@consiliency/agent-board-schema 1.54.0 → 1.56.0

package/migrations/20261006000100_agent_board_room_roster_active_first.sql

@@ -0,0 +1,118 @@
+-- ROOMCONTRACT-ACTIVEFIRST (message-board#542): the owner/admin roster chooses current
+-- standing ACTIVE-FIRST, as every other acting membership reader does (MBROWID 3a).
+--
+-- THE DEFECT. 20261003000100 chose the caller's standing (authorization) and each
+-- member's inclusion (projection) from the LATEST board_memberships row alone:
+-- `order by created_at desc, id desc`. The active-membership unique index is PARTIAL
+-- (idx_agent_board_board_memberships_active_unique, WHERE membership_state in
+-- ('joined','subscribed')), so one active row can coexist with newer non-active rows
+-- (removed / left / requested / invited). MBROWID 3a (20260803000100) ruled that every
+-- reader acting on "current standing" prefers the active row when one exists; join_board,
+-- update_board_membership, _upsert_board_membership_state and
+-- list_board_pending_memberships all do. The roster did not, so an active owner or admin
+-- with a newer non-active row was refused with 42501 and omitted from every roster —
+-- while the rest of MB (and Portal's self view, which reduces active-first as MBROWID
+-- requires) treated them as active.
+--
+-- THE FIX. Both selection sites take the MBROWID 3a key, then the existing total order:
+--   order by case when membership_state in ('joined','subscribed') then 0 else 1 end,
+--            created_at desc, id desc
+-- Everything else is unchanged: signature, projection, STABLE, SECURITY DEFINER,
+-- search_path, the 42501 message, the result order, and the grants.
+--
+-- The class this belongs to is pinned from the catalog, not from this list:
+-- tests/agent_board_membership_current_row_class.test.sql derives every statement that
+-- picks ONE board_memberships row by recency and requires the active-first key, or a
+-- named exemption whose filter it asserts exactly. This migration fixes the only two
+-- sites that class found without the key; the exemptions are recorded there.
+--
+-- CREATE OR REPLACE keeps the ACL and the COMMENT, but both are restated below anyway:
+-- the COMMENT's text described latest-row semantics and must change, and the grants are
+-- restated so this file alone says what the function's posture is.
+
+create or replace function agent_board.list_board_members(p_board_id uuid)
+returns table(
+  membership_id uuid,
+  board_id uuid,
+  agent_id uuid,
+  handle text,
+  display_name text,
+  agent_type text,
+  membership_state text,
+  role text,
+  created_by_agent_id uuid,
+  membership_created_at timestamptz,
+  membership_updated_at timestamptz
+)
+language plpgsql
+stable
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- Authorization precedes disclosure. Creator identity is deliberately absent:
+  -- only the caller's current membership row can establish authority, and the
+  -- current row is the ACTIVE one when one exists (MBROWID 3a), else the latest.
+  if v_actor is null
+     or not exists (
+       select 1
+         from (
+           select bm.membership_state, bm.role
+             from agent_board.board_memberships bm
+            where bm.board_id = p_board_id
+              and bm.agent_id = v_actor
+            order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+                     bm.created_at desc, bm.id desc
+            limit 1
+         ) actor_standing
+        where actor_standing.membership_state in ('joined', 'subscribed')
+          and actor_standing.role in ('owner', 'admin')
+     ) then
+    raise exception 'only a board owner or admin may list board members'
+      using errcode = '42501';
+  end if;
+
+  -- Choose exactly one current row per agent (active-first, MBROWID 3a), then
+  -- keep only agents whose current row is active.
