@consiliency/agent-board-schema 1.56.0 → 1.58.0

package/tests/agent_board_ledger_authority.test.sql

@@ -49,7 +49,8 @@ begin;
 
 -- 88 at #276; #280 deletes 7 (EXEMPTION B1/B2/B3, the three RESIDUAL assertions, and a fourth
 -- residual companion in section 10 that named only the slug) and adds 10 in section 11.
-select plan(91);
+-- 92 with HOSTED (20261008000100): EXEMPTION E below licenses add_delegate_to_board.
+select plan(92);
 
 create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
 begin
@@ -566,10 +567,10 @@ select is(
       and agent_board_test.stripped_body(p.oid)
           ~ agent_board_test.re(agent_board_test.call_frag('_assert_actor_not_fleet_revoked')
                                 || '|' || agent_board_test.call_frag('_actor_fleet_revoked'))),
-  '_redeem_unbounded_invite_for_agent,create_board,create_invite_link,grant_board_role,'
+  '_redeem_unbounded_invite_for_agent,add_delegate_to_board,create_board,create_invite_link,grant_board_role,'
   || 'set_board_authority_ceiling,set_board_claim_policy,set_board_role_gate',
-  'the functions that consult the fleet revocation ledger are exactly these seven (#280 added '
-  'create_board)');
+  'the functions that consult the fleet revocation ledger are exactly these eight (#280 added '
+  'create_board; HOSTED added add_delegate_to_board)');
 
 -- The gate proper: the two sets must differ by EXACTLY the three asserted exemptions, and any
 -- other member of the difference is NAMED in the failure. Each excluded name is licensed by a
@@ -593,6 +594,9 @@ select is(
                 -- the three asserted exemptions (create_board was the fourth until #280)...
                 '_upsert_board_membership_state',
                 '_fedsession_autojoin_default_board', 'bootstrap_board_owner_memberships',
+                -- ...HOSTED's add_delegate_to_board, which consults the ledger for the OWNER and
+                -- writes no authority relation itself (EXEMPTION E, positively, below)...
+                'add_delegate_to_board',
                 -- ...and the two helpers, which ARE the gate rather than users of it
                 '_assert_actor_not_fleet_revoked', '_actor_fleet_revoked')
           and ((agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into', 'board_memberships')
@@ -688,7 +692,8 @@ select is(
     where n.nspname = 'agent_board'
       and p.proname <> '_upsert_board_membership_state'
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_upsert_board_membership_state')),
-  'invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)'
+  'add_delegate_to_board(p_agent_id uuid, p_board_id uuid)'
+  || ' | invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)'
   || ' | join_board(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid, p_metadata jsonb)'
   || ' | request_join_board(p_board_id uuid, p_agent_id uuid, p_metadata jsonb)'
   || ' | resolve_board_request(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid, p_metadata jsonb)'
@@ -726,6 +731,30 @@ select is(
   'EXEMPTION D: bootstrap_board_owner_memberships takes NO arguments — it backfills the board '
   'own recorded owner_agent_id and can name no other principal');
 
