@consiliency/agent-board-schema 1.59.0 → 1.63.0

package/tests/agent_board_session_identity_class.test.sql

@@ -0,0 +1,118 @@
+-- SIDSCHEMA catalog contract: these assertions enumerate the installed class
+-- from pg_catalog so a newly reachable identity writer names itself.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(21);
+
+select has_table('agent_board', 'session_identities', 'EC-SIDSCHEMA-1: identities table exists');
+select has_table('agent_board', 'session_id_aliases', 'EC-SIDSCHEMA-1: aliases table exists');
+select ok((select relrowsecurity from pg_class where oid = 'agent_board.session_identities'::regclass),
+  'EC-SIDSCHEMA-1: identity rows have RLS enabled');
+select ok((select relrowsecurity from pg_class where oid = 'agent_board.session_id_aliases'::regclass),
+  'EC-SIDSCHEMA-1: alias rows have RLS enabled');
+select has_column('agent_board', 'session_identities', 'credential_epoch',
+  'EC-SIDSCHEMA-1: identity lease epoch is stored');
+select has_column('agent_board', 'session_identities', 'holder_secret_hash',
+  'EC-SIDSCHEMA-1: only the holder-secret hash is stored');
+
+select is(
+  (select count(*) from pg_constraint c
+    where c.conrelid = 'agent_board.session_id_aliases'::regclass
+      and c.contype = 'u'
+      and pg_get_constraintdef(c.oid) like '%root_agent_id, harness, session_id%'),
+  1::bigint,
+  'EC-SIDSCHEMA-1: alias uniqueness covers root, harness and session id');
+
+select is(has_table_privilege('authenticated', 'agent_board.session_identities', 'SELECT'), false,
+  'EC-SIDSCHEMA-1: authenticated cannot read identity secrets');
+select is(has_table_privilege('authenticated', 'agent_board.session_id_aliases', 'INSERT'), false,
+  'EC-SIDSCHEMA-1: authenticated cannot write aliases directly');
+
+select is(has_function_privilege('service_role',
+  'agent_board.link_session_alias(uuid,text,text)', 'EXECUTE'), true,
+  'EC-SIDSCHEMA-1: service_role may invoke the verified alias linker');
+select is(has_function_privilege('authenticated',
+  'agent_board.link_session_alias(uuid,text,text)', 'EXECUTE'), false,
+  'EC-SIDSCHEMA-1: authenticated cannot invoke the asserted-id alias linker');
+select is(has_function_privilege('public',
+  'agent_board.link_session_alias(uuid,text,text)', 'EXECUTE'), false,
+  'EC-SIDSCHEMA-1: PUBLIC cannot invoke the asserted-id alias linker');
+
+select ok(
+  (select agent_board_test.stripped_body('agent_board.current_agent_id()'::regprocedure, true)
+      like '%request.jwt.claim.identity_lease_epoch%'
+     and agent_board_test.stripped_body('agent_board.current_agent_id()'::regprocedure, true)
+      like '%request.jwt.claims%'),
+  'EC-SIDSCHEMA-1: resolver reads the lease epoch from both JWT GUC forms');
+
+select ok(
+  (select exists (
+    select 1 from pg_trigger t
+     where t.tgrelid = 'agent_board.session_identities'::regclass
+       and not t.tgisinternal
+       and pg_get_triggerdef(t.oid) like '%identity_kind%immutable%')),
+  'EC-SIDSCHEMA-1: session identity kind has an immutable trigger');
+
+select is(
+  (select coalesce(string_agg(p.oid::regprocedure::text, ', ' order by p.oid::regprocedure::text), '')
+     from pg_proc p
+     join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and agent_board_test.stripped_body(p.oid, true) like '%session_identities%'
+      and (has_function_privilege('public', p.oid, 'EXECUTE')
+        or has_function_privilege('anon', p.oid, 'EXECUTE'))),
+  '',
+  'EC-SIDSCHEMA-1: catalog-derived identity-writer class exposes no public or anon entrypoint');
+
+-- Include every catalog-discovered identity/alias user and every named caller,
+-- not merely the new RPC names. Dynamic SQL and variable callees are outside
+-- fn_call_closure's documented literal-SQL model.
