@consiliency/agent-board-schema 1.56.0 → 1.57.0

package/fixtures/already-applied.json

@@ -616,6 +616,10 @@
   {
    "id": "20261006000100_agent_board_room_roster_active_first",
    "sha256": "637480feeca07dbb2fe7a4624dc6d063d0c1f23e6ea3c3ee9a946ad43de4e34e"
+  },
+  {
+   "id": "20261007000100_agent_board_onboard_requests",
+   "sha256": "fbdbecfb1c78e2d1b16b37845a74082dcdf1241c61c0356b992e1e01baddc41c"
   }
  ]
 }

package/migrations/20261007000100_agent_board_onboard_requests.sql

@@ -0,0 +1,139 @@
+-- ONBOARD (v11) SL-2: the caller's own join requests (IF-0-ONBOARD-4) and a service-side
+-- invite label lookup for the consent page (IF-0-ONBOARD-11). Additive: two new read-only
+-- functions and one index. schema_version stays 8.
+--
+-- Sources read, each at its latest definition:
+--   * agent_board.current_agent_id()              -- 20260920000100 (the resolver
+--     request_join_board, 20260810000100, calls);
+--   * agent_board.board_membership_events         -- 20260806000100 (the append-only
+--     consent ledger; seq is the total order, created_at is wall-clock age);
+--   * agent_board.boards.join_request_ttl_days    -- 20260806000100;
+--   * the emitter _emit_membership_event          -- 20260807000100: a request made by the
+--     subject through request_join_board is `target-authored` / `requested`;
+--   * agent_board.board_invite_tokens             -- 20260724000100. invite_board_for_display
+--     checks only the frozen IF-0-ONBOARD-11 subset: not revoked, expires_at > now(), uses
+--     remaining. The redeem core (latest 20260909000100) refuses MORE -- a suspended or
+--     fleet-revoked creator, a lapsed ceiling, a removed agent, fleet-bounded invites -- so a
+--     code that displays a board can still fail to redeem.
+
+-- =============================================================================
+-- 1. list_my_board_requests() -- IF-0-ONBOARD-4
+-- =============================================================================
+-- WHICH REQUESTS. The ledger, never the membership row. A request is a (board, caller) with
+-- at least one event where agent_id is the caller, provenance = 'target-authored' and
+-- result_state = 'requested'. board_memberships.created_by_agent_id is NOT a source: the
+-- sink overwrites it on every later write (an approval names the approver), so it cannot say
+-- who asked.
+--
+-- IDENTITY. From the session only, by the resolver request_join_board uses. There is no
+-- parameter, and a null identity (service_role, anon, a revoked credential) returns nothing.
+--
+-- CURRENT STATE. The caller's membership row on that board, chosen active-first (MBROWID 3a,
+-- the key every current-standing reader uses), or 'none' when no row exists. A rejected request
+-- reads 'left' (REJECTSEM, #89: a refusal lands on the recoverable state).
+--
+-- EXPIRY. expires_at = the latest request event's created_at + the board's
+-- join_request_ttl_days. expired mirrors the consent predicates exactly
+-- (created_at < now() - ttl): an expired request no longer counts as consent. It is a property
+-- of the REQUEST and is reported whatever the membership's current state.
+create or replace function agent_board.list_my_board_requests()
+returns table(
+  board_id uuid,
+  board_name text,
+  board_slug text,
+  requested_at timestamptz,
+  membership_state text,
+  expires_at timestamptz,
+  expired boolean
+)
+language plpgsql
+stable
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  if v_actor is null then
+    return;
+  end if;
+
+  return query
+  select
+    b.id,
+    b.name,
+    b.slug,
+    req.created_at,
+    coalesce(cur.membership_state, 'none'),
+    req.created_at + make_interval(days => b.join_request_ttl_days),
+    req.created_at < now() - make_interval(days => b.join_request_ttl_days)
+  from (
+    -- The latest request event per board, by seq (the ledger's total order).
+    select distinct on (e.board_id) e.board_id, e.created_at
+      from agent_board.board_membership_events e
+     where e.agent_id = v_actor
+       and e.provenance = 'target-authored'
+       and e.result_state = 'requested'
+     order by e.board_id, e.seq desc
+  ) req
+  join agent_board.boards b on b.id = req.board_id
+  left join lateral (
+    select bm.membership_state
+      from agent_board.board_memberships bm
+     where bm.board_id = req.board_id
+       and bm.agent_id = v_actor
+     order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+              bm.created_at desc, bm.id desc
+     limit 1
+  ) cur on true
+  order by req.created_at desc, b.id desc;
+end;
+$$;
+
+comment on function agent_board.list_my_board_requests() is