+-- EXEMPTION E — add_delegate_to_board (HOSTED, 20261008000100). It is in the ledger-consult set
+-- (the owner must not be fleet-revoked, IF-0-HOSTED-12) and NOT in the authority-writer set, so
+-- the pairing assertion above excludes it by name. Licensed positively here: it consults the
+-- ledger, it reaches board_memberships ONLY through the sink, it names no role, and it writes
+-- no other authority relation in its own body. Each conjunct is reported, so a change names
+-- which one moved.
+select is(
+  (select string_agg(
+            'ledger=' || (b ~ agent_board_test.call_re('_assert_actor_not_fleet_revoked', false))::text
+            || ' sink=' || (b ~ agent_board_test.call_re('_upsert_board_membership_state', false))::text
+            || ' direct_membership_write=' || (b ~ agent_board_test.write_re('board_memberships'))::text
+            || ' role_write=' || (b ~ agent_board_test.col_write_re('board_memberships', 'role'))::text
+            || ' other_authority_write=' || (b ~ agent_board_test.stmt_re('insert into|update', 'board_authority_ceilings')
+                                              or b ~ agent_board_test.col_write_re('boards', 'role_gate_enforced')
+                                              or b ~ agent_board_test.col_write_re('boards', 'claim_policy')
+                                              or b ~ agent_board_test.stmt_re('insert into', 'board_invite_tokens'))::text,
+            ' | ')
+     from (select agent_board_test.stripped_body(p.oid) as b
+             from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board' and p.proname = 'add_delegate_to_board') x),
+  'ledger=true sink=true direct_membership_write=false role_write=false other_authority_write=false',
+  'EXEMPTION E: add_delegate_to_board consults the ledger and writes membership only through the '
+  'sink — no role, no other authority relation');
+
 
 -- ===========================================================================
 -- 10. G3 — THE INVITE ROUTE. An admin-preset link is a deferred grant of admin, so a

package/tests/agent_board_membership_current_row_class.test.sql

@@ -309,6 +309,7 @@ select is(
     'list_board_members/distinct/active-first',
     'list_board_members/limit/active-first',
     'list_board_pending_memberships/distinct/active-first',
+    'list_my_board_requests/limit/active-first',
     'request_join_board/limit/filtered:''joined'',''subscribed''',
     'resolve_board_request/limit/filtered:''joined'',''subscribed''',
     'resolve_board_request/limit/filtered:''requested'',''invited''',
@@ -367,10 +368,11 @@ select is(
     'list_board_members/distinct',
     'list_board_members/limit',
     'list_board_pending_memberships/distinct',
+    'list_my_board_requests/limit',
     'update_board_membership/limit',
     'update_board_membership/limit'
   ]::text[],
-  'CRC-4: these seven sites carry the MBROWID 3a active-first key');
+  'CRC-4: these eight sites carry the MBROWID 3a active-first key');
 
 -- ---------------------------------------------------------------------------
 -- CRC-5..14: behaviour rows over fixture text, through the same objects.

