to_jsonb(r) ?| array[
+            'metadata', 'auth_user_id', 'owner_user_id', 'email', 'invite_code',
+            'token_hash', 'credential_id'
+          ]))
+     from agent_board.list_board_members((select board_a from _roomcontract_fixture)) r),
+  'RC-30: returned roster rows contain no metadata, auth, credential, email, or invite material');
+
+reset role;
+
+select set_config('request.jwt.claim.sub', (select admin_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select lives_ok(
+  (select format($q$select * from agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
+  'RC-31: an active admin may list the roster');
+reset role;
+
+-- ---------------------------------------------------------------------------
+-- Denials: member, observer, non-member, null actor, and creator exception.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select member_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-32: an ordinary active member cannot enumerate the roster');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select observer_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-33: an active observer cannot enumerate the roster');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select nonmember_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-34: an active non-member cannot enumerate the roster');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select suspended_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-35: a suspended principal resolves to a null actor and is denied');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select creator_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-36: board creator identity is not authority after its latest membership departed');
+
+reset role;
+
+-- ---------------------------------------------------------------------------
+-- Mutation-sensitive result controls, run as the owner.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select owner_user::text from _roomcontract_fixture), true);
+set local role authenticated;
+select is(
+  (select count(*)::int
+     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
+    where agent_id = (select board_b_agent from _roomcontract_fixture)),
+  0,
+  'RC-37: board B membership is absent from board A roster (cross-board isolation)');
+select is(
+  (select count(*)::int
+     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
+    where agent_id = (select stale_agent from _roomcontract_fixture)),
+  0,
+  'RC-38: latest left row excludes an older joined row (choose latest before filtering state)');
+select is(
+  (select count(*)::int
+     from agent_board.list_board_members((select board_a from _roomcontract_fixture))
+    where agent_id = (select tie_agent from _roomcontract_fixture)),
+  0,
+  'RC-39: equal created_at rows use id DESC, so the larger removed row excludes the older joined row');
+reset role;
+
+-- ---------------------------------------------------------------------------
+-- service_role is executable at the ACL layer but denied by the user-facing gate.
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+set local role service_role;
+select is(current_setting('request.jwt.claim.role', true), 'service_role',
+  'RC-40: service probe carries request.jwt.claim.role=service_role');
+select is(current_setting('request.jwt.claim.sub', true), '',
+  'RC-41: service probe carries an explicitly cleared request.jwt.claim.sub');
+select is(agent_board.current_agent_id(), null::uuid,
+  'RC-42: service_role has no current_agent_id in the user-facing path');
+select is(agent_board._is_service_role(), true,
+  'RC-43: the service probe is classified as service_role');
+select throws_ok(
+  (select format($q$select agent_board.list_board_members(%L::uuid)$q$, board_a) from _roomcontract_fixture),
+  '42501', 'only a board owner or admin may list board members',
+  'RC-44: service_role receives 42501 rather than bypassing the null-actor gate');
+reset role;
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+\else
+
+select * from skip(
+  28,
+  'ROOMCONTRACT runtime checks require list_board_members and v_board_memberships.role'
+);
+
+\endif
+
+select * from finish();
+rollback;