+  'IF-0-ONBOARD-4: the caller''s own join requests as they stand now. Source is the consent ledger (board_membership_events: agent_id = caller, provenance target-authored, result_state requested), never board_memberships.created_by_agent_id, which later writers overwrite. Identity is current_agent_id() only; there is no parameter and a null identity returns nothing, so service_role (no caller identity) is refused EXECUTE. Per board: id, name, slug, the latest request event''s time, the current membership state chosen active-first (MBROWID 3a) or none, expires_at = requested_at + join_request_ttl_days, and expired (the request no longer counts as consent). Requests made before the ledger existed carry only a board-authored backfill_neutral event and are not returned. No per-row history.';
+
+revoke all on function agent_board.list_my_board_requests() from public, anon, service_role;
+grant execute on function agent_board.list_my_board_requests() to authenticated;
+
+-- =============================================================================
+-- 2. invite_board_for_display(p_code_sha256) -- IF-0-ONBOARD-11
+-- =============================================================================
+-- The Portal's consent page shows which board an in-chat enrollment will join, and it holds
+-- only the digest (the code itself never leaves the agent). The digest is the lowercase hex
+-- sha256 of the code text; the argument is compared case-insensitively.
+--
+-- Only a code passing the IF-0-ONBOARD-11 subset resolves: not revoked, not expired, and uses
+-- remaining. This is narrower than the redeem core (see the header), so display is not a promise
+-- that redeem will succeed. Anything else -- including an unknown digest -- returns no row, one uniform
+-- answer. Codes are 256-bit, so the digest is not a practical oracle; EXECUTE is service_role
+-- only regardless, because the Portal calls it server-side.
+create index if not exists idx_agent_board_board_invite_tokens_code_sha256
+  on agent_board.board_invite_tokens (encode(extensions.digest(code, 'sha256'), 'hex'));
+
+create or replace function agent_board.invite_board_for_display(p_code_sha256 text)
+returns table(
+  board_id uuid,
+  board_name text,
+  board_slug text,
+  preset_role text
+)
+language sql
+stable
+security definer
+set search_path = agent_board, public
+as $$
+  select b.id, b.name, b.slug, t.preset_role
+    from agent_board.board_invite_tokens t
+    join agent_board.boards b on b.id = t.board_id
+   where encode(extensions.digest(t.code, 'sha256'), 'hex') = lower(p_code_sha256)
+     and t.revoked_at is null
+     and t.expires_at > now()
+     and (t.max_uses is null or t.uses_count < t.max_uses);
+$$;
+
+comment on function agent_board.invite_board_for_display(text) is
+  'IF-0-ONBOARD-11: resolves an invite code''s digest (lowercase hex sha256 of the code, compared case-insensitively) to (board_id, board_name, board_slug, preset_role) for display on the Portal consent page. Only a usable code resolves -- not revoked, expires_at > now(), and max_uses null or uses_count < max_uses (a subset of the redeem core''s checks, so a displayed board can still fail to redeem); revoked, expired, exhausted and unknown codes return no row. Read-only. EXECUTE is service_role only: the Portal calls it server-side.';
+
+revoke all on function agent_board.invite_board_for_display(text) from public, anon, authenticated;
+grant execute on function agent_board.invite_board_for_display(text) to service_role;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.56.0",
+  "version": "1.57.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.56.0",
+  "packageVersion": "1.57.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 154,
-  "aggregateSha256": "d0b74be9b41032a78ad45227706a48283f931b40cd6350c63c619a0e153c0cee",
+  "migrationCount": 155,
+  "aggregateSha256": "347357b36b5ee37fbde189e005993c40df1e63a2d9d247b53823761304ae127e",
   "migrations": [
     {
       "order": 0,
@@ -1434,6 +1434,15 @@
       "sourceRef": "message-board",
       "bytes": 5470,
       "sha256": "637480feeca07dbb2fe7a4624dc6d063d0c1f23e6ea3c3ee9a946ad43de4e34e"
+    },
+    {
+      "order": 154,
+      "id": "20261007000100_agent_board_onboard_requests",
+      "filename": "20261007000100_agent_board_onboard_requests.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 7655,
+      "sha256": "fbdbecfb1c78e2d1b16b37845a74082dcdf1241c61c0356b992e1e01baddc41c"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 154)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST + one ONBOARD forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 155)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(154);
+    expect(manifest.migrationCount).toBe(155);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -343,6 +343,9 @@ describe('manifest integrity', () => {
       // ROOMCONTRACT-ACTIVEFIRST (#542): list_board_members chooses current standing
       // active-first (MBROWID 3a) at both its authorization and projection sites.
       '20261006000100_agent_board_room_roster_active_first.sql',
+      // ONBOARD (v11): list_my_board_requests (IF-0-ONBOARD-4) and the service-only
+      // invite_board_for_display digest lookup (IF-0-ONBOARD-11).
+      '20261007000100_agent_board_onboard_requests.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_membership_current_row_class.test.sql

