@consiliency/agent-board-schema 1.53.0 → 1.55.0

package/tests/agent_board_enroll_token_single_use.test.sql

@@ -0,0 +1,538 @@
+-- Consiliency/message-board#521 pgTAP: A VERIFIED PORTAL TOKEN ENROLLS AT MOST ONE KEY.
+--
+-- /enroll's proof-of-possession is the new key's signature over the token, so whoever
+-- holds a token can mint a fresh key and sign it again; the #176 replay path is keyed on
+-- the KEY and a fresh key walks past it. 20261005000100 binds each token (the sha256 of
+-- its RS256 signing input, computed by the Edge Function) to one key fingerprint, in ONE
+-- place: enroll_federated_identity, after its owner lock, before the found/not-found
+-- split. This file pins the behaviour (T1-T10), the placement, and the class (EC-T1..4).
+--
+-- Rule 3 throughout: every allow-side call is `lives_ok(...)` followed by a SEPARATE state
+-- check, never a bare `is((select ... from rpc(...)))` (#113 -- that form aborts the file
+-- instead of failing it). Every call expected to raise goes through pg_temp.try(), a
+-- BEGIN/EXCEPTION subtransaction that records '00000' when the call does NOT raise, so a
+-- vanished raise fails an assertion rather than matching an absent row. Result tables are
+-- declared up front, never CTAS'd from the call under test. Counts are scoped to this
+-- file's own fixtures (its issuer, its fingerprints, its token hashes).
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(66);
+
+-- ---------------------------------------------------------------------------
+-- Fixtures
+-- ---------------------------------------------------------------------------
+create temp table _v (name text primary key, val text) on commit drop;
+create temp table _err (label text primary key, state text, msg text) on commit drop;
+create temp table _r (
+  label text, agent_id uuid, auth_user_id uuid, provider_id text, signing_key_id uuid,
+  granted_scopes text[], key_id text, key_version int, agent_handle text,
+  invite_redeemed boolean
+) on commit drop;
+create temp table _f (label text, agent_id uuid, identity_disposition text) on commit drop;
+
+create function pg_temp.v(p_name text) returns text language sql stable as
+$$ select val from _v where name = p_name $$;
+
+-- A token identity: lowercase hex sha256, exactly what the Edge Function sends.
+create function pg_temp.tok(p_label text) returns text language sql immutable as
+$$ select encode(sha256(convert_to('tok521-test-token-' || p_label, 'UTF8')), 'hex') $$;
+
+-- The exact identity-route call, as SQL text. The hash and expiry are passed as SQL
+-- expressions so the T9 gate cases can pass NULL and malformed values through the same
+-- builder the allow-side cases use.
+create function pg_temp.enroll_sql(
+  p_sub text, p_slug text, p_key int, p_hash_sql text, p_exp_sql text default null
+) returns text language sql stable as
+$$
+  select format(
+    $q$select %L::text, * from agent_board.enroll_federated_identity(%L,'message-board',%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,%s,%s,null,'agent','{board:send}','{}')$q$,
+    p_slug, pg_temp.v('iss'), p_sub,
+    jsonb_build_object('iss', pg_temp.v('iss'), 'aud', 'message-board', 'sub', p_sub)::text,
+    p_slug, pg_temp.v('pub' || p_key), pg_temp.v('fp' || p_key),
+    p_hash_sql, coalesce(p_exp_sql, quote_literal(pg_temp.v('exp')) || '::timestamptz'))
+$$;
+
+-- The exact fleet-route call. `p_inv` names one of the fixture invites; its bounds fix the
+-- authorized handle, which is the slug.
+create function pg_temp.fleet_sql(
+  p_sub text, p_inv text, p_key int, p_hash_sql text, p_exp_sql text default null
+) returns text language sql stable as
+$$
+  select format(
+    $q$select %L::text, r.agent_id, r.identity_disposition from agent_board.onboard_federated_fleet_agent(%L,'message-board',%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,%s,%s,null,'agent','{board:send}','{}',%L,%L::uuid,%L::uuid,'codex','phase-loop','message-board','sha256:tok521-repo','worker','phase_worker',%L) r$q$,
+    p_inv, pg_temp.v('iss'), p_sub,
+    jsonb_build_object('iss', pg_temp.v('iss'), 'aud', 'message-board', 'sub', p_sub)::text,
+    pg_temp.v('handle_' || p_inv), pg_temp.v('pub' || p_key), pg_temp.v('fp' || p_key),
+    p_hash_sql, coalesce(p_exp_sql, quote_literal(pg_temp.v('exp')) || '::timestamptz'),
+    pg_temp.v('code_' || p_inv), pg_temp.v('board'), pg_temp.v('machine'),
+    pg_temp.v('handle_' || p_inv))
+$$;
+
+create function pg_temp.try(p_label text, p_sql text) returns void language plpgsql as
+$$
+begin
+  begin
+    execute p_sql;
+    insert into _err values (p_label, '00000', '(no error raised)');
+  exception when others then
+    insert into _err values (p_label, sqlstate, sqlerrm);
+  end;
+end
+$$;
+
+-- The fingerprint a token is bound to, or NULL.