package/tests/agent_board_onboard_requests.test.sql

@@ -0,0 +1,353 @@
+-- ONBOARD (v11) SL-2 pgTAP: list_my_board_requests() (IF-0-ONBOARD-4) and
+-- invite_board_for_display(text) (IF-0-ONBOARD-11), migration 20261007000100.
+--
+-- Driven by the real operations only: request_join_board, resolve_board_request (approve and
+-- reject), leave_board then request_join_board again, create_invite_link / redeem_invite_link /
+-- revoke_invite_link, enroll_federated_human. Two fixtures are AGE only, because now() is
+-- constant inside the test transaction and neither the TTL nor an invite expiry can be waited
+-- out: one request event's created_at is moved 31 days back (OB-L13), and one invite's
+-- expires_at is moved into the past (OB-I05). Both rows were first written by the real RPC.
+--
+-- Identity is set by the whole-JSON claim GUC only (the consent suite's method): SET LOCAL
+-- ROLE is never used, so EXECUTE posture is asserted separately through
+-- has_function_privilege, not by calling as a role.
+--
+-- Every call to a function under test is a lives_ok capture into a temp table, then separate
+-- state checks (AGENTS.md rule 3): a missing or re-signatured function FAILS the capture and
+-- leaves the checks to fail on an empty table, instead of aborting the file.
+--
+-- Mutation receipts (plans/evidence/onboard/mutation-receipts.md, "## SL-2"):
+--   identity parameter added          -> OB-L02
+--   agent_id = caller dropped         -> OB-L10, OB-L16
+--   created_by_agent_id as the source -> OB-L10
+--   service_role granted              -> OB-L05
+--   IF-11 granted to authenticated    -> OB-I13
+--   revoked / expired / exhausted predicate dropped -> OB-I04 / OB-I05 / OB-I07
+--
+-- HAND-COUNTED plan: OB-L01..L23 (23) + OB-I01..I16 with I03b (17) + OB-R01..R03 and the two
+-- named redeem pins (5) = 45.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(45);
+
+create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role','authenticated','sub',p_sub)::text, true);
+end $$;
+create function pg_temp.service() returns void language plpgsql as $$
+begin perform set_config('request.jwt.claims', '', true); end $$;
+create function pg_temp.state(b uuid, a uuid) returns text language sql as $$
+  select membership_state from agent_board.board_memberships
+   where board_id = b and agent_id = a
+   order by case when membership_state in ('joined','subscribed') then 0 else 1 end,
+            created_at desc, id desc
+   limit 1;
+$$;
+create function pg_temp.sha(p_code text) returns text language sql as $$
+  select encode(extensions.digest(p_code, 'sha256'), 'hex');
+$$;
+
+-- ---------------------------------------------------------------------------
+-- Fixture: principals and boards (service context; create_board seeds the owner).
+-- ---------------------------------------------------------------------------
+insert into auth.users(id, instance_id, aud, role, email)
+select ('0b000000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid,
+       '00000000-0000-0000-0000-000000000000','authenticated','authenticated','onb'||n||'@t.test'
+from generate_series(1,4) n;
+
+-- 1 = owner, 2 = requester R, 3 = another principal X, 4 = invite redeemer / exhauster Y.
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+select ('0b100000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid,
+       'agent','agent','onb-agent-'||n,'ONB Agent '||n,'active',
+       ('0b000000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid
+from generate_series(1,4) n;
+
+create temp table _ob (
+  owner uuid, r uuid, x uuid, y uuid, h uuid, h_user uuid,
+  b_approve uuid, b_reject uuid, b_rerequest uuid, b_expire uuid,
+  b_invite uuid, b_other uuid, b_human uuid, b_links uuid,
+  code_join text, code_live text, code_revoked text, code_expired text,
+  code_exhaust text, code_replay text, code_other text
+) on commit drop;
+
+do $$
+declare
+  v_owner uuid := '0b100000-0000-4000-8000-000000000001';
+  v_iss text := 'https://onb-fed-' || replace(substr(gen_random_uuid()::text, 1, 8), '-', '') || '.test';
+  v_h uuid; v_h_user uuid;
+  v_ba uuid; v_bb uuid; v_bc uuid; v_bd uuid; v_be uuid; v_bg uuid; v_bf uuid; v_bk uuid;
+begin
+  select board_id into v_ba from agent_board.create_board(v_owner, 'onb-approve', 'ONB Approve', null, '{}'::jsonb, 'open');
+  select board_id into v_bb from agent_board.create_board(v_owner, 'onb-reject', 'ONB Reject', null, '{}'::jsonb, 'open');
+  select board_id into v_bc from agent_board.create_board(v_owner, 'onb-rerequest', 'ONB Rerequest', null, '{}'::jsonb, 'open');
+  select board_id into v_bd from agent_board.create_board(v_owner, 'onb-expire', 'ONB Expire', null, '{}'::jsonb, 'invite_only');
+  select board_id into v_be from agent_board.create_board(v_owner, 'onb-invite', 'ONB Invite', null, '{}'::jsonb, 'open');
+  select board_id into v_bg from agent_board.create_board(v_owner, 'onb-other', 'ONB Other', null, '{}'::jsonb, 'open');
+  select board_id into v_bf from agent_board.create_board(v_owner, 'onb-human', 'ONB Human', null, '{}'::jsonb, 'open');