@@ -309,6 +309,7 @@ select is(
     'list_board_members/distinct/active-first',
     'list_board_members/limit/active-first',
     'list_board_pending_memberships/distinct/active-first',
+    'list_my_board_requests/limit/active-first',
     'request_join_board/limit/filtered:''joined'',''subscribed''',
     'resolve_board_request/limit/filtered:''joined'',''subscribed''',
     'resolve_board_request/limit/filtered:''requested'',''invited''',
@@ -367,10 +368,11 @@ select is(
     'list_board_members/distinct',
     'list_board_members/limit',
     'list_board_pending_memberships/distinct',
+    'list_my_board_requests/limit',
     'update_board_membership/limit',
     'update_board_membership/limit'
   ]::text[],
-  'CRC-4: these seven sites carry the MBROWID 3a active-first key');
+  'CRC-4: these eight sites carry the MBROWID 3a active-first key');
 
 -- ---------------------------------------------------------------------------
 -- CRC-5..14: behaviour rows over fixture text, through the same objects.

package/tests/agent_board_onboard_requests.test.sql

@@ -0,0 +1,353 @@
+-- ONBOARD (v11) SL-2 pgTAP: list_my_board_requests() (IF-0-ONBOARD-4) and
+-- invite_board_for_display(text) (IF-0-ONBOARD-11), migration 20261007000100.
+--
+-- Driven by the real operations only: request_join_board, resolve_board_request (approve and
+-- reject), leave_board then request_join_board again, create_invite_link / redeem_invite_link /
+-- revoke_invite_link, enroll_federated_human. Two fixtures are AGE only, because now() is
+-- constant inside the test transaction and neither the TTL nor an invite expiry can be waited
+-- out: one request event's created_at is moved 31 days back (OB-L13), and one invite's
+-- expires_at is moved into the past (OB-I05). Both rows were first written by the real RPC.
+--
+-- Identity is set by the whole-JSON claim GUC only (the consent suite's method): SET LOCAL
+-- ROLE is never used, so EXECUTE posture is asserted separately through
+-- has_function_privilege, not by calling as a role.
+--
+-- Every call to a function under test is a lives_ok capture into a temp table, then separate
+-- state checks (AGENTS.md rule 3): a missing or re-signatured function FAILS the capture and
+-- leaves the checks to fail on an empty table, instead of aborting the file.
+--
+-- Mutation receipts (plans/evidence/onboard/mutation-receipts.md, "## SL-2"):
+--   identity parameter added          -> OB-L02
+--   agent_id = caller dropped         -> OB-L10, OB-L16
+--   created_by_agent_id as the source -> OB-L10
+--   service_role granted              -> OB-L05
+--   IF-11 granted to authenticated    -> OB-I13
+--   revoked / expired / exhausted predicate dropped -> OB-I04 / OB-I05 / OB-I07
+--
+-- HAND-COUNTED plan: OB-L01..L23 (23) + OB-I01..I16 with I03b (17) + OB-R01..R03 and the two
+-- named redeem pins (5) = 45.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(45);
+
+create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role','authenticated','sub',p_sub)::text, true);
+end $$;
+create function pg_temp.service() returns void language plpgsql as $$
+begin perform set_config('request.jwt.claims', '', true); end $$;
+create function pg_temp.state(b uuid, a uuid) returns text language sql as $$
+  select membership_state from agent_board.board_memberships
+   where board_id = b and agent_id = a
+   order by case when membership_state in ('joined','subscribed') then 0 else 1 end,
+            created_at desc, id desc
+   limit 1;
+$$;
+create function pg_temp.sha(p_code text) returns text language sql as $$
+  select encode(extensions.digest(p_code, 'sha256'), 'hex');
+$$;
+
+-- ---------------------------------------------------------------------------
+-- Fixture: principals and boards (service context; create_board seeds the owner).
+-- ---------------------------------------------------------------------------
+insert into auth.users(id, instance_id, aud, role, email)
+select ('0b000000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid,
+       '00000000-0000-0000-0000-000000000000','authenticated','authenticated','onb'||n||'@t.test'
+from generate_series(1,4) n;
+
+-- 1 = owner, 2 = requester R, 3 = another principal X, 4 = invite redeemer / exhauster Y.
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+select ('0b100000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid,