+create function pg_temp.bound(p_label text) returns text language sql stable as
+$$ select agent_public_key_fingerprint from agent_board.enroll_token_uses where token_sha256 = pg_temp.tok(p_label) $$;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_creator uuid := gen_random_uuid();
+  v_board uuid;
+  v_domain uuid;
+  v_machine uuid;
+  v_code text;
+  v_pub text;
+  i int;
+  inv text;
+begin
+  insert into _v values
+    ('s', s), ('iss', 'https://tok521-' || s || '.test'),
+    ('suba', 'portal|tok521-a-' || s), ('subr', 'portal|tok521-r-' || s),
+    -- One fixed expiry for every allow-side call, whole seconds so the stored value
+    -- round-trips exactly (T1 compares it).
+    ('exp', (date_trunc('second', now()) + interval '1 hour')::text),
+    ('creator', v_creator::text);
+
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values (pg_temp.v('iss'), 'message-board', true, true, '{board:send}', '{}', '{agent}');
+
+  for i in 1..14 loop
+    v_pub := rtrim(translate(encode(gen_random_bytes(32), 'base64'), '+/', '-_'), '=');
+    insert into _v values ('pub' || i, v_pub), ('fp' || i, agent_board._raw_key_fingerprint(v_pub));
+  end loop;
+
+  -- Fleet fixture: creator, board, trust domain, machine, and one bounded invite per
+  -- fleet scenario (each invite fixes one authorized handle).
+  insert into agent_board.agents(id, agent_type, handle, display_name, status)
+  values (v_creator, 'agent', 'tok521-creator-' || s, 'Tok521 Creator', 'active');
+  select board_id into v_board from agent_board.create_board(
+    v_creator, 'tok521-board-' || s, 'Tok521 Board', '#521 pgTAP', '{}'::jsonb, 'private');
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values ('tok521-domain-' || s, 'Tok521 Domain', 'tailnet', v_creator, 'active', now())
+  returning id into v_domain;
+  insert into agent_board.fleet_machines(trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+                                         lifecycle_state, enrollment_source, enrolled_at)
+  values (v_domain, v_creator, 'claw', 'sha256:tok521-machine-' || s, 'active', 'portal', now())
+  returning id into v_machine;
+  insert into _v values ('board', v_board::text), ('machine', v_machine::text);
+
+  foreach inv in array array['f', 'x', 'y', 'g'] loop
+    select code into v_code from agent_board.create_fleet_onboarding_invite(
+      v_board, v_machine, 'codex', 'phase-loop', 'message-board', 'sha256:tok521-repo',
+      'worker', 'phase_worker', 'tok521-' || inv || '-' || s, 10, now() + interval '1 hour',
+      v_creator, '{}'::jsonb);
+    insert into _v values ('code_' || inv, v_code), ('handle_' || inv, 'tok521-' || inv || '-' || s);
+  end loop;
+end
+$$;
+
+-- ---------------------------------------------------------------------------
+-- T1 -- first use: the token binds to the key it enrolls
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r ' || pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-one-' || pg_temp.v('s'), 1, quote_literal(pg_temp.tok('T')))),
+  'T1: identity (T, K1) enrolls');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys where fingerprint = pg_temp.v('fp1')),
+  1, 'T1: exactly one K1 key');
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e
+    where e.agent_id = (select agent_id from _r where label like 'tok521-one-%')),
+  1, 'T1: exactly one audit row for the new agent');
+select is(pg_temp.bound('T'), pg_temp.v('fp1'), 'T1: the token row binds T to fp(K1)');
+select is(
+  (select token_expires_at from agent_board.enroll_token_uses where token_sha256 = pg_temp.tok('T')),
+  pg_temp.v('exp')::timestamptz, 'T1: the token row records the verified expiry');
+
+-- ---------------------------------------------------------------------------
+-- T2 -- same token, same key: an ordinary retry, resumption unchanged
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r ' || replace(pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-one-' || pg_temp.v('s'), 1, quote_literal(pg_temp.tok('T'))),
+     'select ''tok521-one-', 'select ''retry-tok521-one-')),
+  'T2: identity (T, K1) again lives (same-key retry)');
+select is(
+  (select agent_id from _r where label like 'retry-%'),
+  (select agent_id from _r where label like 'tok521-one-%'),
+  'T2: the retry resumes the SAME agent');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys where fingerprint = pg_temp.v('fp1')),
+  1, 'T2: still exactly one K1 key');
+select is(
+  (select count(*)::int from agent_board.enroll_token_uses where token_sha256 = pg_temp.tok('T')),
+  1, 'T2: still exactly one row for T');
+
+-- ---------------------------------------------------------------------------
+-- T3 -- same token, DIFFERENT key: MBT01, and nothing is created
+-- ---------------------------------------------------------------------------
+select pg_temp.try('T3', pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-three-' || pg_temp.v('s'), 2, quote_literal(pg_temp.tok('T'))));