+create temp view _sid_catalog_direct as
+select p.oid, p.proname from pg_proc p
+where p.pronamespace = 'agent_board'::regnamespace
+  and (agent_board_test.stripped_body(p.oid) ~ agent_board_test.re(
+    agent_board_test.qname_frag('session_identities', agent_board_test.bare_ok(p.oid)) || '|'
+    || agent_board_test.qname_frag('session_id_aliases', agent_board_test.bare_ok(p.oid)))
+    or p.oid in (select t.tgfoid from pg_trigger t where not t.tgisinternal
+      and t.tgrelid in ('agent_board.session_identities'::regclass, 'agent_board.session_id_aliases'::regclass)));
+create temp view _sid_catalog_class as
+select distinct p.oid, p.proname
+from pg_proc p join agent_board_test.fn_call_closure() c on c.root_oid = p.oid
+join _sid_catalog_direct d on d.oid = c.reached_oid;
+select ok((select count(*) >= 12 from _sid_catalog_class),
+  'EC-SIDSCHEMA-6-catalog-nonempty: the derived identity/alias RPC and caller population is not empty');
+select is((select coalesce(string_agg(proname, ', ' order by proname), '') from _sid_catalog_class
+  where has_function_privilege('public', oid, 'EXECUTE') or has_function_privilege('anon', oid, 'EXECUTE')), '',
+  'EC-SIDSCHEMA-6-catalog-acl: no discovered identity or alias RPC/caller is PUBLIC or anon executable');
+-- Comments are the direct identity/alias API and trigger contract, not a new
+-- documentation requirement on all historical callers of current_agent_id().
+select is((select coalesce(string_agg(proname, ', ' order by proname), '') from _sid_catalog_direct
+  where nullif(obj_description(oid, 'pg_proc'), '') is null), '',
+  'EC-SIDSCHEMA-6-catalog-comment: every discovered direct identity or alias RPC/trigger has a catalog contract comment');
+select ok(has_function_privilege('service_role', 'agent_board.renew_session_identity(uuid,text)', 'EXECUTE')
+  and not has_function_privilege('authenticated', 'agent_board.renew_session_identity(uuid,text)', 'EXECUTE'),
+  'EC-SIDSCHEMA-6-renew-service: fresh caller-asserted renewal attestation is service-role-only');
+create function agent_board.sid_catalog_unsafe_probe(p_identity uuid)
+returns void language sql security definer set search_path = '' as $probe$
+  UPDATE agent_board.session_identities SET resolution_state = 'active' WHERE agent_id = p_identity;
+$probe$;
+create function agent_board.sid_catalog_wrapper_probe(p_identity uuid)
+returns void language sql security definer set search_path = '' as $probe$
+  SELECT agent_board.sid_catalog_unsafe_probe(/* commented wrapper */ p_identity);
+$probe$;
+select is((select string_agg(proname, ', ' order by proname) from _sid_catalog_class
+  where proname in ('sid_catalog_unsafe_probe', 'sid_catalog_wrapper_probe')
+    and has_function_privilege('public', oid, 'EXECUTE')),
+  'sid_catalog_unsafe_probe, sid_catalog_wrapper_probe',
+  'EC-SIDSCHEMA-6-catalog-acl-canary: new uppercase writer and commented wrapper expose themselves by their actual grants');
+select is((select string_agg(proname, ', ' order by proname) from _sid_catalog_class
+  where proname in ('sid_catalog_unsafe_probe', 'sid_catalog_wrapper_probe')
+    and obj_description(oid, 'pg_proc') is null),
+  'sid_catalog_unsafe_probe, sid_catalog_wrapper_probe',
+  'EC-SIDSCHEMA-6-catalog-comment-canary: each uncommented new member names itself');
+
+select finish();
+rollback;

package/tests/agent_board_session_identity_fingerprint.test.sql

@@ -0,0 +1,271 @@
+-- Fresh readings are recorded through trusted service wiring; approval actors
+-- still come from the forwarded verified subject and epoch, never an actor id.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(60);
+create temp table _sid_fp_root(root_id uuid, root_auth uuid, owner_auth uuid, suffix text);
+create temp table _sid_fp_children(label text primary key, agent_id uuid, key_id uuid, auth_id uuid);
+create temp table _sid_fp_claims(label text primary key, epoch bigint);
+do $$
+declare v_root uuid := gen_random_uuid(); v_owner uuid; v_auth uuid;