+       'agent','agent','onb-agent-'||n,'ONB Agent '||n,'active',
+       ('0b000000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid
+from generate_series(1,4) n;
+
+create temp table _ob (
+  owner uuid, r uuid, x uuid, y uuid, h uuid, h_user uuid,
+  b_approve uuid, b_reject uuid, b_rerequest uuid, b_expire uuid,
+  b_invite uuid, b_other uuid, b_human uuid, b_links uuid,
+  code_join text, code_live text, code_revoked text, code_expired text,
+  code_exhaust text, code_replay text, code_other text
+) on commit drop;
+
+do $$
+declare
+  v_owner uuid := '0b100000-0000-4000-8000-000000000001';
+  v_iss text := 'https://onb-fed-' || replace(substr(gen_random_uuid()::text, 1, 8), '-', '') || '.test';
+  v_h uuid; v_h_user uuid;
+  v_ba uuid; v_bb uuid; v_bc uuid; v_bd uuid; v_be uuid; v_bg uuid; v_bf uuid; v_bk uuid;
+begin
+  select board_id into v_ba from agent_board.create_board(v_owner, 'onb-approve', 'ONB Approve', null, '{}'::jsonb, 'open');
+  select board_id into v_bb from agent_board.create_board(v_owner, 'onb-reject', 'ONB Reject', null, '{}'::jsonb, 'open');
+  select board_id into v_bc from agent_board.create_board(v_owner, 'onb-rerequest', 'ONB Rerequest', null, '{}'::jsonb, 'open');
+  select board_id into v_bd from agent_board.create_board(v_owner, 'onb-expire', 'ONB Expire', null, '{}'::jsonb, 'invite_only');
+  select board_id into v_be from agent_board.create_board(v_owner, 'onb-invite', 'ONB Invite', null, '{}'::jsonb, 'open');
+  select board_id into v_bg from agent_board.create_board(v_owner, 'onb-other', 'ONB Other', null, '{}'::jsonb, 'open');
+  select board_id into v_bf from agent_board.create_board(v_owner, 'onb-human', 'ONB Human', null, '{}'::jsonb, 'open');
+  select board_id into v_bk from agent_board.create_board(v_owner, 'onb-links', 'ONB Links', null, '{}'::jsonb, 'private');
+
+  -- A Portal human: the federated provider, then the fed-human agent it provisions.
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_agent_kinds, default_board_id)
+  values (v_iss, 'message-board', true, true, '{human}', null);
+  select e.agent_id, e.auth_user_id into v_h, v_h_user
+    from agent_board.enroll_federated_human(
+      v_iss, 'message-board', 'onb-human-sub',
+      jsonb_build_object('sub', 'onb-human-sub', 'email_verified', false), 'ONB Human') e;
+
+  insert into _ob(owner, r, x, y, h, h_user,
+                  b_approve, b_reject, b_rerequest, b_expire, b_invite, b_other, b_human, b_links)
+  values (v_owner,
+          '0b100000-0000-4000-8000-000000000002', '0b100000-0000-4000-8000-000000000003',
+          '0b100000-0000-4000-8000-000000000004', v_h, v_h_user,
+          v_ba, v_bb, v_bc, v_bd, v_be, v_bg, v_bf, v_bk);
+
+  update _ob set
+    code_join    = (select code from agent_board.create_invite_link(v_be, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_live    = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_revoked = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_expired = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_exhaust = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', 1, null, v_owner, '{}'::jsonb)),
+    code_replay  = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_other   = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb));
+end
+$$;
+
+create temp table _req (
+  who text, board_id uuid, board_name text, board_slug text, requested_at timestamptz,
+  membership_state text, expires_at timestamptz, expired boolean
+) on commit drop;
+create temp table _disp (
+  label text, board_id uuid, board_name text, board_slug text, preset_role text
+) on commit drop;
+
+-- ===========================================================================
+-- list_my_board_requests: catalog posture
+-- ===========================================================================
+select ok(to_regprocedure('agent_board.list_my_board_requests()') is not null,
+  'OB-L01: list_my_board_requests() exists with no arguments');
+select is(
+  (select string_agg(coalesce(pg_get_function_arguments(p.oid), ''), '|')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_my_board_requests'),
+  '',
+  'OB-L02: exactly one list_my_board_requests overload, and it takes NO parameter (identity is never an argument)');