+  return query
+  select
+    latest.id,
+    latest.board_id,
+    latest.agent_id,
+    a.handle,
+    a.display_name,
+    a.agent_type,
+    latest.membership_state,
+    latest.role,
+    latest.created_by_agent_id,
+    latest.created_at,
+    latest.updated_at
+  from (
+    select distinct on (bm.agent_id) bm.*
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+     order by bm.agent_id,
+              case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+              bm.created_at desc, bm.id desc
+  ) latest
+  join agent_board.agents a on a.id = latest.agent_id
+  where latest.membership_state in ('joined', 'subscribed')
+  order by
+    case latest.role
+      when 'owner' then 0
+      when 'admin' then 1
+      when 'member' then 2
+      when 'observer' then 3
+    end,
+    lower(a.handle),
+    latest.agent_id;
+end;
+$$;
+
+comment on function agent_board.list_board_members(uuid) is
+  'Owner/admin-gated active board roster. Fails 42501 for a null actor (including service_role through this user-facing path), creator without current standing, or any caller whose current board membership is not active owner/admin. The current row is chosen active-first (MBROWID 3a): case when membership_state in (joined, subscribed) then 0 else 1 end, created_at desc, id desc — so an active row outranks a newer removed/left/requested/invited row. Returns each agent''s current row only when joined/subscribed, ordered owner/admin/member/observer then lower(handle), agent_id. Board-scoped and metadata-free.';
+
+revoke all on function agent_board.list_board_members(uuid) from public, anon;
+grant execute on function agent_board.list_board_members(uuid) to authenticated, service_role;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.54.0",
+  "version": "1.56.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.54.0",
+  "packageVersion": "1.56.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 152,
-  "aggregateSha256": "a98fe8541f1689748da03753076ff5e7d8d8af5bcda5857c9c5a1dce0358d8c4",
+  "migrationCount": 154,
+  "aggregateSha256": "d0b74be9b41032a78ad45227706a48283f931b40cd6350c63c619a0e153c0cee",
   "migrations": [
     {
       "order": 0,
@@ -1416,6 +1416,24 @@
       "sourceRef": "message-board",
       "bytes": 3403,
       "sha256": "cd1815a58978261be143426eaac2dfccb6bb86b003487e4d1866aba60e7a6eb6"
+    },
+    {
+      "order": 152,
+      "id": "20261005000100_agent_board_enroll_token_single_use",
+      "filename": "20261005000100_agent_board_enroll_token_single_use.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 55964,
+      "sha256": "317d7b41432b36a2e38cc64940838e173e425014e3e256a96d832202b250e82d"
+    },
+    {
+      "order": 153,
+      "id": "20261006000100_agent_board_room_roster_active_first",
+      "filename": "20261006000100_agent_board_room_roster_active_first.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 5470,
+      "sha256": "637480feeca07dbb2fe7a4624dc6d063d0c1f23e6ea3c3ee9a946ad43de4e34e"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 152)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 154)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(152);
+    expect(manifest.migrationCount).toBe(154);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -338,6 +338,11 @@ describe('manifest integrity', () => {
       // ROOMCONTRACT: owner/admin active roster RPC plus self-membership role.
       '20261003000100_agent_board_room_roster.sql',
       '20261004000100_agent_board_callback_consumer_intent.sql',
+      // ENROLLTOKENSINGLEUSE (#521): a verified Portal token binds to at most one key.
+      '20261005000100_agent_board_enroll_token_single_use.sql',
+      // ROOMCONTRACT-ACTIVEFIRST (#542): list_board_members chooses current standing
+      // active-first (MBROWID 3a) at both its authorization and projection sites.
+      '20261006000100_agent_board_room_roster_active_first.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_atomic_fleet_onboarding.test.sql

@@ -156,7 +156,7 @@ select has_function(
 );
 select has_function(
   'agent_board', 'onboard_federated_fleet_agent',
-  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','timestamp with time zone','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
   'atomic fleet onboarding RPC exists'
 );
 select has_function('agent_board', '_redeem_fleet_invite_for_agent', array['text','uuid'], 'fleet-only redemption helper exists');
@@ -168,7 +168,7 @@ select has_function(
 );
 select function_privs_are(
   'agent_board', 'onboard_federated_fleet_agent',
-  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','timestamp with time zone','text','text','text[]','text[]','text','uuid','uuid','text','text','text','text','text','text','text'],
   'service_role', array['EXECUTE'],
   'only service_role can execute atomic onboarding'
 );
@@ -178,27 +178,27 @@ select function_privs_are(
   'fleet redemption helper is service-role-only'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%fleet_onboarding.v1%',
   'atomic onboarding returns the frozen contract version'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%for update%',
   'atomic onboarding catalog-pins row locking'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text)'::regprocedure, true)
     like '%pg_advisory_xact_lock%',
   'exact-key create-or-reuse is serialized by fingerprint'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%pg_advisory_xact_lock(hashtextextended(p_agent_public_key_fingerprint, 0))%',