+select is((select state from _err where label = 'T3'), 'MBT01',
+  'T3: identity (T, K2) after (T, K1) is refused with SQLSTATE MBT01');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys where fingerprint = pg_temp.v('fp2')),
+  0, 'T3: no K2 key was created');
+select is(
+  (select count(*)::int from agent_board.agents a where a.handle like 'tok521-three-%'),
+  0, 'T3: no new agent was created');
+select is(pg_temp.bound('T'), pg_temp.v('fp1'), 'T3: the token row still binds T to fp(K1)');
+
+-- ---------------------------------------------------------------------------
+-- T4 -- a NEW token enrolls a second key: the legitimate path
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r ' || pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-four-' || pg_temp.v('s'), 2, quote_literal(pg_temp.tok('T4')))),
+  'T4: identity (T'', K2) enrolls a second agent');
+select isnt(
+  (select agent_id from _r where label like 'tok521-four-%'),
+  (select agent_id from _r where label like 'tok521-one-%'),
+  'T4: it is a DIFFERENT agent');
+select is(pg_temp.bound('T4'), pg_temp.v('fp2'), 'T4: the new token binds to fp(K2)');
+
+-- ---------------------------------------------------------------------------
+-- T5 -- one KEY may consume many tokens (#176 retry after a lost response), but
+-- binding covers resumption: a token that resumed K1 cannot then create K3
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _r ' || replace(pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-one-' || pg_temp.v('s'), 1, quote_literal(pg_temp.tok('T5'))),
+     'select ''tok521-one-', 'select ''t5-tok521-one-')),
+  'T5: (T'''', K1) -- an already-enrolled key under a NEW token -- lives');
+select is(
+  (select agent_id from _r where label like 't5-%'),
+  (select agent_id from _r where label like 'tok521-one-%'),
+  'T5: it resumes the same agent');
+select is(pg_temp.bound('T5'), pg_temp.v('fp1'), 'T5: and binds the new token to fp(K1)');
+select pg_temp.try('T5-K3', pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-five-' || pg_temp.v('s'), 3, quote_literal(pg_temp.tok('T5'))));
+select is((select state from _err where label = 'T5-K3'), 'MBT01',
+  'T5: (T'''', K3) is refused MBT01 -- a token that RESUMED a key is bound as firmly as one that created it');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys where fingerprint = pg_temp.v('fp3')),
+  0, 'T5: no K3 key was created');
+
+-- ---------------------------------------------------------------------------
+-- T6 -- the gates around the bind still run for the same key
+-- ---------------------------------------------------------------------------
+-- Two different claims, kept apart because they prove different things. The human-revocation
+-- gate runs BEFORE the bind, so its 42501 shows only that the bind did not displace it. The
+-- key-revoked case is the fall-through proof: resumption gate (b) runs AFTER the bind, and a
+-- same-key bind that returned early would skip it (T7 is the same proof for gate (c)).
+select lives_ok(
+  (select 'insert into _r ' || pg_temp.enroll_sql(pg_temp.v('subr'), 'tok521-six-' || pg_temp.v('s'), 6, quote_literal(pg_temp.tok('T6')))),
+  'T6: setup -- (T6, K6) enrolls for the subject about to be revoked');
+insert into agent_board.fleet_human_revocations(issuer, subject, revoked_by_agent_id, revocation_reason)
+values (pg_temp.v('iss'), pg_temp.v('subr'), pg_temp.v('creator')::uuid, '#521 pgTAP T6');
+select pg_temp.try('T6-revoked-human', pg_temp.enroll_sql(pg_temp.v('subr'), 'tok521-six-' || pg_temp.v('s'), 6, quote_literal(pg_temp.tok('T6'))));
+select is((select state from _err where label = 'T6-revoked-human'), '42501',
+  'T6: the revocation gate BEFORE the bind still refuses the same (T6, K6) once the human is revoked (42501)');
+
+select lives_ok(
+  (select 'insert into _r ' || pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-seven-' || pg_temp.v('s'), 7, quote_literal(pg_temp.tok('T7')))),
+  'T6: setup -- (T7, K7) enrolls a key about to be revoked');
+update agent_board.agent_signing_keys
+   set status = 'revoked', proof_state = 'revoked', revoked_at = now()
+ where fingerprint = pg_temp.v('fp7');
+select pg_temp.try('T6-revoked-key', pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-seven-' || pg_temp.v('s'), 7, quote_literal(pg_temp.tok('T7'))));
+select ok(
+  (select state = '23505' and msg like '%is not resumable%' from _err where label = 'T6-revoked-key'),
+  'T6: the same (T7, K7) after its key is revoked is refused 23505 NOT RESUMABLE (the bind no-op did not return early)');
+
+-- ---------------------------------------------------------------------------
+-- T7 -- fall-through, frozen contract: a stamped enrollment still refuses drift
+-- ---------------------------------------------------------------------------