+select is(
+  (select p.prosecdef::text || '/' || p.provolatile::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_my_board_requests'),
+  'true/s',
+  'OB-L03: list_my_board_requests is SECURITY DEFINER and STABLE');
+select is(has_function_privilege('authenticated', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  true, 'OB-L04: authenticated holds EXECUTE on list_my_board_requests');
+select is(has_function_privilege('service_role', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  false, 'OB-L05: service_role holds NO EXECUTE on list_my_board_requests (no caller identity)');
+select is(has_function_privilege('anon', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  false, 'OB-L06: anon holds NO EXECUTE on list_my_board_requests');
+select is(has_function_privilege('public', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  false, 'OB-L07: PUBLIC holds NO EXECUTE on list_my_board_requests');
+
+-- ===========================================================================
+-- Real operations
+-- ===========================================================================
+-- R requests four boards.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.request_join_board(o.b_approve, o.r);
+  perform agent_board.request_join_board(o.b_reject, o.r);
+  perform agent_board.request_join_board(o.b_rerequest, o.r);
+  perform agent_board.request_join_board(o.b_expire, o.r);
+end $$;
+
+-- X requests the approve board and a board R never asked for.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000003');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.request_join_board(o.b_approve, o.x);
+  perform agent_board.request_join_board(o.b_other, o.x);
+end $$;
+
+-- The owner approves A and C, rejects B. Passing the owner as p_created_by_agent_id makes the
+-- sink overwrite created_by_agent_id on R's rows -- the reason that column is not a source.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000001');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.resolve_board_request(o.b_approve, o.r, 'joined', o.owner, '{}'::jsonb);
+  perform agent_board.resolve_board_request(o.b_reject, o.r, 'removed', o.owner, '{}'::jsonb);
+  perform agent_board.resolve_board_request(o.b_rerequest, o.r, 'joined', o.owner, '{}'::jsonb);
+end $$;
+
+-- R leaves C and requests it again; R joins E through an invite with no request.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.leave_board(o.b_rerequest, o.r);
+  perform agent_board.request_join_board(o.b_rerequest, o.r);
+  perform agent_board.redeem_invite_link(o.code_join);
+end $$;
+
+-- The Portal human requests F from its own session.
+select pg_temp.claims((select h_user::text from _ob));
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.request_join_board(o.b_human, o.h);
+end $$;
+
+-- AGE fixture: R's request on D is moved past the board's 30-day TTL.
+select pg_temp.service();
+update agent_board.board_membership_events e
+   set created_at = now() - interval '31 days'
+  from _ob
+ where e.board_id = _ob.b_expire and e.agent_id = _ob.r
+   and e.provenance = 'target-authored' and e.result_state = 'requested';
+
+-- ===========================================================================
+-- list_my_board_requests: behaviour
+-- ===========================================================================
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+select lives_ok($$ insert into _req select 'R', * from agent_board.list_my_board_requests() $$,
+  'OB-L08: R lists its requests [call succeeds]');
+select pg_temp.claims('0b000000-0000-0000-0000-000000000003');
+select lives_ok($$ insert into _req select 'X', * from agent_board.list_my_board_requests() $$,
+  'OB-L09: X lists its requests [call succeeds]');
+
+select is(
+  (select string_agg(board_slug, ',' order by board_slug) from _req where who = 'R'),
+  'onb-approve,onb-expire,onb-reject,onb-rerequest',
+  'OB-L10: R sees exactly its four requested boards -- approved, rejected, re-requested and expired');
+select is((select membership_state from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_approve),
+  'joined', 'OB-L11: an approved request reads its current state, joined');
+select is((select membership_state from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_reject),