+  select board_id into v_bk from agent_board.create_board(v_owner, 'onb-links', 'ONB Links', null, '{}'::jsonb, 'private');
+
+  -- A Portal human: the federated provider, then the fed-human agent it provisions.
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_agent_kinds, default_board_id)
+  values (v_iss, 'message-board', true, true, '{human}', null);
+  select e.agent_id, e.auth_user_id into v_h, v_h_user
+    from agent_board.enroll_federated_human(
+      v_iss, 'message-board', 'onb-human-sub',
+      jsonb_build_object('sub', 'onb-human-sub', 'email_verified', false), 'ONB Human') e;
+
+  insert into _ob(owner, r, x, y, h, h_user,
+                  b_approve, b_reject, b_rerequest, b_expire, b_invite, b_other, b_human, b_links)
+  values (v_owner,
+          '0b100000-0000-4000-8000-000000000002', '0b100000-0000-4000-8000-000000000003',
+          '0b100000-0000-4000-8000-000000000004', v_h, v_h_user,
+          v_ba, v_bb, v_bc, v_bd, v_be, v_bg, v_bf, v_bk);
+
+  update _ob set
+    code_join    = (select code from agent_board.create_invite_link(v_be, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_live    = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_revoked = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_expired = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_exhaust = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', 1, null, v_owner, '{}'::jsonb)),
+    code_replay  = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_other   = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb));
+end
+$$;
+
+create temp table _req (
+  who text, board_id uuid, board_name text, board_slug text, requested_at timestamptz,
+  membership_state text, expires_at timestamptz, expired boolean
+) on commit drop;
+create temp table _disp (
+  label text, board_id uuid, board_name text, board_slug text, preset_role text
+) on commit drop;
+
+-- ===========================================================================
+-- list_my_board_requests: catalog posture
+-- ===========================================================================
+select ok(to_regprocedure('agent_board.list_my_board_requests()') is not null,
+  'OB-L01: list_my_board_requests() exists with no arguments');
+select is(
+  (select string_agg(coalesce(pg_get_function_arguments(p.oid), ''), '|')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_my_board_requests'),
+  '',
+  'OB-L02: exactly one list_my_board_requests overload, and it takes NO parameter (identity is never an argument)');
+select is(
+  (select p.prosecdef::text || '/' || p.provolatile::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_my_board_requests'),
+  'true/s',
+  'OB-L03: list_my_board_requests is SECURITY DEFINER and STABLE');
+select is(has_function_privilege('authenticated', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  true, 'OB-L04: authenticated holds EXECUTE on list_my_board_requests');
+select is(has_function_privilege('service_role', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  false, 'OB-L05: service_role holds NO EXECUTE on list_my_board_requests (no caller identity)');
+select is(has_function_privilege('anon', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  false, 'OB-L06: anon holds NO EXECUTE on list_my_board_requests');
+select is(has_function_privilege('public', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  false, 'OB-L07: PUBLIC holds NO EXECUTE on list_my_board_requests');
+
+-- ===========================================================================
+-- Real operations
+-- ===========================================================================
+-- R requests four boards.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.request_join_board(o.b_approve, o.r);
+  perform agent_board.request_join_board(o.b_reject, o.r);
+  perform agent_board.request_join_board(o.b_rerequest, o.r);
+  perform agent_board.request_join_board(o.b_expire, o.r);
+end $$;
+
+-- X requests the approve board and a board R never asked for.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000003');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.request_join_board(o.b_approve, o.x);
+  perform agent_board.request_join_board(o.b_other, o.x);
+end $$;
+
+-- The owner approves A and C, rejects B. Passing the owner as p_created_by_agent_id makes the
+-- sink overwrite created_by_agent_id on R's rows -- the reason that column is not a source.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000001');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.resolve_board_request(o.b_approve, o.r, 'joined', o.owner, '{}'::jsonb);
+  perform agent_board.resolve_board_request(o.b_reject, o.r, 'removed', o.owner, '{}'::jsonb);
+  perform agent_board.resolve_board_request(o.b_rerequest, o.r, 'joined', o.owner, '{}'::jsonb);
+end $$;
+
+-- R leaves C and requests it again; R joins E through an invite with no request.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.leave_board(o.b_rerequest, o.r);
+  perform agent_board.request_join_board(o.b_rerequest, o.r);
+  perform agent_board.redeem_invite_link(o.code_join);
+end $$;
+
+-- The Portal human requests F from its own session.