+select pg_temp.try('T7', pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-one-renamed-' || pg_temp.v('s'), 1, quote_literal(pg_temp.tok('T'))));
+select ok(
+  (select state = '23505' and msg like '%frozen identity contract%' from _err where label = 'T7'),
+  'T7: (T, K1) with a DIFFERENT slug still raises the 23505 frozen-contract refusal');
+
+-- ---------------------------------------------------------------------------
+-- T8 -- the fleet route, and both directions across routes
+-- ---------------------------------------------------------------------------
+select lives_ok(
+  (select 'insert into _f ' || pg_temp.fleet_sql(pg_temp.v('suba'), 'f', 4, quote_literal(pg_temp.tok('Tf')))),
+  'T8: fleet (Tf, K4) onboards');
+select is((select identity_disposition from _f where label = 'f'), 'created',
+  'T8: fleet (Tf, K4) created its identity');
+select pg_temp.try('T8-fleet-K5', pg_temp.fleet_sql(pg_temp.v('suba'), 'f', 5, quote_literal(pg_temp.tok('Tf'))));
+select is((select state from _err where label = 'T8-fleet-K5'), 'MBT01',
+  'T8: fleet (Tf, K5) after fleet (Tf, K4) is refused MBT01');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys where fingerprint = pg_temp.v('fp5')),
+  0, 'T8: the refused onboarding left no K5 key');
+select is(
+  (select count(*)::int from agent_board.fleet_machine_agents b where b.machine_id = pg_temp.v('machine')::uuid),
+  1, 'T8: the machine carries exactly one binding (K4''s), none for K5');
+select is(
+  (select count(*)::int from agent_board.fleet_harness_registrations h where h.machine_id = pg_temp.v('machine')::uuid),
+  1, 'T8: exactly one harness registration on the machine (K4''s, reused -- none added by the refused call)');
+select is(
+  (select count(*)::int from agent_board.fleet_repo_scopes r
+     join agent_board.fleet_harness_registrations h on h.id = r.harness_registration_id
+    where h.machine_id = pg_temp.v('machine')::uuid),
+  1, 'T8: exactly one repo scope on the machine (none added by the refused call)');
+
+select lives_ok(
+  (select 'insert into _r ' || pg_temp.enroll_sql(pg_temp.v('suba'), pg_temp.v('handle_x'), 8, quote_literal(pg_temp.tok('Tx')))),
+  'T8: identity (Tx, K8) enrolls');
+select lives_ok(
+  (select 'insert into _f ' || pg_temp.fleet_sql(pg_temp.v('suba'), 'x', 8, quote_literal(pg_temp.tok('Tx')))),
+  'T8: fleet (Tx, K8) after identity (Tx, K8) lives -- same token, same key, across routes');
+select is((select identity_disposition from _f where label = 'x'), 'reused',
+  'T8: and it REUSES the identity-route identity');
+select pg_temp.try('T8-cross-K9', pg_temp.fleet_sql(pg_temp.v('suba'), 'x', 9, quote_literal(pg_temp.tok('Tx'))));
+select is((select state from _err where label = 'T8-cross-K9'), 'MBT01',
+  'T8: fleet (Tx, K9) after identity (Tx, K8) is refused MBT01');
+
+select lives_ok(
+  (select 'insert into _f ' || pg_temp.fleet_sql(pg_temp.v('suba'), 'y', 10, quote_literal(pg_temp.tok('Ty')))),
+  'T8: fleet (Ty, K10) onboards');
+select lives_ok(
+  (select 'insert into _r ' || pg_temp.enroll_sql(pg_temp.v('suba'), pg_temp.v('handle_y'), 10, quote_literal(pg_temp.tok('Ty')))),
+  'T8: identity (Ty, K10) after fleet (Ty, K10) lives');
+select is(
+  (select agent_id from _r where label = pg_temp.v('handle_y')),
+  (select agent_id from _f where label = 'y'),
+  'T8: and resumes the fleet-created identity');
+
+-- ---------------------------------------------------------------------------
+-- T9 -- the bind's input gates, on BOTH routes, and nothing is written
+-- ---------------------------------------------------------------------------
+select pg_temp.try('T9-i-null-hash',  pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-nine-' || pg_temp.v('s'), 11, 'null'));
+select pg_temp.try('T9-i-nonhex',     pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-nine-' || pg_temp.v('s'), 11, quote_literal(repeat('g', 64))));
+select pg_temp.try('T9-i-63',         pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-nine-' || pg_temp.v('s'), 11, quote_literal(left(pg_temp.tok('T9'), 63))));
+select pg_temp.try('T9-i-null-exp',   pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-nine-' || pg_temp.v('s'), 11, quote_literal(pg_temp.tok('T9')), 'null'));
+select pg_temp.try('T9-i-expired',    pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-nine-' || pg_temp.v('s'), 11, quote_literal(pg_temp.tok('T9')), 'now()'));
+select pg_temp.try('T9-f-null-hash',  pg_temp.fleet_sql(pg_temp.v('suba'), 'g', 11, 'null'));
+select pg_temp.try('T9-f-nonhex',     pg_temp.fleet_sql(pg_temp.v('suba'), 'g', 11, quote_literal(repeat('g', 64))));
+select pg_temp.try('T9-f-63',         pg_temp.fleet_sql(pg_temp.v('suba'), 'g', 11, quote_literal(left(pg_temp.tok('T9'), 63))));
+select pg_temp.try('T9-f-null-exp',   pg_temp.fleet_sql(pg_temp.v('suba'), 'g', 11, quote_literal(pg_temp.tok('T9')), 'null'));