+  'left', 'OB-L12: a rejected request reads its current state, left (REJECTSEM)');
+select is((select membership_state || '/' || expired::text from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_expire),
+  'requested/true', 'OB-L13: a request older than join_request_ttl_days is returned with expired = true');
+select is((select count(*)::int from _req where who = 'R' and not expired),
+  3, 'OB-L14: the three requests inside the TTL are expired = false');
+select is(
+  (select membership_state || '/' || (select count(*) from _req q where q.who = 'R' and q.board_id = r.board_id)::text
+     from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_rerequest),
+  'requested/1',
+  'OB-L15: leave then re-request reads requested, in ONE row for the board');
+select is((select count(*)::int from _req r, _ob where r.who = 'R' and r.board_id in (_ob.b_other, _ob.b_human)),
+  0, 'OB-L16: another principal''s requests are invisible to R');
+select is(
+  (select pg_temp.state(_ob.b_invite, _ob.r) || '/' ||
+          (select count(*) from _req r where r.who = 'R' and r.board_id = _ob.b_invite)::text from _ob),
+  'joined/0',
+  'OB-L17: an invite-only join (R is joined) is NOT returned as a request');
+select is(
+  (select (r.board_name = 'ONB Approve' and r.expires_at = r.requested_at + interval '30 days')::text
+     from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_approve),
+  'true', 'OB-L18: a row carries the board name and expires_at = requested_at + join_request_ttl_days');
+select is(
+  (select string_agg(board_slug || '=' || membership_state, ',' order by board_slug) from _req where who = 'X'),
+  'onb-approve=requested,onb-other=requested',
+  'OB-L19: X sees only its own requests, with its own state on the shared board');
+
+select pg_temp.claims((select h_user::text from _ob));
+select lives_ok($$ insert into _req select 'H', * from agent_board.list_my_board_requests() $$,
+  'OB-L20: the Portal human session lists [call succeeds]');
+select is((select string_agg(board_slug || '=' || membership_state, ',') from _req where who = 'H'),
+  'onb-human=requested',
+  'OB-L21: a Portal human session sees its fed-human agent''s request');
+
+select pg_temp.service();
+select lives_ok($$ insert into _req select 'S', * from agent_board.list_my_board_requests() $$,
+  'OB-L22: a session with no caller identity calls the function [call succeeds]');
+select is((select count(*)::int from _req where who = 'S'),
+  0, 'OB-L23: a session with no caller identity lists nothing');
+
+-- ===========================================================================
+-- invite_board_for_display: catalog posture
+-- ===========================================================================
+select ok(to_regprocedure('agent_board.invite_board_for_display(text)') is not null,
+  'OB-I01: invite_board_for_display(text) exists');
+select is(
+  (select count(*)::int from pg_indexes
+    where schemaname = 'agent_board' and tablename = 'board_invite_tokens'
+      and indexname = 'idx_agent_board_board_invite_tokens_code_sha256'
+      and indexdef like '%digest(code, ''sha256''%'),
+  1, 'OB-I02: board_invite_tokens has the functional digest index');
+
+-- ===========================================================================
+-- Real operations on the links board
+-- ===========================================================================
+select pg_temp.claims('0b000000-0000-0000-0000-000000000001');
+do $$ begin perform agent_board.revoke_invite_link((select code_revoked from _ob)); end $$;
+select pg_temp.service();
+-- AGE fixture: a code minted by create_invite_link is moved past its expiry.
+update agent_board.board_invite_tokens t set expires_at = now() - interval '1 second'
+  from _ob where t.code = _ob.code_expired;
+
+select lives_ok($$ insert into _disp select 'exhaust-before', * from agent_board.invite_board_for_display(pg_temp.sha((select code_exhaust from _ob))) $$,
+  'OB-I03: the capped code is looked up before its last use [call succeeds]');
+
+-- Y spends the capped code's only use.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000004');
+do $$ begin perform agent_board.redeem_invite_link((select code_exhaust from _ob)); end $$;
+select pg_temp.service();
+
+select lives_ok($$