+begin
+  v_owner := public.ensure_github_user('sid-fp-owner-' || v_root, 'sid-fp-owner-' || v_root || '@example.test', 'sid-fp-owner-' || v_root, 'Fingerprint owner');
+  v_auth := public.ensure_github_user('sid-fp-root-' || v_root, 'sid-fp-root-' || v_root || '@example.test', 'sid-fp-root-' || v_root, 'Fingerprint root');
+  insert into agent_board.agents(agent_type, handle, display_name, status, auth_user_id)
+  values ('human', 'sid-fp-owner-' || v_root, 'Fingerprint owner', 'active', v_owner);
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_root, 'agent', 'sid-fp-root-' || v_root, 'Fingerprint root', 'active', v_auth, v_owner);
+  insert into agent_board.session_identities(agent_id, root_agent_id, depth)
+  values (v_root, v_root, 0);
+  insert into _sid_fp_root values (v_root, v_auth, v_owner, substr(v_root::text, 1, 8));
+end;
+$$;
+grant select on _sid_fp_root, _sid_fp_children, _sid_fp_claims to authenticated, service_role;
+grant insert on _sid_fp_children, _sid_fp_claims to service_role;
+create function pg_temp.sid_fp_subject(p_label text)
+returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claim.sub', coalesce((select auth_id::text from _sid_fp_children where label = p_label),
+    case when p_label = 'owner' then (select owner_auth::text from _sid_fp_root) else (select root_auth::text from _sid_fp_root) end), true);
+  perform set_config('request.jwt.claim.identity_lease_epoch', coalesce((select epoch::text from _sid_fp_claims where label = p_label), ''), true);
+end;
+$$;
+create function pg_temp.sid_fp_mint(p_label text, p_parent text default null)
+returns void language plpgsql as $$
+declare v_parent uuid; v_root record; v_result record; v_challenge record;
+begin
+  select * into v_root from _sid_fp_root;
+  v_parent := coalesce((select agent_id from _sid_fp_children where label = p_parent), v_root.root_id);
+  select * into v_result from agent_board.mint_delegated_child(v_parent, 'sid-fp-' || p_label || '-' || v_root.suffix,
+    '["read"]', public.test_pubkey(v_root.suffix || p_label), interval '8 hours', false, 'claude', 'fp-' || p_label,
+    (select epoch::text from _sid_fp_claims where label = p_parent), '[]',
+    '{"resolution":"resolved","risky_digest":"approved","recorded":{"version":"one"}}');
+  insert into _sid_fp_children select p_label, v_result.child_agent_id, v_result.signing_key_id, a.auth_user_id
+    from agent_board.agents a where a.id = v_result.child_agent_id;
+  select * into v_challenge from agent_board.issue_signing_key_challenge(v_result.child_agent_id, 'delegated-ephemeral');
+  insert into _sid_fp_claims select p_label, m.identity_lease_epoch from agent_board.mint_fleet_agent_session(
+    v_challenge.challenge_id, split_part(v_challenge.challenge, ':', 3), v_result.signing_key_id, v_result.child_agent_id, 900, null, 'fp-' || p_label) m;
+end;
+$$;
+create function pg_temp.sid_fp_refuse(p_sql text)
+returns void language plpgsql as $$
+begin
+  execute p_sql;
+  raise exception 'expected refusal but RPC succeeded' using errcode = 'P0001';
+end;
+$$;
+grant execute on function pg_temp.sid_fp_subject(text), pg_temp.sid_fp_refuse(text) to authenticated, service_role;
+grant execute on function pg_temp.sid_fp_mint(text,text) to service_role;
+select ok(has_function_privilege('service_role', 'agent_board.approve_identity_state(uuid,text,jsonb)', 'EXECUTE')
+  and not has_function_privilege('authenticated', 'agent_board.approve_identity_state(uuid,text,jsonb)', 'EXECUTE'),
+  'EC-SIDSCHEMA-5-approval-boundary: measured fingerprint inputs are service-only, with the human/ancestor subject preserved');
+select ok(has_function_privilege('service_role', 'agent_board.record_session_identity_state(uuid,jsonb)', 'EXECUTE')
+  and not has_function_privilege('authenticated', 'agent_board.record_session_identity_state(uuid,jsonb)', 'EXECUTE'),
+  'EC-SIDSCHEMA-5-reading-boundary: an end caller cannot assert a fresh fingerprint reading');
+select set_config('request.jwt.claims', '{}', true);