+select pg_temp.try('T9-f-expired',    pg_temp.fleet_sql(pg_temp.v('suba'), 'g', 11, quote_literal(pg_temp.tok('T9')), 'now()'));
+select is(
+  (select string_agg(label || '=' || state, ' ' order by label) from _err where label like 'T9-i-%'),
+  'T9-i-63=22023 T9-i-expired=22023 T9-i-nonhex=22023 T9-i-null-exp=22023 T9-i-null-hash=22023',
+  'T9: identity route -- null hash, non-hex hash, 63-char hash, null expiry and expiry <= now() each raise 22023');
+select is(
+  (select string_agg(label || '=' || state, ' ' order by label) from _err where label like 'T9-f-%'),
+  'T9-f-63=22023 T9-f-expired=22023 T9-f-nonhex=22023 T9-f-null-exp=22023 T9-f-null-hash=22023',
+  'T9: fleet route -- the same five inputs each raise 22023');
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys where fingerprint = pg_temp.v('fp11'))
+  + (select count(*)::int from agent_board.enroll_token_uses where token_sha256 = pg_temp.tok('T9')),
+  0, 'T9: none of the ten refused calls wrote a key or a token row');
+
+-- ---------------------------------------------------------------------------
+-- T10 -- the bounded prune: 50 per call, and never a row inside the 1-hour margin
+-- ---------------------------------------------------------------------------
+insert into agent_board.enroll_token_uses(token_sha256, agent_public_key_fingerprint, token_expires_at)
+select pg_temp.tok('old-' || i), 'sha256:tok521-prune', now() - interval '2 hours' - make_interval(secs => i)
+  from generate_series(1, 60) i;
+insert into agent_board.enroll_token_uses(token_sha256, agent_public_key_fingerprint, token_expires_at)
+values (pg_temp.tok('recent'), 'sha256:tok521-prune', now() - interval '30 minutes');
+select lives_ok(
+  (select 'insert into _r ' || pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-ten-' || pg_temp.v('s'), 12, quote_literal(pg_temp.tok('T10')))),
+  'T10: one enrollment runs the prune');
+select is(
+  (select count(*)::int from agent_board.enroll_token_uses
+    where token_sha256 in (select pg_temp.tok('old-' || i) from generate_series(1, 60) i)),
+  10, 'T10: exactly 50 of the 60 rows expired more than an hour ago were deleted');
+-- A second enrollment drains the 10 old rows left over, and the recent row is then the ONLY
+-- expired row within reach of the batch. The first call alone cannot pin the margin: with 60
+-- older rows ahead of it in expiry order, a 50-row batch never reaches the recent row even
+-- when the margin is gone (measured: removing the margin left the first call's assertions
+-- green). This is the call where a missing margin deletes it.
+select lives_ok(
+  (select 'insert into _r ' || pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-ten-b-' || pg_temp.v('s'), 13, quote_literal(pg_temp.tok('T10b')))),
+  'T10: a second enrollment runs the prune again');
+select is(
+  (select count(*)::int from agent_board.enroll_token_uses
+    where token_sha256 in (select pg_temp.tok('old-' || i) from generate_series(1, 60) i)),
+  0, 'T10: the second prune drained the remaining 10 old rows');
+select is(
+  (select count(*)::int from agent_board.enroll_token_uses where token_sha256 = pg_temp.tok('recent')),
+  1, 'T10: the row expired only 30 minutes ago is kept even when the batch reaches it (the clock-skew margin)');
+
+-- ---------------------------------------------------------------------------
+-- T11 -- the bind decides expiry at the time it RUNS, not when its transaction began
+-- ---------------------------------------------------------------------------
+-- now() is fixed at transaction start; a real request can start, wait on the owner lock for
+-- as long as another enrollment holds it, and only then bind. This file's transaction began
+-- long before this point (and sleeps to make the margin certain), so now() < exp <
+-- clock_timestamp() below: the state of a request whose token expired while it waited. With
+-- a now()-based refusal it would bind; had the prune meanwhile removed the token's old row,
+-- that would be a second key under one token (#524 round 1).
+select pg_sleep(0.2);
+select pg_temp.try('T11-late', pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-eleven-' || pg_temp.v('s'), 14,
+  quote_literal(pg_temp.tok('T11')), $$now() + interval '100 milliseconds'$$));
+select ok(
+  (select state = '22023' and msg like '%has expired%' from _err where label = 'T11-late'),
+  'T11: a token whose exp passed while the request waited (now() < exp <= clock_timestamp()) is refused 22023 expired');
+select is(
+  (select count(*)::int from agent_board.enroll_token_uses where token_sha256 = pg_temp.tok('T11')),
+  0, 'T11: and no row was written for it');
+-- The prune reads the SAME clock, so its window matches the refusal: a row whose exp is
+-- between now() - 1h and clock_timestamp() - 1h is one the refusal already rejects, and it
+-- is deleted. A now()-based cutoff would keep it (harmless, but the two clocks would differ).