   'composed onboarding serializes identity disposition by fingerprint'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text)'::regprocedure, true)
     like '%fleet invite requires atomic fleet onboarding%',
   'legacy enrollment rejects bounded invites before writes'
 );
@@ -208,42 +208,42 @@ select ok(
   'generic ROOMLINK redemption rejects bounded invites'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%phase_worker%worker%reviewer%reviewer%',
   'only bounded worker and reviewer role pairs are admitted'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%signing_key_id is distinct from v_enroll.signing_key_id%',
   'binding replay pins the exact proven signing key'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%v_inv.board_id is distinct from p_board_id%',
   'requested board is checked against the locked invite before writes'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%not v_completed_replay%v_inv.expires_at <= now()%v_inv.uses_count >= v_inv.max_uses%',
   'only a complete active replay may bypass expiry and exhaustion'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%v_inv.revoked_at is not null%a.status = ''active''%_grant_within_ceiling%',
   'revocation and current creator authority gate every fleet replay'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%a.id = any(array[v_inv.created_by_agent_id, v_existing_agent_id])%order by a.id for update%bm.agent_id = v_inv.created_by_agent_id%order by bm.id for update%_grant_within_ceiling%',
   'creator and enrolled principals lock in UUID order before creator authority'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%board_invite_redemptions red%order by red.id for update%bm.agent_id = v_enroll.agent_id%order by bm.id for update%select exists%',
   'complete-replay proof locks redemption and membership first'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%perform 1 from agent_board.fleet_harness_registrations%perform 1 from agent_board.fleet_repo_scopes%perform 1 from agent_board.fleet_machine_agents%',
   'every matching harness, repo, and binding history row is locked before reuse'
 );
@@ -263,12 +263,12 @@ select ok(
   'exact binding revocation locks the machine before the binding [SOLE PIN: no isolation spec discriminates this ordering -- measured against all 20]'
 );
 select ok(
-  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
-  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'where fm.id = p_machine_id for update'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.agents a where a.id = v_enroll.agent_id for update'
   ),
   'atomic onboarding locks the machine before its enrolled agent [CONFIRMATORY: atomic_fleet_binding_revoke.spec and atomic_fleet_lifecycle_races.spec both discriminate the inversion]'
 );
@@ -368,12 +368,12 @@ select ok(
   'bounded invite mint locks and requires an active board'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure, true)
     like '%from agent_board.boards b%where b.id = v_inv.board_id%for update%v_board.status <> ''active''%',
   'atomic onboarding locks and requires the invite board to remain active'
 );
 select ok(
-  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text)'::regprocedure, true)
+  agent_board_test.stripped_body('agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text)'::regprocedure, true)
     like '%from auth.users u where u.id = v_owner_user_id for update%fleet_human_revocations%r.issuer = p_issuer and r.subject = p_subject%',
   'identity enrollment locks the human owner and rejects durable total revocation'
 );
@@ -404,7 +404,7 @@ select ok(
 select ok(
   not has_function_privilege(
     'authenticated',
-    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
     'EXECUTE'
   ),
   'authenticated CANNOT execute atomic onboarding'
@@ -412,7 +412,7 @@ select ok(
 select ok(
   not has_function_privilege(
     'anon',
-    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure,
     'EXECUTE'
   ),
   'anon CANNOT execute atomic onboarding'
@@ -439,10 +439,10 @@ select ok(
 -- Ordering, not mere presence: the lock has to be held BEFORE the authorization
 -- decision reads the (possibly absent) ceiling, and BEFORE the writer upserts it.
 select ok(
-  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
-  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
   ),
   'atomic onboarding holds the board ceiling lock before evaluating creator authority [REDUNDANT: implied by the advisory-before-boards and boards-before-ceiling-read claims below; an advisory moved between those two points violates the real ordering and still passes THIS one]'
 );
@@ -454,10 +454,10 @@ select ok(
 -- that catches the inversion; it is deliberately separate from the "before the
 -- ceiling read" assertion below, because that one passes in BOTH orders.
 select ok(
-  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
-  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'perform agent_board._lock_board_authority_ceiling(v_inv.board_id)'
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
    where b.id = v_inv.board_id
    for update'
   ),
@@ -477,14 +477,14 @@ select ok(
 -- ordering nothing else states, because the boards lock is taken for board liveness,
 -- not for the ceiling. Pin the ordering so a refactor that moves it is not silent.