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sid_fp_root), 'root_minted', '["read"]', 200, interval '7 days', true)$q$,
+  'EC-SIDSCHEMA-5-fp-policy: real service policy prepares the fixture');
+reset role;
+select is((select count(*) from agent_board.delegation_policies where root_agent_id = (select root_id from _sid_fp_root)), 1::bigint,
+  'EC-SIDSCHEMA-5-fp-policy-state: one current policy exists');
+set local role service_role;
+select pg_temp.sid_fp_subject('root');
+select lives_ok($q$select agent_board.record_session_identity_state((select root_id from _sid_fp_root), '{"resolution":"resolved","risky_digest":"approved","recorded":{"version":"one"}}')$q$,
+  'EC-SIDSCHEMA-5-root-reading: trusted wiring records the root fresh reading');
+reset role;
+select ok((select approved_risky_digest is null and current_risky_digest = 'approved' and resolution_state = 'frozen'
+  from agent_board.session_identities where agent_id = (select root_id from _sid_fp_root)),
+  'EC-SIDSCHEMA-5-root-unapproved: a fresh root reading is never implicit human approval');
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select root_id from _sid_fp_root), 'approved', '{"resolution":"resolved"}')$q$),
+  '42501', 'identity approval requires the human owner', 'EC-SIDSCHEMA-5-depth-zero-agent: root agent cannot approve its own depth-zero state');
+reset role;
+select is((select approved_risky_digest from agent_board.session_identities where agent_id = (select root_id from _sid_fp_root)), null::text,
+  'EC-SIDSCHEMA-5-depth-zero-state: agent refusal left human approval absent');
+set local role service_role;
+select pg_temp.sid_fp_subject('owner');
+select lives_ok($q$select agent_board.approve_identity_state((select root_id from _sid_fp_root), 'approved', '{"resolution":"resolved"}')$q$,
+  'EC-SIDSCHEMA-5-owner-root-control: verified human owner approves the resolved root');
+reset role;
+select ok((select resolution_state = 'active' and approved_risky_digest = 'approved' from agent_board.session_identities where agent_id = (select root_id from _sid_fp_root)),
+  'EC-SIDSCHEMA-5-owner-root-state: explicit owner approval activates the root');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_fp_mint('parent'); select pg_temp.sid_fp_mint('sibling'); select pg_temp.sid_fp_mint('child', 'parent')$q$,
+  'EC-SIDSCHEMA-5-fp-fixture: real matching child mints and claims create parent, sibling and depth-two subject');
+reset role;
+select is((select count(*) from agent_board.session_identities si join _sid_fp_children c on c.agent_id = si.agent_id
+  where si.approved_risky_digest = 'approved' and si.current_risky_digest = 'approved' and si.resolution_state = 'active'), 3::bigint,
+  'EC-SIDSCHEMA-5-autoapprove-state: matching owner-approved parent digest is inherited by each real child');
+set local role service_role;
+select pg_temp.sid_fp_subject('parent');
+select lives_ok($q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'approved', '{"resolution":"resolved"}')$q$,
+  'EC-SIDSCHEMA-5-parent-control: non-frozen matching approved parent may approve its child');
+reset role;
+select is((select approved_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'approved',
+  'EC-SIDSCHEMA-5-parent-state: parent approval stores the matching digest');
+set local role service_role;
+select pg_temp.sid_fp_subject('sibling');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'approved', '{"resolution":"resolved"}')$q$),
+  '42501', 'identity approval requires the owner or an approved ancestor', 'EC-SIDSCHEMA-5-sibling-approver: a live approved sibling is not an ancestor');
+select pg_temp.sid_fp_subject('child');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'approved', '{"resolution":"resolved"}')$q$),
+  '42501', 'identity approval requires the owner or an approved ancestor', 'EC-SIDSCHEMA-5-self-approver: a live approved child is not its own ancestor');
+reset role;