+insert into agent_board.enroll_token_uses(token_sha256, agent_public_key_fingerprint, token_expires_at)
+values (pg_temp.tok('T11-prune'), 'sha256:tok521-prune', now() - interval '1 hour' + interval '100 milliseconds');
+select lives_ok(
+  (select 'insert into _r ' || pg_temp.enroll_sql(pg_temp.v('suba'), 'tok521-eleven-b-' || pg_temp.v('s'), 14, quote_literal(pg_temp.tok('T11b')))),
+  'T11: an enrollment runs the prune');
+select is(
+  (select count(*)::int from agent_board.enroll_token_uses where token_sha256 = pg_temp.tok('T11-prune')),
+  0, 'T11: the prune cutoff is clock_timestamp() - 1 hour, the same clock the refusal uses');
+
+-- ---------------------------------------------------------------------------
+-- PLACEMENT -- the bind sits after the owner lock and before the found/not-found split
+-- ---------------------------------------------------------------------------
+-- Over stripped_body(), so a comment cannot satisfy it. Above the owner lock the identity
+-- route deadlocks against the fleet route (enroll_token_placement.spec shows the runtime
+-- half); below `for update of a, k` it would cover creation only, not resumption.
+select ok(
+  (with b as (
+     select lower(agent_board_test.stripped_body(p.oid)) as body
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board' and p.proname = 'enroll_federated_identity')
+   select count(*) = 1
+      and bool_and(strpos(body, 'from auth.users u where u.id = v_owner_user_id for update') > 0
+      and strpos(body, 'from auth.users u where u.id = v_owner_user_id for update')
+          < strpos(body, 'perform agent_board._enroll_token_bind(')
+      and strpos(body, 'perform agent_board._enroll_token_bind(')
+          < strpos(body, 'for update of a, k'))
+     from b),
+  'PLACEMENT: enroll_federated_identity binds the token AFTER its owner lock and BEFORE the found/not-found split');
+
+-- ---------------------------------------------------------------------------
+-- EC-T1 -- every API-executable route that accepts a key fingerprint carries the token,
+-- enumerated from pg_proc
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proargnames && array['p_agent_public_key_fingerprint']
+      and (has_function_privilege('anon', p.oid, 'EXECUTE')
+        or has_function_privilege('authenticated', p.oid, 'EXECUTE')
+        or has_function_privilege('service_role', p.oid, 'EXECUTE'))),
+  'enroll_federated_identity, onboard_federated_fleet_agent',
+  'EC-T1: exactly two API-executable routes accept a key fingerprint, one overload each (pg_proc-derived)');
+select is(
+  (select string_agg(p.proname || ':' || (
+            array_position(p.proargnames, 'p_token_sha256') is not null
+        and array_position(p.proargnames, 'p_token_expires_at') is not null
+        and array_position(p.proargnames, 'p_token_sha256') <= p.pronargs - p.pronargdefaults
+        and array_position(p.proargnames, 'p_token_expires_at') <= p.pronargs - p.pronargdefaults)::text,
+          ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proargnames && array['p_agent_public_key_fingerprint']
+      and (has_function_privilege('anon', p.oid, 'EXECUTE')
+        or has_function_privilege('authenticated', p.oid, 'EXECUTE')
+        or has_function_privilege('service_role', p.oid, 'EXECUTE'))),
+  'enroll_federated_identity:true, onboard_federated_fleet_agent:true',
+  'EC-T1: each carries p_token_sha256 and p_token_expires_at with NO default');
+
+-- ---------------------------------------------------------------------------
+-- EC-T2 -- the signing-key creator set, each member justified POSITIVELY
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.prokind = 'f'
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into', 'agent_signing_keys')),
+  '_enroll_federated_identity_once, mint_delegated_child',
+  'EC-T2: exactly two functions insert signing keys (the EC-2 form)');
+select is(
+  (select string_agg(r || '=' || has_function_privilege(r, p.oid, 'EXECUTE')::text, ' ' order by r)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace,
+          unnest(array['anon', 'authenticated', 'service_role']) r
+    where n.nspname = 'agent_board' and p.proname = '_enroll_federated_identity_once'),
+  'anon=false authenticated=false service_role=false',
+  'EC-T2: _enroll_federated_identity_once is EXECUTE-able by no API role');
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname <> '_enroll_federated_identity_once'
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_enroll_federated_identity_once')),
+  'enroll_federated_identity',
+  'EC-T2: _enroll_federated_identity_once''s only caller is enroll_federated_identity');
+-- Counted per CALL SITE, not per calling function: a second bind call inside
+-- enroll_federated_identity is a no-op under fall-through, so only this count sees it.