+select pg_temp.claims((select h_user::text from _ob));
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.request_join_board(o.b_human, o.h);
+end $$;
+
+-- AGE fixture: R's request on D is moved past the board's 30-day TTL.
+select pg_temp.service();
+update agent_board.board_membership_events e
+   set created_at = now() - interval '31 days'
+  from _ob
+ where e.board_id = _ob.b_expire and e.agent_id = _ob.r
+   and e.provenance = 'target-authored' and e.result_state = 'requested';
+
+-- ===========================================================================
+-- list_my_board_requests: behaviour
+-- ===========================================================================
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+select lives_ok($$ insert into _req select 'R', * from agent_board.list_my_board_requests() $$,
+  'OB-L08: R lists its requests [call succeeds]');
+select pg_temp.claims('0b000000-0000-0000-0000-000000000003');
+select lives_ok($$ insert into _req select 'X', * from agent_board.list_my_board_requests() $$,
+  'OB-L09: X lists its requests [call succeeds]');
+
+select is(
+  (select string_agg(board_slug, ',' order by board_slug) from _req where who = 'R'),
+  'onb-approve,onb-expire,onb-reject,onb-rerequest',
+  'OB-L10: R sees exactly its four requested boards -- approved, rejected, re-requested and expired');
+select is((select membership_state from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_approve),
+  'joined', 'OB-L11: an approved request reads its current state, joined');
+select is((select membership_state from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_reject),
+  'left', 'OB-L12: a rejected request reads its current state, left (REJECTSEM)');
+select is((select membership_state || '/' || expired::text from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_expire),
+  'requested/true', 'OB-L13: a request older than join_request_ttl_days is returned with expired = true');
+select is((select count(*)::int from _req where who = 'R' and not expired),
+  3, 'OB-L14: the three requests inside the TTL are expired = false');
+select is(
+  (select membership_state || '/' || (select count(*) from _req q where q.who = 'R' and q.board_id = r.board_id)::text
+     from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_rerequest),
+  'requested/1',
+  'OB-L15: leave then re-request reads requested, in ONE row for the board');
+select is((select count(*)::int from _req r, _ob where r.who = 'R' and r.board_id in (_ob.b_other, _ob.b_human)),
+  0, 'OB-L16: another principal''s requests are invisible to R');
+select is(
+  (select pg_temp.state(_ob.b_invite, _ob.r) || '/' ||
+          (select count(*) from _req r where r.who = 'R' and r.board_id = _ob.b_invite)::text from _ob),
+  'joined/0',
+  'OB-L17: an invite-only join (R is joined) is NOT returned as a request');
+select is(
+  (select (r.board_name = 'ONB Approve' and r.expires_at = r.requested_at + interval '30 days')::text
+     from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_approve),
+  'true', 'OB-L18: a row carries the board name and expires_at = requested_at + join_request_ttl_days');
+select is(
+  (select string_agg(board_slug || '=' || membership_state, ',' order by board_slug) from _req where who = 'X'),
+  'onb-approve=requested,onb-other=requested',
+  'OB-L19: X sees only its own requests, with its own state on the shared board');
+
+select pg_temp.claims((select h_user::text from _ob));
+select lives_ok($$ insert into _req select 'H', * from agent_board.list_my_board_requests() $$,
+  'OB-L20: the Portal human session lists [call succeeds]');
+select is((select string_agg(board_slug || '=' || membership_state, ',') from _req where who = 'H'),
+  'onb-human=requested',
+  'OB-L21: a Portal human session sees its fed-human agent''s request');
+
+select pg_temp.service();
+select lives_ok($$ insert into _req select 'S', * from agent_board.list_my_board_requests() $$,
+  'OB-L22: a session with no caller identity calls the function [call succeeds]');
+select is((select count(*)::int from _req where who = 'S'),
+  0, 'OB-L23: a session with no caller identity lists nothing');
+
+-- ===========================================================================
+-- invite_board_for_display: catalog posture
+-- ===========================================================================
+select ok(to_regprocedure('agent_board.invite_board_for_display(text)') is not null,
+  'OB-I01: invite_board_for_display(text) exists');
+select is(
+  (select count(*)::int from pg_indexes
+    where schemaname = 'agent_board' and tablename = 'board_invite_tokens'
+      and indexname = 'idx_agent_board_board_invite_tokens_code_sha256'
+      and indexdef like '%digest(code, ''sha256''%'),
+  1, 'OB-I02: board_invite_tokens has the functional digest index');
+
+-- ===========================================================================
+-- Real operations on the links board
+-- ===========================================================================
+select pg_temp.claims('0b000000-0000-0000-0000-000000000001');