+select is((select approved_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'approved',
+  'EC-SIDSCHEMA-5-actor-refusal-state: refused sibling/self calls leave approval unchanged');
+set local role service_role;
+select pg_temp.sid_fp_subject('parent');
+select lives_ok($q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'parent'), '{"resolution":"resolved","risky_digest":"parent-changed","recorded":{"version":"one"}}')$q$,
+  'EC-SIDSCHEMA-5-parent-reading: a trusted risky change is recorded without aborting its transaction');
+reset role;
+select ok((select current_risky_digest = 'parent-changed' and approved_risky_digest = 'approved' and resolution_state = 'frozen'
+  from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'parent')),
+  'EC-SIDSCHEMA-5-risky-freeze: committed risky reading freezes identity without replacing the approved digest');
+set local role service_role;
+select lives_ok($q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'parent'), '{"resolution":"resolved","risky_digest":"approved","recorded":{"version":"one"}}')$q$,
+  'EC-SIDSCHEMA-5-frozen-equal-control: restoring the old bytes records a reading, not a new approval');
+reset role;
+select ok((select resolution_state = 'frozen' and approved_risky_digest = current_risky_digest
+  from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'parent')),
+  'EC-SIDSCHEMA-5-frozen-equal-state: frozen approver fixture has equal digests, isolating the freeze gate');
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'approved', '{"resolution":"resolved"}')$q$),
+  '42501', 'identity approval requires the owner or an approved ancestor', 'EC-SIDSCHEMA-5-frozen-approver: frozen parent cannot approve a child');
+reset role;
+select is((select approved_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'approved',
+  'EC-SIDSCHEMA-5-frozen-approver-state: child approval stayed unchanged');
+set local role service_role;
+select lives_ok($q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'parent'), '{"resolution":"resolved","risky_digest":"parent-changed","recorded":{}}')$q$,
+  'EC-SIDSCHEMA-5-parent-current-control: changed bytes are read again before owner approval');
+reset role;
+select is((select current_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'parent')), 'parent-changed',
+  'EC-SIDSCHEMA-5-parent-current-state: owner approval uses the latest actual reading');
+set local role service_role;
+select pg_temp.sid_fp_subject('owner');
+select lives_ok($q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'parent'), 'parent-changed', '{"resolution":"resolved"}')$q$,
+  'EC-SIDSCHEMA-5-owner-change-control: human owner can approve a new resolved risky digest');
+reset role;
+select is((select approved_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'parent')), 'parent-changed',
+  'EC-SIDSCHEMA-5-owner-change-state: parent now has different owner-approved authority');
+set local role service_role;
+select pg_temp.sid_fp_subject('parent');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'approved', '{"resolution":"resolved"}')$q$),
+  '42501', 'identity approval requires the owner or an approved ancestor', 'EC-SIDSCHEMA-5-parent-digest: parent approval must match its own current owner-approved risky digest');
+reset role;
+select is((select approved_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'approved',
+  'EC-SIDSCHEMA-5-parent-digest-state: mismatched parent cannot replace child approval');
+set local role service_role;
+select pg_temp.sid_fp_subject('owner');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'child'), '{"resolution":"resolved","risky_digest":"fabricated"}')$q$),
+  '42501', 'identity_lease_not_held', 'EC-SIDSCHEMA-5-reading-subject: another forwarded principal cannot record this identity state');
+reset role;
+select is((select current_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'approved',
+  'EC-SIDSCHEMA-5-reading-subject-state: mismatched subject left current reading untouched');
+set local role service_role;