 select ok(
-  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
+  strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
    where b.id = v_inv.board_id
    for update'
   ) > 0
-  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
+  and strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'from agent_board.boards b
    where b.id = v_inv.board_id
    for update'
-  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
+  ) < strpos(lower(agent_board_test.stripped_body('agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text)'::regprocedure)), 'agent_board._grant_within_ceiling('
   ),
   'atomic onboarding holds the boards row FOR UPDATE before it reads the ceiling [CONFIRMATORY FOR FLAT MASKS ONLY: agent_board_federated_lock_order_class.test.sql EC-3 fails by name on the comment/literal mutants, but it carries the SAME strip, so a NESTED block comment takes this assertion and EC-3 green together -- see #199 in the header; atomic_fleet_authority_races.spec pins the OUTCOME only when this lock and the advisory are BOTH gone, and atomic_fleet_board_archive.spec BLOCKS rather than failing by name]'
 );
@@ -553,7 +553,7 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     -- lock also closes this reader's exposure to the ceiling row's ABSENCE, one of the three
     -- 20260901000110 left explicitly undetermined.
     'agent_board.grant_board_role(uuid,uuid,text,uuid) => serialized',
-    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) => serialized'
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) => serialized'
   ]::text[],
   'every ceiling-authorization reader in pg_proc is declared with its serialization state'
 );
@@ -698,14 +698,14 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     'agent_board._revoke_agent_principal(uuid,uuid,text) [definer] => service_role',
     'agent_board.create_fleet_onboarding_invite(uuid,uuid,text,text,text,text,text,text,text,integer,timestamp with time zone,uuid,jsonb) [definer] => authenticated,service_role',
     'agent_board.enroll_federated_human(text,text,text,jsonb,text) [definer] => service_role',
-    'agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text) [definer] => service_role',
+    'agent_board.enroll_federated_identity(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text) [definer] => service_role',
     'agent_board.evaluate_fleet_sender_policy(uuid,uuid,uuid,uuid,text,uuid,boolean) [definer] => authenticated,service_role',
     -- Joined this class in #276: the live grant chokepoint now takes _lock_board_authority_ceiling
     -- (forced by the section-9 agents/board_memberships class in agent_board_signer_lifecycle.test.sql
     -- once the ledger gate made it lock both). Still authenticated,service_role — #276 removes
     -- authority from a revoked principal, it does not change who may call the RPC.
     'agent_board.grant_board_role(uuid,uuid,text,uuid) [definer] => authenticated,service_role',
-    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) [definer] => service_role',
+    'agent_board.onboard_federated_fleet_agent(text,text,text,jsonb,text,text,text,text,boolean,text,timestamp with time zone,text,text,text[],text[],text,uuid,uuid,text,text,text,text,text,text,text) [definer] => service_role',
     'agent_board.reactivate_fleet_machine(uuid,uuid,text) [definer] => service_role',
     'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb) [definer] => authenticated,service_role',
     'agent_board.revoke_human_subtree(uuid,uuid,text) [definer] => service_role',

package/tests/agent_board_atomic_fleet_onboarding_backfill.test.sql

@@ -83,7 +83,7 @@ select * from agent_board.enroll_federated_identity(
   'TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
   'raw_ed25519_base64url',
   'sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-  true, null, 'agent', ARRAY['board:read','board:send'], ARRAY[]::text[], null
+  true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:read','board:send'], ARRAY[]::text[], null
 );
 select is((select agent_id from _legacy_replay),
           '16200000-0000-0000-0000-000000000001'::uuid,
@@ -107,7 +107,7 @@ select throws_ok(
     '{"iss":"https://legacy.atomic.test","aud":["message-board","new-audience"],"uid":"legacy-complete"}'::jsonb,
     'atomic-backfill-complete','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
     'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-    true,null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
   '23505', null, 'changed normalized audience projection conflicts'
 );
 select throws_ok(
@@ -116,7 +116,7 @@ select throws_ok(
     '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"changed-subject"}'::jsonb,
     'atomic-backfill-complete','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
     'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-    true,null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
   '23505', null, 'changed stable subject conflicts'
 );
 select throws_ok(
@@ -125,7 +125,7 @@ select throws_ok(
     '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"legacy-complete"}'::jsonb,
     'changed-slug','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
     'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-    true,null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
   '23505', null, 'changed requested slug conflicts'
 );
 select throws_ok(
@@ -134,7 +134,7 @@ select throws_ok(
     '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"legacy-complete"}'::jsonb,
     'atomic-backfill-complete','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
     'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
-    true,'new-actor','agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),'new-actor','agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
   '23505', null, 'changed independent actor subject conflicts'
 );