+do $$ begin perform agent_board.revoke_invite_link((select code_revoked from _ob)); end $$;
+select pg_temp.service();
+-- AGE fixture: a code minted by create_invite_link is moved past its expiry.
+update agent_board.board_invite_tokens t set expires_at = now() - interval '1 second'
+  from _ob where t.code = _ob.code_expired;
+
+select lives_ok($$ insert into _disp select 'exhaust-before', * from agent_board.invite_board_for_display(pg_temp.sha((select code_exhaust from _ob))) $$,
+  'OB-I03: the capped code is looked up before its last use [call succeeds]');
+
+-- Y spends the capped code's only use.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000004');
+do $$ begin perform agent_board.redeem_invite_link((select code_exhaust from _ob)); end $$;
+select pg_temp.service();
+
+select lives_ok($$
+  insert into _disp select 'live', * from agent_board.invite_board_for_display(pg_temp.sha((select code_live from _ob)));
+  insert into _disp select 'live-upper', * from agent_board.invite_board_for_display(upper(pg_temp.sha((select code_live from _ob))));
+  insert into _disp select 'revoked', * from agent_board.invite_board_for_display(pg_temp.sha((select code_revoked from _ob)));
+  insert into _disp select 'expired', * from agent_board.invite_board_for_display(pg_temp.sha((select code_expired from _ob)));
+  insert into _disp select 'exhausted', * from agent_board.invite_board_for_display(pg_temp.sha((select code_exhaust from _ob)));
+  insert into _disp select 'unknown', * from agent_board.invite_board_for_display(pg_temp.sha('onb-no-such-code'));
+$$, 'OB-I03b: every code is looked up [call succeeds]');
+
+select is((select count(*)::int from _disp where label = 'revoked'),
+  0, 'OB-I04: a revoked code returns no row');
+select is((select count(*)::int from _disp where label = 'expired'),
+  0, 'OB-I05: an expired code returns no row');
+select is(
+  (select uses_count::text || '/' || max_uses::text from agent_board.board_invite_tokens t, _ob where t.code = _ob.code_exhaust),
+  '1/1', 'OB-I06: the capped code was exhausted by a real redeem (uses_count = max_uses)');
+select is((select count(*)::int from _disp where label = 'exhausted'),
+  0, 'OB-I07: an exhausted code returns no row');
+select is((select count(*)::int from _disp where label = 'exhaust-before'),
+  1, 'OB-I08: the same code resolved while a use remained (the exhausted check is discriminating)');
+select is((select count(*)::int from _disp where label = 'unknown'),
+  0, 'OB-I09: an unknown digest returns no row');
+select is(
+  (select (d.board_id = _ob.b_links)::text || '/' || d.board_name || '/' || d.board_slug || '/' || d.preset_role
+     from _disp d, _ob where d.label = 'live'),
+  'true/ONB Links/onb-links/member',
+  'OB-I10: a usable code resolves to its board id, name, slug and preset role');
+select is((select count(*)::int from _disp where label = 'live-upper'),
+  1, 'OB-I11: the digest is compared case-insensitively');
+select is(has_function_privilege('service_role', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  true, 'OB-I12: service_role holds EXECUTE on invite_board_for_display');
+select is(has_function_privilege('authenticated', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  false, 'OB-I13: authenticated holds NO EXECUTE on invite_board_for_display');
+select is(has_function_privilege('anon', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  false, 'OB-I14: anon holds NO EXECUTE on invite_board_for_display');
+select is(has_function_privilege('public', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  false, 'OB-I15: PUBLIC holds NO EXECUTE on invite_board_for_display');
+select is(
+  (select p.prosecdef::text || '/' || p.provolatile::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'invite_board_for_display'),
+  'true/s',
+  'OB-I16: invite_board_for_display is SECURITY DEFINER and STABLE');
+
+-- ===========================================================================
+-- Redeem behaviour on the real RPC (EC-ONBOARD-1's pin)
+-- ===========================================================================
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+select lives_ok($$ select agent_board.redeem_invite_link((select code_replay from _ob)) $$,
+  'OB-R01: R redeems an unlimited invite [call succeeds]');
+select lives_ok($$ select agent_board.redeem_invite_link((select code_replay from _ob)) $$,
+  'OB-R02: R replays the same invite [call succeeds]');
+select is(
+  (select uses_count from agent_board.board_invite_tokens t, _ob where t.code = _ob.code_replay),
+  1, 'redeem_replay_no_use: replaying the same invite consumes no use');
+select lives_ok($$ select agent_board.redeem_invite_link((select code_other from _ob)) $$,
+  'OB-R03: R, already a member, redeems a different invite [call succeeds]');
+select pg_temp.service();
+select is(
+  (select pg_temp.state(_ob.b_links, _ob.r) || '/' || t.uses_count::text
+     from agent_board.board_invite_tokens t, _ob where t.code = _ob.code_other),
+  'joined/1', 'redeem_other_invite_consumes: redeeming a different invite while already a member consumes one');
+
+select * from finish();
+rollback;