+select pg_temp.sid_fp_subject('child');
+select set_config('request.jwt.claim.identity_lease_epoch', '99', true);
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'child'), '{"resolution":"resolved","risky_digest":"fabricated"}')$q$),
+  '42501', 'identity_lease_not_held', 'EC-SIDSCHEMA-5-reading-epoch: stale forwarded epoch cannot record a new reading');
+reset role;
+select is((select current_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'approved',
+  'EC-SIDSCHEMA-5-reading-epoch-state: stale epoch left current reading untouched');
+set local role service_role;
+select pg_temp.sid_fp_subject('child');
+select lives_ok($q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'child'), '{"resolution":"resolved","risky_digest":"approved","recorded":{"version":"two","model":"another"}}')$q$,
+  'EC-SIDSCHEMA-5-recorded-control: fresh recorded-only inputs are accepted');
+reset role;
+select ok((select resolution_state = 'active' and approved_risky_digest = 'approved' and current_risky_digest = 'approved'
+  and recorded_fingerprint ->> 'version' = 'two' from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')),
+  'EC-SIDSCHEMA-5-recorded-only: recorded change is stored without freezing or changing risky approval');
+set local role service_role;
+select lives_ok($q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'child'), '{"resolution":"resolved","risky_digest":"child-changed","recorded":{"version":"two"}}')$q$,
+  'EC-SIDSCHEMA-5-child-reading: trusted reading persists the child risky change');
+reset role;
+select ok((select resolution_state = 'frozen' and approved_risky_digest = 'approved' and current_risky_digest = 'child-changed'
+  from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')),
+  'EC-SIDSCHEMA-5-child-freeze: child risky change is durably frozen before the next protected action');
+select set_config('request.jwt.claim.role', 'authenticated', true);
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.heartbeat_session_identity((select agent_id from _sid_fp_children where label = 'child'))$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-fresh-action: real stored risky change blocks authenticated heartbeat');
+reset role;
+select is((select resolution_state from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'frozen',
+  'EC-SIDSCHEMA-5-fresh-action-state: refusal cannot roll back the earlier stored reading');
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select pg_temp.sid_fp_subject('owner');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'child-changed', '{"resolution":"unresolved"}')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-input-unresolved: a fresh unresolved input refuses even when the previous reading was resolved');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'child-changed')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-input-missing: a missing fresh resolution refuses even with a resolved stored reading');
+reset role;
+select is((select approved_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'approved',
+  'EC-SIDSCHEMA-5-input-refusal-state: neither missing nor unresolved input approved new bytes');
+set local role service_role;
+select pg_temp.sid_fp_subject('child');
+select lives_ok($q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'child'), '{"resolution":"unresolved","risky_digest":"child-changed","recorded":{"version":"two"}}')$q$,
+  'EC-SIDSCHEMA-5-unresolved-reading: unresolved hook or registration state is recorded without approval');
+reset role;
+select ok((select resolution_state = 'frozen' and recorded_fingerprint ->> 'resolution' = 'unresolved'
+  from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')),
+  'EC-SIDSCHEMA-5-unresolved-state: unresolved reading remains frozen and explicitly recorded');
+set local role service_role;
