@consiliency/agent-board-schema 1.53.0 → 1.55.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.53.0",
+  "version": "1.55.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.53.0",
+  "packageVersion": "1.55.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 151,
-  "aggregateSha256": "332c33f67f08d8bcdbf71ef2568ea03f6cd16ccdeaac4d1944259ab28012900c",
+  "migrationCount": 153,
+  "aggregateSha256": "90e7cdfd7208e11b31f1699482c22b96f2ad0d797eb9490c85098491881e95dc",
   "migrations": [
     {
       "order": 0,
@@ -1407,6 +1407,24 @@
       "sourceRef": "message-board",
       "bytes": 3993,
       "sha256": "7bcb993b9943cd7e6bd3777c90c32e9cb32e53415262f8c58a8d75678a449853"
+    },
+    {
+      "order": 151,
+      "id": "20261004000100_agent_board_callback_consumer_intent",
+      "filename": "20261004000100_agent_board_callback_consumer_intent.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 3403,
+      "sha256": "cd1815a58978261be143426eaac2dfccb6bb86b003487e4d1866aba60e7a6eb6"
+    },
+    {
+      "order": 152,
+      "id": "20261005000100_agent_board_enroll_token_single_use",
+      "filename": "20261005000100_agent_board_enroll_token_single_use.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 55964,
+      "sha256": "317d7b41432b36a2e38cc64940838e173e425014e3e256a96d832202b250e82d"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 151)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 153)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(151);
+    expect(manifest.migrationCount).toBe(153);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -337,6 +337,9 @@ describe('manifest integrity', () => {
       '20261002000100_agent_board_session_challenge_supersede.sql',
       // ROOMCONTRACT: owner/admin active roster RPC plus self-membership role.
       '20261003000100_agent_board_room_roster.sql',
+      '20261004000100_agent_board_callback_consumer_intent.sql',
+      // ENROLLTOKENSINGLEUSE (#521): a verified Portal token binds to at most one key.
+      '20261005000100_agent_board_enroll_token_single_use.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_atomic_fleet_onboarding.test.sql