package/tests/agent_board_rowid.test.sql

@@ -19,7 +19,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(99);
+select plan(100);
 
 create temp view _rowid_order_sites as
 with defs as (
@@ -506,9 +506,10 @@ select is(
   true,
   'control: fixture and structural block really runs as service_role');
 
--- 2. Catalog-derived inventory: eight membership readers plus the two task/message idempotency
--- readers. request_join_board joined the set in MBCONSENT-B(iii), and list_board_members joined
--- it in ROOMCONTRACT; both read board_memberships with the created_at DESC + id DESC tiebreak.
+-- 2. Catalog-derived inventory: nine membership readers plus the two task/message idempotency
+-- readers. request_join_board joined the set in MBCONSENT-B(iii), list_board_members joined
+-- it in ROOMCONTRACT, and list_my_board_requests joined it in ONBOARD (v11); all read
+-- board_memberships with the created_at DESC + id DESC tiebreak.
 select is(
   (select array_agg(proname order by proname)
      from _rowid_function_order_counts),
@@ -519,12 +520,13 @@ select is(
     'join_board',
     'list_board_members',
     'list_board_pending_memberships',
+    'list_my_board_requests',
     'post_board_message',
     'request_join_board',
     'resolve_board_request',
     'update_board_membership'
   ]::text[],
-  'live catalog exposes eight membership readers plus two task/message idempotency readers');
+  'live catalog exposes nine membership readers plus two task/message idempotency readers');
 
 -- 3-10. COUNT-EQUALITY, never substring containment.
 select is(
@@ -1313,6 +1315,17 @@ select is(
   array[2, 2],
   'list_board_members: BOTH created_at DESC sites (authorization + projection) have the id DESC tiebreak');
 