package/tests/agent_board_rowid.test.sql

@@ -48,7 +48,8 @@ statements as (
     proname,
     args,
     statement_ordinality::int as statement_ordinality,
-    statement
+    -- bound through `def` so the source-scan lint can follow `statement` to its producer
+    split.statement as statement
   from defs
   cross join lateral regexp_split_to_table(def, ';')
     with ordinality as split(statement, statement_ordinality)
@@ -57,33 +58,45 @@ select
   proname,
   args,
   statement_ordinality,
+  -- `from <rel>` through stmt_re: the verb is a word, the relation is schema-qualified
+  -- (`bare_ok => false`, as the hand-rolled `agent_board\.` was), case folded by the family
+  -- rather than by `~*`. The ORDER BY operands are `created_at` and `id`, qualified or bare
+  -- (col_ref_frag: `m.created_at desc` is the common spelling).
   case
-    when statement ~* 'from\s+agent_board\.board_memberships'
+    when statement ~ agent_board_test.stmt_re('from', 'board_memberships', false)
       then 'board_memberships'
-    when statement ~* 'from\s+agent_board\.tasks'
+    when statement ~ agent_board_test.stmt_re('from', 'tasks', false)
       then 'tasks'
-    when statement ~* 'from\s+agent_board\.messages'
+    when statement ~ agent_board_test.stmt_re('from', 'messages', false)
       then 'messages'
   end as source_relation,
   (select count(*)::int
-     from regexp_matches(statement, 'created_at\s+desc', 'gi')) as created_at_desc_count,
+     from regexp_matches(statement,
+            agent_board_test.re(agent_board_test.col_ref_frag('created_at')
+                                || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard()),
+            'g')) as created_at_desc_count,
   (select count(*)::int
      from regexp_matches(
        statement,
-       'created_at\s+desc\s*,\s*(?:[a-z_][a-z_0-9]*\.)?id\s+desc',
-       'gi'
+       agent_board_test.re(agent_board_test.col_ref_frag('created_at')
+                           || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard() || '\s*,\s*'
+                           || agent_board_test.col_ref_frag('id')
+                           || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard()),
+       'g'
      )) as total_order_count
 from statements
-where statement ~* 'order\s+by.*created_at\s+desc'
+where statement ~ agent_board_test.re('\m' || agent_board_test.ci_re('order by') || '\M.*'
+                                      || agent_board_test.col_ref_frag('created_at')
+                                      || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard())
   and (
-    statement ~* 'from\s+agent_board\.board_memberships'
+    statement ~ agent_board_test.stmt_re('from', 'board_memberships', false)
     or (
       proname = 'create_tasking_delivery'
-      and statement ~* 'from\s+agent_board\.tasks'
+      and statement ~ agent_board_test.stmt_re('from', 'tasks', false)
     )
     or (
       proname = 'post_board_message'
-      and statement ~* 'from\s+agent_board\.messages'
+      and statement ~ agent_board_test.stmt_re('from', 'messages', false)
     )
   );
 
@@ -493,9 +506,9 @@ select is(
   true,
   'control: fixture and structural block really runs as service_role');
 
--- 2. Catalog-derived inventory: seven membership readers plus the two task/message idempotency
--- readers. request_join_board joined the set in MBCONSENT-B(iii): its Option-3 active-member
--- no-op reads board_memberships with the created_at DESC + id DESC tiebreak like the others.
+-- 2. Catalog-derived inventory: eight membership readers plus the two task/message idempotency
+-- readers. request_join_board joined the set in MBCONSENT-B(iii), and list_board_members joined
+-- it in ROOMCONTRACT; both read board_memberships with the created_at DESC + id DESC tiebreak.
 select is(
   (select array_agg(proname order by proname)
      from _rowid_function_order_counts),
@@ -504,13 +517,14 @@ select is(
     '_upsert_board_membership_state',
     'create_tasking_delivery',
     'join_board',
+    'list_board_members',
     'list_board_pending_memberships',
     'post_board_message',
     'request_join_board',
     'resolve_board_request',
     'update_board_membership'
   ]::text[],
-  'live catalog exposes seven membership readers plus two task/message idempotency readers');
+  'live catalog exposes eight membership readers plus two task/message idempotency readers');
 
 -- 3-10. COUNT-EQUALITY, never substring containment.
 select is(
@@ -564,7 +578,7 @@ select is(
 
 -- 11. The live view is catalog-derived too; its last definer uses DROP + CREATE.
 with d as (
-  select pg_get_viewdef(c.oid, true) as def
+  select agent_board_test.stripped_viewdef(c.oid) as def
   from pg_class c
   join pg_namespace n on n.oid = c.relnamespace
   where n.nspname = 'agent_board'
@@ -572,12 +586,18 @@ with d as (
     and c.relkind = 'v'
 )
 select is(
-  (select count(*)::int from d, regexp_matches(def, 'created_at\s+desc', 'gi')),
+  (select count(*)::int from d, regexp_matches(def,
+     agent_board_test.re(agent_board_test.col_ref_frag('created_at')
+                         || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard()),
+     'g')),
   (select count(*)::int
      from d, regexp_matches(
        def,
-       'created_at\s+desc\s*,\s*(?:[a-z_][a-z_0-9]*\.)?id\s+desc',
-       'gi'
+       agent_board_test.re(agent_board_test.col_ref_frag('created_at')
+                           || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard() || '\s*,\s*'
+                           || agent_board_test.col_ref_frag('id')
+                           || '\s+' || agent_board_test.ci_re('desc') || agent_board_test.trail_guard()),
+       'g'
      )),
   'v_board_directory live catalog definition gives its membership read the id DESC tiebreak');