+select is(
+  (select string_agg(p.proname || '=' || regexp_count(agent_board_test.stripped_body(p.oid), agent_board_test.call_re('_enroll_token_bind')), ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname <> '_enroll_token_bind'
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_enroll_token_bind')),
+  'enroll_federated_identity=1',
+  'EC-T2: _enroll_token_bind has exactly ONE call site in the schema, in enroll_federated_identity (one guard site)');
+select ok(
+  (select bool_and('p_root_agent_id' = any(p.proargnames)
+               and not (p.proargnames && array['p_issuer', 'p_subject', 'p_human_identity_claim']))
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'mint_delegated_child'),
+  'EC-T2: mint_delegated_child''s authority input is a parent agent, not a Portal token');
+
+-- ---------------------------------------------------------------------------
+-- EC-T3 -- the token table and its only writer are unreachable from the API
+-- ---------------------------------------------------------------------------
+select is(
+  (select count(*)::int
+     from unnest(array['anon', 'authenticated', 'service_role']) r,
+          unnest(array['SELECT', 'INSERT', 'UPDATE', 'DELETE']) pr
+    where has_table_privilege(r, 'agent_board.enroll_token_uses', pr)),
+  0, 'EC-T3: no API role holds SELECT/INSERT/UPDATE/DELETE on enroll_token_uses');
+select ok(
+  (select relrowsecurity from pg_class where oid = 'agent_board.enroll_token_uses'::regclass),
+  'EC-T3: RLS is enabled on enroll_token_uses');
+select is(
+  (select string_agg(a.attname, ',')
+     from pg_constraint c
+     join pg_attribute a on a.attrelid = c.conrelid and a.attnum = any(c.conkey)
+    where c.conrelid = 'agent_board.enroll_token_uses'::regclass and c.contype = 'p'),
+  'token_sha256', 'EC-T3: the primary key (the fail-closed backstop) is on token_sha256');
+select is(
+  (select string_agg(r || '=' || has_function_privilege(r, p.oid, 'EXECUTE')::text, ' ' order by r)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace,
+          unnest(array['anon', 'authenticated', 'service_role']) r
+    where n.nspname = 'agent_board' and p.proname = '_enroll_token_bind'),
+  'anon=false authenticated=false service_role=false',
+  'EC-T3: _enroll_token_bind is EXECUTE-able by no API role');
+
+-- ---------------------------------------------------------------------------
+-- EC-T4 -- the recreated and new functions kept their comment, owner and ACL
+-- ---------------------------------------------------------------------------
+select is(
+  (select string_agg(p.proname, ', ' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname in ('enroll_federated_identity', 'onboard_federated_fleet_agent',
+                        '_enroll_federated_identity_once', '_enroll_token_bind')
+      and obj_description(p.oid, 'pg_proc') like '%#521%'
+      and p.proowner = (select q.proowner from pg_proc q join pg_namespace m on m.oid = q.pronamespace
+                         where m.nspname = 'agent_board' and q.proname = '_enroll_federated_identity_once')),
+  '_enroll_federated_identity_once, _enroll_token_bind, enroll_federated_identity, onboard_federated_fleet_agent',
+  'EC-T4: all four carry a #521 comment and the same owner as _enroll_federated_identity_once');
+select is(
+  (select string_agg(p.proname || ':' || r || '=' || has_function_privilege(r, p.oid, 'EXECUTE')::text, ' ' order by p.proname, r)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace,
+          unnest(array['anon', 'authenticated', 'public', 'service_role']) r
+    where n.nspname = 'agent_board'
+      and p.proname in ('enroll_federated_identity', 'onboard_federated_fleet_agent')),
+  'enroll_federated_identity:anon=false enroll_federated_identity:authenticated=false enroll_federated_identity:public=false enroll_federated_identity:service_role=true '
+  || 'onboard_federated_fleet_agent:anon=false onboard_federated_fleet_agent:authenticated=false onboard_federated_fleet_agent:public=false onboard_federated_fleet_agent:service_role=true',
+  'EC-T4: the recreated RPCs are EXECUTE-able by service_role only (DROP discarded the ACL; it was restated)');
+
+select * from finish();
+rollback;

package/tests/agent_board_enrollment_audit_content.test.sql

@@ -31,7 +31,7 @@ begin
   select e.agent_id into v_agent
     from agent_board.enroll_federated_identity(
       'https://mock-portal-'||s||'.test', 'message-board', 'portal|'||s,
-      v_claim, 'acfx-'||s, v_pub, 'raw_ed25519_base64url', v_fp, true, null, 'human', '{board:send}', '{board:x}') e;
+      v_claim, 'acfx-'||s, v_pub, 'raw_ed25519_base64url', v_fp, true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'human', '{board:send}', '{board:x}') e;
 
   insert into _acfx values (v_agent, v_claim);
 end
@@ -120,10 +120,10 @@ begin
   values ('https://rls-portal-'||s||'.test','message-board',true,true,'{board:send}','{board:x}','{agent,human}');