+-- 100. list_my_board_requests (ONBOARD v11, 20261007000100): one statement, two created_at
+-- DESC sites -- the lateral that picks the caller's current membership row (active-first),
+-- and the result order -- and both carry the id DESC tiebreak. The exact pair, as for 99,
+-- so a site that disappears is not read as agreement 0 = 0.
+select is(
+  (select array[created_at_desc_count, total_order_count]
+     from _rowid_function_order_counts
+    where proname = 'list_my_board_requests'),
+  array[2, 2],
+  'list_my_board_requests: BOTH created_at DESC sites (current row + result order) have the id DESC tiebreak');
+
 select finish();
 
 rollback;

package/tests/agent_board_signer_lifecycle.test.sql

@@ -727,6 +727,9 @@ select is(
      from agg
     where locks_agents and locks_memberships),
   array[
+    -- HOSTED (20261008000100): the fleet-ledger gate on the owner row-locks agents, and the sink
+    -- writes the delegate's membership. Serialised by the advisory lock, as grant_board_role is.
+    'add_delegate_to_board => serialised by the board advisory lock',
     -- Joined this class in #276 (20260909000100). The fleet-ledger gate row-locks the actor's
     -- agents row, so the live grant chokepoint -- and therefore every caller of it -- now locks
     -- both relations. It takes the advisory lock rather than arguing from its ordering: this

package/tests/agent_board_write_enforcement_class.test.sql

@@ -427,10 +427,13 @@ select distinct p.oid,
 -- 59 -> 60 with #521's agent_board.enroll_token_uses. Its only writer, _enroll_token_bind, is
 -- EXECUTE-able by no API role and is reached only from the service_role-only
 -- enroll_federated_identity, so it adds no member to the `authenticated` writer population.
+-- 60 -> 62 with HOSTED's delegate_instances and delegate_allowed_operations (20261008000100).
+-- Both are written only by service_role-only definers or the migration itself, so neither joins
+-- the `authenticated` writer population below.
 select is(
   (select count(*)::text from _wec_target where relkind = 'r'),
-  '60',
-  '#325 canary: agent_board has 60 base tables — the universe the write scan runs over, pinned so an empty violating set below cannot mean an empty universe');
+  '62',
+  '#325 canary: agent_board has 62 base tables — the universe the write scan runs over, pinned so an empty violating set below cannot mean an empty universe');
 
 -- WEC-2. The relations the class writes, as an EXACT SET. A new one names itself.
 select is(
@@ -489,6 +492,8 @@ select is( -- pgtap-allow-raise-checked
   array[
     'agent_board.acquire_claim(uuid,text,text,timestamp with time zone,uuid,uuid,jsonb)',
     'agent_board.add_artifact(uuid,text,text,text,uuid,uuid,uuid,uuid,jsonb)',
+    -- HOSTED (20261008000100): the owner places its hosted delegate through the sink.
+    'agent_board.add_delegate_to_board(uuid,uuid)',
     'agent_board.append_task_event(uuid,uuid,text,jsonb,text,uuid,timestamp with time zone)',
     'agent_board.block_board_inviter(uuid,uuid,uuid,jsonb)',
     'agent_board.create_board(uuid,text,text,text,jsonb,text)',
@@ -548,7 +553,7 @@ select is( -- pgtap-allow-raise-checked
     'agent_board.upsert_delegation_policy(uuid,text,jsonb,integer,interval,boolean)',
     'agent_board.verify_callback_endpoint(uuid,uuid,jsonb)'
     ]::text[],
-  '#325: the effect-derived class is exactly these 60 authenticated-executable writer OVERLOADS — per-OID, and TRANSITIVE, so a delegating wrapper whose own body holds no DML is a member rather than a blind spot');
+  '#325: the effect-derived class is exactly these 61 authenticated-executable writer OVERLOADS — per-OID, and TRANSITIVE, so a delegating wrapper whose own body holds no DML is a member rather than a blind spot');
 
 -- WEC-4. THE DELEGATION-CHAIN LIVENESS PIN, and the mitigation for the fail-open inversion the
 -- header describes. Everything above depends on `fn_call_closure()` actually resolving edges; a