+select pg_temp.sid_fp_subject('owner');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'child-changed', '{"resolution":"unresolved"}')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-unresolved-approval: human owner cannot approve unresolved inputs');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'child-changed')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-missing-resolution: omitted resolution never defaults to resolved');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'child-changed', '{"resolution":"resolved"}')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-stored-unresolved: stale unresolved reading cannot be approved by changing only approval metadata');
+reset role;
+select is((select approved_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'approved',
+  'EC-SIDSCHEMA-5-resolution-refusal-state: all unresolved/missing refusals preserve prior approval');
+set local role service_role;
+select pg_temp.sid_fp_subject('child');
+select lives_ok($q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'child'), '{"resolution":"resolved","risky_digest":"child-changed","recorded":{"version":"two"}}')$q$,
+  'EC-SIDSCHEMA-5-resolved-control: corrected hook gets a fresh resolved reading');
+reset role;
+select is((select resolution_state from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'frozen',
+  'EC-SIDSCHEMA-5-resolved-pending: resolving inputs alone does not approve a changed risky digest');
+set local role service_role;
+select pg_temp.sid_fp_subject('owner');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'fabricated', '{"resolution":"resolved"}')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-reading-digest: approval cannot substitute an unrecorded risky digest');
+reset role;
+select is((select current_risky_digest from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 'child-changed',
+  'EC-SIDSCHEMA-5-reading-digest-state: refusal retains the actually recorded risky digest');
+set local role service_role;
+select lives_ok($q$select agent_board.approve_identity_state((select agent_id from _sid_fp_children where label = 'child'), 'child-changed', '{"resolution":"resolved"}')$q$,
+  'EC-SIDSCHEMA-5-owner-child-control: human owner approves the now-resolved changed child');
+reset role;
+select ok((select resolution_state = 'active' and approved_risky_digest = current_risky_digest
+  from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')),
+  'EC-SIDSCHEMA-5-owner-child-state: explicit resolved approval thaws the child');
+set local role service_role;
+select pg_temp.sid_fp_subject('parent');
+select lives_ok($q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'parent'), '{"resolution":"resolved","risky_digest":"parent-new","recorded":{}}')$q$,
+  'EC-SIDSCHEMA-5-frozen-revoker-control: parent becomes frozen again through an actual new reading');
+reset role;
+select is((select resolution_state from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'parent')), 'frozen',
+  'EC-SIDSCHEMA-5-frozen-revoker-state: actor is positively frozen, not merely named');
+select set_config('request.jwt.claim.role', 'authenticated', true);
+set local role authenticated;
+select lives_ok($q$select agent_board.revoke_session_identity((select agent_id from _sid_fp_children where label = 'child'))$q$,
+  'EC-SIDSCHEMA-5-frozen-ancestor-revoke: any ancestor may revoke even when approval is frozen');
+reset role;
+select ok((select tombstoned_at is not null from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')),
+  'EC-SIDSCHEMA-5-frozen-ancestor-revoke-state: selected child was permanently tombstoned');
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select pg_temp.sid_fp_subject('child');
+select throws_ok(format('select pg_temp.sid_fp_refuse(%L)', $q$select agent_board.record_session_identity_state((select agent_id from _sid_fp_children where label = 'child'), '{"resolution":"resolved","risky_digest":"child-changed"}')$q$),
+  '42501', 'identity_tombstoned', 'EC-SIDSCHEMA-5-reading-tombstone: recording cannot revive a revoked context');
+reset role;