   select e.agent_id, e.auth_user_id into v_a_agent, v_a_user
     from agent_board.enroll_federated_identity('https://rls-portal-'||s||'.test','message-board','portal|a-'||s,
-      jsonb_build_object('iss','https://rls-portal-'||s||'.test','aud','message-board','sub','portal|a-'||s,'name','A'), 'rls-a-'||s, v_pub_a,'raw_ed25519_base64url',v_fp_a,true,null,'human','{board:send}','{board:x}') e;
+      jsonb_build_object('iss','https://rls-portal-'||s||'.test','aud','message-board','sub','portal|a-'||s,'name','A'), 'rls-a-'||s, v_pub_a,'raw_ed25519_base64url',v_fp_a,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'human','{board:send}','{board:x}') e;
   select e.agent_id into v_b_agent
     from agent_board.enroll_federated_identity('https://rls-portal-'||s||'.test','message-board','portal|b-'||s,
-      jsonb_build_object('iss','https://rls-portal-'||s||'.test','aud','message-board','sub','portal|b-'||s,'name','B'), 'rls-b-'||s, v_pub_b,'raw_ed25519_base64url',v_fp_b,true,null,'human','{board:send}','{board:x}') e;
+      jsonb_build_object('iss','https://rls-portal-'||s||'.test','aud','message-board','sub','portal|b-'||s,'name','B'), 'rls-b-'||s, v_pub_b,'raw_ed25519_base64url',v_fp_b,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'human','{board:send}','{board:x}') e;
   insert into _rls values (v_a_agent, v_a_user, v_b_agent);
 end
 $$;

package/tests/agent_board_federated_lock_order_class.test.sql

@@ -321,7 +321,7 @@ select lives_ok(
        'https://lockorder194.test', 'message-board', 'sub-lo194',
        jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
        'lo194-a', public.test_pubkey('lo194-k1'), 'raw_ed25519_base64url',
-       public.test_key_fingerprint('lo194-k1'), true, null, 'agent',
+       public.test_key_fingerprint('lo194-k1'), true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
        ARRAY[]::text[], ARRAY[]::text[], 'lo194-code-1') $$,
   'R-1: fresh federated enrollment with a usable invite succeeds');
 select is((select invite_redeemed from _e1), true,
@@ -342,7 +342,7 @@ select lives_ok(
        'https://lockorder194.test', 'message-board', 'sub-lo194',
        jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
        'lo194-b', public.test_pubkey('lo194-k2'), 'raw_ed25519_base64url',
-       public.test_key_fingerprint('lo194-k2'), true, null, 'agent',
+       public.test_key_fingerprint('lo194-k2'), true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
        ARRAY[]::text[], ARRAY[]::text[], 'lo194-no-such-code') $$,
   'R-4: an unusable invite code still enrolls (soft-honor preserved)');
 select is((select invite_redeemed from _e2), false,
@@ -368,7 +368,7 @@ select throws_ok(
        'https://lockorder194.test', 'message-board', 'sub-lo194',
        jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
        'lo194-c', public.test_pubkey('lo194-k3'), 'raw_ed25519_base64url',
-       public.test_key_fingerprint('lo194-k3'), true, null, 'agent',
+       public.test_key_fingerprint('lo194-k3'), true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
        ARRAY[]::text[], ARRAY[]::text[], 'lo194-code-2') $$,
   '40001', null,
   'R-6: class 40 during the CREATE-path redemption propagates to the caller');
@@ -380,7 +380,7 @@ select throws_ok(
        'https://lockorder194.test', 'message-board', 'sub-lo194',
        jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
        'lo194-a', public.test_pubkey('lo194-k1'), 'raw_ed25519_base64url',
-       public.test_key_fingerprint('lo194-k1'), true, null, 'agent',
+       public.test_key_fingerprint('lo194-k1'), true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
        ARRAY[]::text[], ARRAY[]::text[], 'lo194-code-3') $$,
   '40001', null,
   'R-7: class 40 during the REPLAY-path redemption propagates to the caller');
@@ -395,7 +395,7 @@ select lives_ok(
        'https://lockorder194.test', 'message-board', 'sub-lo194',
        jsonb_build_object('iss','https://lockorder194.test','aud','message-board','sub','sub-lo194'),
        'lo194-a', public.test_pubkey('lo194-k1'), 'raw_ed25519_base64url',
-       public.test_key_fingerprint('lo194-k1'), true, null, 'agent',
+       public.test_key_fingerprint('lo194-k1'), true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
        ARRAY[]::text[], ARRAY[]::text[], 'lo194-no-such-code') $$,
   'R-8: replay with an unusable code still succeeds');
 select is((select invite_redeemed from _e3), false,

package/tests/agent_board_fedsession.test.sql

@@ -233,7 +233,7 @@ begin
     from agent_board.enroll_federated_identity(
       f.iss, 'message-board', f.sub_a, jsonb_build_object('iss',f.iss,'aud','message-board','sub', f.sub_a),
       'idlink-'||f.s, v_pub, 'raw_ed25519_base64url', v_fp,
-      true, null, 'agent', '{board:send}', '{}') e;
+      true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', '{board:send}', '{}') e;
   insert into _idlink select a.owner_user_id from agent_board.agents a where a.id = v_agent;
 end
 $$;