+  insert into _disp select 'live', * from agent_board.invite_board_for_display(pg_temp.sha((select code_live from _ob)));
+  insert into _disp select 'live-upper', * from agent_board.invite_board_for_display(upper(pg_temp.sha((select code_live from _ob))));
+  insert into _disp select 'revoked', * from agent_board.invite_board_for_display(pg_temp.sha((select code_revoked from _ob)));
+  insert into _disp select 'expired', * from agent_board.invite_board_for_display(pg_temp.sha((select code_expired from _ob)));
+  insert into _disp select 'exhausted', * from agent_board.invite_board_for_display(pg_temp.sha((select code_exhaust from _ob)));
+  insert into _disp select 'unknown', * from agent_board.invite_board_for_display(pg_temp.sha('onb-no-such-code'));
+$$, 'OB-I03b: every code is looked up [call succeeds]');
+
+select is((select count(*)::int from _disp where label = 'revoked'),
+  0, 'OB-I04: a revoked code returns no row');
+select is((select count(*)::int from _disp where label = 'expired'),
+  0, 'OB-I05: an expired code returns no row');
+select is(
+  (select uses_count::text || '/' || max_uses::text from agent_board.board_invite_tokens t, _ob where t.code = _ob.code_exhaust),
+  '1/1', 'OB-I06: the capped code was exhausted by a real redeem (uses_count = max_uses)');
+select is((select count(*)::int from _disp where label = 'exhausted'),
+  0, 'OB-I07: an exhausted code returns no row');
+select is((select count(*)::int from _disp where label = 'exhaust-before'),
+  1, 'OB-I08: the same code resolved while a use remained (the exhausted check is discriminating)');
+select is((select count(*)::int from _disp where label = 'unknown'),
+  0, 'OB-I09: an unknown digest returns no row');
+select is(
+  (select (d.board_id = _ob.b_links)::text || '/' || d.board_name || '/' || d.board_slug || '/' || d.preset_role
+     from _disp d, _ob where d.label = 'live'),
+  'true/ONB Links/onb-links/member',
+  'OB-I10: a usable code resolves to its board id, name, slug and preset role');
+select is((select count(*)::int from _disp where label = 'live-upper'),
+  1, 'OB-I11: the digest is compared case-insensitively');
+select is(has_function_privilege('service_role', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  true, 'OB-I12: service_role holds EXECUTE on invite_board_for_display');
+select is(has_function_privilege('authenticated', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  false, 'OB-I13: authenticated holds NO EXECUTE on invite_board_for_display');
+select is(has_function_privilege('anon', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  false, 'OB-I14: anon holds NO EXECUTE on invite_board_for_display');
+select is(has_function_privilege('public', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  false, 'OB-I15: PUBLIC holds NO EXECUTE on invite_board_for_display');
+select is(
+  (select p.prosecdef::text || '/' || p.provolatile::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'invite_board_for_display'),
+  'true/s',
+  'OB-I16: invite_board_for_display is SECURITY DEFINER and STABLE');
+
+-- ===========================================================================
+-- Redeem behaviour on the real RPC (EC-ONBOARD-1's pin)
+-- ===========================================================================
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+select lives_ok($$ select agent_board.redeem_invite_link((select code_replay from _ob)) $$,
+  'OB-R01: R redeems an unlimited invite [call succeeds]');
+select lives_ok($$ select agent_board.redeem_invite_link((select code_replay from _ob)) $$,
+  'OB-R02: R replays the same invite [call succeeds]');
+select is(
+  (select uses_count from agent_board.board_invite_tokens t, _ob where t.code = _ob.code_replay),
+  1, 'redeem_replay_no_use: replaying the same invite consumes no use');
+select lives_ok($$ select agent_board.redeem_invite_link((select code_other from _ob)) $$,
+  'OB-R03: R, already a member, redeems a different invite [call succeeds]');
+select pg_temp.service();
+select is(
+  (select pg_temp.state(_ob.b_links, _ob.r) || '/' || t.uses_count::text
+     from agent_board.board_invite_tokens t, _ob where t.code = _ob.code_other),
+  'joined/1', 'redeem_other_invite_consumes: redeeming a different invite while already a member consumes one');
+
+select * from finish();
+rollback;