@@ -156,7 +156,7 @@ select has_function(
 );
 select has_function(
   'agent_board', 'onboard_federated_fleet_agent',
-  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','timestamp with time zone','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
   'atomic fleet onboarding RPC exists'
 );
 select has_function('agent_board', '_redeem_fleet_invite_for_agent', array['text','uuid'], 'fleet-only redemption helper exists');
@@ -168,7 +168,7 @@ select has_function(
 );
 select function_privs_are(
   'agent_board', 'onboard_federated_fleet_agent',
-  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','timestamp with time zone','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
   'service_role', array['EXECUTE'],
   'only service_role can execute atomic onboarding'
 );
@@ -178,27 +178,27 @@ select function_privs_are(
   'fleet redemption helper is service-role-only'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%fleet_onboarding.v1%',
   'atomic onboarding returns the frozen contract version'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%for update%',
   'atomic onboarding catalog-pins row locking'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text)'::regprocedure, true)
     like '%pg_advisory_xact_lock%',
   'exact-key create-or-reuse is serialized by fingerprint'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%pg_advisory_xact_lock(hashtextextended(p_agent_public_key_fingerprint, 0))%',
   'composed onboarding serializes identity disposition by fingerprint'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text)'::regprocedure, true)
     like '%fleet invite requires atomic fleet onboarding%',
   'legacy enrollment rejects bounded invites before writes'
 );
@@ -208,42 +208,42 @@ select ok(
   'generic ROOMLINK redemption rejects bounded invites'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%phase_worker%worker%reviewer%reviewer%',
   'only bounded worker and reviewer role pairs are admitted'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%signing_key_id is distinct from v_enroll.signing_key_id%',
   'binding replay pins the exact proven signing key'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%v_inv.board_id is distinct from p_board_id%',
   'requested board is checked against the locked invite before writes'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%not v_completed_replay%v_inv.expires_at <= now()%v_inv.uses_count >= v_inv.max_uses%',
   'only a complete active replay may bypass expiry and exhaustion'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%v_inv.revoked_at is not null%a.status = ''active''%_grant_within_ceiling%',
   'revocation and current creator authority gate every fleet replay'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%a.id = any(array[v_inv.created_by_agent_id, v_existing_agent_id])%order by a.id for update%bm.agent_id = v_inv.created_by_agent_id%order by bm.id for update%_grant_within_ceiling%',
   'creator and enrolled principals lock in UUID order before creator authority'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%board_invite_redemptions red%order by red.id for update%bm.agent_id = v_enroll.agent_id%order by bm.id for update%select exists%',
   'complete-replay proof locks redemption and membership first'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%perform 1 from agent_board.fleet_harness_registrations%perform 1 from agent_board.fleet_repo_scopes%perform 1 from agent_board.fleet_machine_agents%',
   'every matching harness, repo, and binding history row is locked before reuse'
 );
@@ -263,12 +263,12 @@ select ok(
   'exact binding revocation locks the machine before the binding [SOLE PIN: no isolation spec discriminates this ordering -- measured against all 20]'
 );
 select ok(
-  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
-  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
   ),
   'atomic onboarding locks the machine before its enrolled agent [CONFIRMATORY: atomic_fleet_binding_revoke.spec and atomic_fleet_lifecycle_races.spec both discriminate the inversion]'
 );
@@ -368,12 +368,12 @@ select ok(
   'bounded invite mint locks and requires an active board'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%from agent_board.boards b%where b.id = v_inv.board_id%for update%v_board.status <> ''active''%',
   'atomic onboarding locks and requires the invite board to remain active'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text)'::regprocedure, true)
     like '%from auth.users u where u.id = v_owner_user_id for update%fleet_human_revocations%r.issuer = p_issuer and r.subject = p_subject%',
   'identity enrollment locks the human owner and rejects durable total revocation'
 );
@@ -404,7 +404,7 @@ select ok(
 select ok(
   not has_function_privilege(
     'authenticated',
-    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
     'EXECUTE'
   ),
   'authenticated CANNOT execute atomic onboarding'
@@ -412,7 +412,7 @@ select ok(
 select ok(
   not has_function_privilege(
     'anon',
-    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
     'EXECUTE'
   ),
   'anon CANNOT execute atomic onboarding'
@@ -439,10 +439,10 @@ select ok(
 -- Ordering, not mere presence: the lock has to be held BEFORE the authorization
 -- decision reads the (possibly absent) ceiling, and BEFORE the writer upserts it.
 select ok(
-  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
-  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
   ),
   'atomic onboarding holds the board ceiling lock before evaluating creator authority [REDUNDANT: implied by the advisory-before-boards and boards-before-ceiling-read claims below; an advisory moved between those two points violates the real ordering and still passes THIS one]'
 );
@@ -454,10 +454,10 @@ select ok(
 -- that catches the inversion; it is deliberately separate from the "before the
 -- ceiling read" assertion below, because that one passes in BOTH orders.
 select ok(
-  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
-  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
    where b.id = v_inv.board_id
    for update'
   ),
@@ -477,14 +477,14 @@ select ok(
 -- ordering nothing else states, because the boards lock is taken for board liveness,
 -- not for the ceiling. Pin the ordering so a refactor that moves it is not silent.
 select ok(
-  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
    where b.id = v_inv.board_id
    for update'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
    where b.id = v_inv.board_id
    for update'
-  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
   ),
   'atomic onboarding holds the boards row FOR UPDATE before it reads the ceiling [CONFIRMATORY FOR FLAT MASKS ONLY: agent_board_federated_lock_order_class.test.sql EC-3 fails by name on the comment/literal mutants, but it carries the SAME strip, so a NESTED block comment takes this assertion and EC-3 green together -- see #199 in the header; atomic_fleet_authority_races.spec pins the OUTCOME only when this lock and the advisory are BOTH gone, and atomic_fleet_board_archive.spec BLOCKS rather than failing by name]'
 );
@@ -553,7 +553,7 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     -- lock also closes this reader's exposure to the ceiling row's ABSENCE, one of the three
     -- 20260901000110 left explicitly undetermined.
     'agent_board.grant_board_role(uuid,uuid,text,uuid) => serialized',
-    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) => serialized'
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) => serialized'
   ]::text[],
   'every ceiling-authorization reader in pg_proc is declared with its serialization state'
 );
@@ -698,14 +698,14 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     'agent_board._revoke_agent_principal(uuid,uuid,text) [definer] => service_role',
     'agent_board.create_fleet_onboarding_invite(uuid,uuid,text,text,text,text,text,text,text,integer,timestamp with time zone,uuid,jsonb) [definer] => authenticated,service_role',
     'agent_board.enroll_federated_human(text,text,text,jsonb,text) [definer] => service_role',
-    'agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text) [definer] => service_role',
+    'agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text) [definer] => service_role',
     'agent_board.evaluate_fleet_sender_policy(uuid,uuid,uuid,uuid,text,uuid,boolean) [definer] => authenticated,service_role',
     -- Joined this class in #276: the live grant chokepoint now takes _lock_board_authority_ceiling
     -- (forced by the section-9 agents/board_memberships class in agent_board_signer_lifecycle.test.sql
     -- once the ledger gate made it lock both). Still authenticated,service_role — #276 removes
     -- authority from a revoked principal, it does not change who may call the RPC.
     'agent_board.grant_board_role(uuid,uuid,text,uuid) [definer] => authenticated,service_role',
-    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) [definer] => service_role',
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) [definer] => service_role',
     'agent_board.reactivate_fleet_machine(uuid,uuid,text) [definer] => service_role',
     'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb) [definer] => authenticated,service_role',
     'agent_board.revoke_human_subtree(uuid,uuid,text) [definer] => service_role',

package/tests/agent_board_atomic_fleet_onboarding_backfill.test.sql

@@ -83,7 +83,7 @@ select * from agent_board.enroll_federated_identity(
   'TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
   'raw_ed25519_base64url',
   'sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-  true, null, 'agent', ARRAY['board:read','board:send'], ARRAY[]::text[], null
+  true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:read','board:send'], ARRAY[]::text[], null
 );
 select is((select agent_id from _legacy_replay),
           '16200000-0000-0000-0000-000000000001'::uuid,
@@ -107,7 +107,7 @@ select throws_ok(
     '{"iss":"https://legacy.atomic.test","aud":["message-board","new-audience"],"uid":"legacy-complete"}'::jsonb,
     'atomic-backfill-complete','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
     'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-    true,null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
   '23505', null, 'changed normalized audience projection conflicts'
 );
 select throws_ok(
@@ -116,7 +116,7 @@ select throws_ok(
     '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"changed-subject"}'::jsonb,
     'atomic-backfill-complete','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
     'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-    true,null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
   '23505', null, 'changed stable subject conflicts'
 );
 select throws_ok(
@@ -125,7 +125,7 @@ select throws_ok(
     '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"legacy-complete"}'::jsonb,
     'changed-slug','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
     'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-    true,null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
   '23505', null, 'changed requested slug conflicts'
 );
 select throws_ok(
@@ -134,7 +134,7 @@ select throws_ok(
     '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"legacy-complete"}'::jsonb,
     'atomic-backfill-complete','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
     'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-    true,'new-actor','agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),'new-actor','agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
   '23505', null, 'changed independent actor subject conflicts'
 );