package/tests/agent_board_rowid.test.sql

@@ -19,7 +19,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(99);
+select plan(100);
 
 create temp view _rowid_order_sites as
 with defs as (
@@ -506,9 +506,10 @@ select is(
   true,
   'control: fixture and structural block really runs as service_role');
 
--- 2. Catalog-derived inventory: eight membership readers plus the two task/message idempotency
--- readers. request_join_board joined the set in MBCONSENT-B(iii), and list_board_members joined
--- it in ROOMCONTRACT; both read board_memberships with the created_at DESC + id DESC tiebreak.
+-- 2. Catalog-derived inventory: nine membership readers plus the two task/message idempotency
+-- readers. request_join_board joined the set in MBCONSENT-B(iii), list_board_members joined
+-- it in ROOMCONTRACT, and list_my_board_requests joined it in ONBOARD (v11); all read
+-- board_memberships with the created_at DESC + id DESC tiebreak.
 select is(
   (select array_agg(proname order by proname)
      from _rowid_function_order_counts),
@@ -519,12 +520,13 @@ select is(
     'join_board',
     'list_board_members',
     'list_board_pending_memberships',
+    'list_my_board_requests',
     'post_board_message',
     'request_join_board',
     'resolve_board_request',
     'update_board_membership'
   ]::text[],
-  'live catalog exposes eight membership readers plus two task/message idempotency readers');
+  'live catalog exposes nine membership readers plus two task/message idempotency readers');
 
 -- 3-10. COUNT-EQUALITY, never substring containment.
 select is(
@@ -1313,6 +1315,17 @@ select is(
   array[2, 2],
   'list_board_members: BOTH created_at DESC sites (authorization + projection) have the id DESC tiebreak');
 
+-- 100. list_my_board_requests (ONBOARD v11, 20261007000100): one statement, two created_at
+-- DESC sites -- the lateral that picks the caller's current membership row (active-first),
+-- and the result order -- and both carry the id DESC tiebreak. The exact pair, as for 99,
+-- so a site that disappears is not read as agreement 0 = 0.
+select is(
+  (select array[created_at_desc_count, total_order_count]
+     from _rowid_function_order_counts
+    where proname = 'list_my_board_requests'),
+  array[2, 2],
+  'list_my_board_requests: BOTH created_at DESC sites (current row + result order) have the id DESC tiebreak');
+
 select finish();
 
 rollback;

package/tests/catalog/function_execute_privileges.json

@@ -1036,6 +1036,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "invite_board_for_display",
+      "signature": "invite_board_for_display(p_code_sha256 text)",
+      "executable_by": {
+        "anon": false,
+        "service_role": true,
+        "authenticated": false
+      }
+    },
     {
       "name": "invite_board_member",
       "signature": "invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)",
@@ -1090,6 +1099,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "list_my_board_requests",
+      "signature": "list_my_board_requests()",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": true
+      }
+    },
     {
       "name": "mark_read",
       "signature": "mark_read(p_thread_id uuid, p_agent_id uuid, p_last_read_message_sequence bigint)",

package/tests/catalog/p_metadata_parameters.json

@@ -461,6 +461,10 @@
       "signature": "heartbeat(p_agent_id uuid, p_thread_id uuid, p_availability text, p_activity_summary text, p_expires_in interval, p_metadata jsonb)",
       "declares_p_metadata": true
     },
+    {
+      "signature": "invite_board_for_display(p_code_sha256 text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)",
       "declares_p_metadata": true
@@ -485,6 +489,10 @@
       "signature": "list_board_pending_memberships(p_board_id uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "list_my_board_requests()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "mark_read(p_thread_id uuid, p_agent_id uuid, p_last_read_message_sequence bigint)",
       "declares_p_metadata": false