+select is((select credential_epoch from agent_board.session_identities where agent_id = (select agent_id from _sid_fp_children where label = 'child')), 1::bigint,
+  'EC-SIDSCHEMA-5-reading-tombstone-state: refused recording preserves the revocation epoch');
+select finish();
+rollback;

package/tests/agent_board_session_identity_labels_limits.test.sql

@@ -0,0 +1,205 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+grant usage on schema extensions to authenticated;
+select plan(30);
+
+insert into auth.users(id, instance_id, aud, role, email)
+values
+  ('9a000000-0000-4000-8000-000000000001', '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'sid-label-admin@test.invalid'),
+  ('9a000000-0000-4000-8000-000000000002', '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'sid-label-member@test.invalid'),
+  ('9a000000-0000-4000-8000-000000000003', '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'sid-label-outsider@test.invalid');
+
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+values
+  ('9b000000-0000-4000-8000-000000000001', 'agent', 'agent', 'sid-label-admin', 'Board admin', 'active', '9a000000-0000-4000-8000-000000000001'),
+  ('9b000000-0000-4000-8000-000000000002', 'agent', 'agent', 'sid-label-member', 'Member display', 'active', '9a000000-0000-4000-8000-000000000002'),
+  ('9b000000-0000-4000-8000-000000000003', 'agent', 'agent', 'sid-label-outsider', 'Outsider', 'active', '9a000000-0000-4000-8000-000000000003');
+
+insert into agent_board.boards(id, name, slug, created_by_agent_id)
+values
+  ('9c000000-0000-4000-8000-000000000001', 'SID label board', 'sid-label-board', '9b000000-0000-4000-8000-000000000001'),
+  ('9c000000-0000-4000-8000-000000000002', 'SID other board', 'sid-other-board', '9b000000-0000-4000-8000-000000000003');
+
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+values
+  ('9c000000-0000-4000-8000-000000000001', '9b000000-0000-4000-8000-000000000001', 'admin', 'joined', '9b000000-0000-4000-8000-000000000001'),
+  ('9c000000-0000-4000-8000-000000000001', '9b000000-0000-4000-8000-000000000002', 'member', 'joined', '9b000000-0000-4000-8000-000000000001'),
+  ('9c000000-0000-4000-8000-000000000002', '9b000000-0000-4000-8000-000000000003', 'owner', 'joined', '9b000000-0000-4000-8000-000000000003');
+
+select set_config('request.jwt.claims', json_build_object(
+  'role', 'authenticated', 'sub', '9a000000-0000-4000-8000-000000000001'
+)::text, true);
+
+create temp table _label_before on commit drop as
+select count(*)::int as event_count from agent_board.board_membership_events
+ where board_id = '9c000000-0000-4000-8000-000000000001';
+
+select lives_ok(
+  $$select agent_board.set_board_member_label(
+    '9c000000-0000-4000-8000-000000000001',
+    '9b000000-0000-4000-8000-000000000002', 'Local label')$$,
+  'EC-SIDSCHEMA-6-label-authorized: a board admin may set a label on a membership in that board'
+);
+
+select is(
+  (select metadata ->> 'label' from agent_board.board_memberships
+    where board_id = '9c000000-0000-4000-8000-000000000001'
+      and agent_id = '9b000000-0000-4000-8000-000000000002'),
+  'Local label',
+  'EC-SIDSCHEMA-6-label-local: the label is stored on the selected board membership'
+);
+select throws_ok($$select agent_board.set_board_member_label(
+  '9c000000-0000-4000-8000-000000000001','9b000000-0000-4000-8000-000000000002',repeat('x',201))$$,
+  '22023','board label exceeds 200 characters','R1-label-length: oversized board-local label is refused');
+select is((select metadata->>'label' from agent_board.board_memberships
+  where board_id='9c000000-0000-4000-8000-000000000001' and agent_id='9b000000-0000-4000-8000-000000000002'),
+  'Local label','R1-label-length-refusal-state: refusal preserves the existing label');
+select lives_ok($$select agent_board.set_board_member_label(
+  '9c000000-0000-4000-8000-000000000001','9b000000-0000-4000-8000-000000000002',repeat('x',200))$$,
+  'R1-label-boundary-control: exact 200-character boundary is allowed');
+select is((select length(metadata->>'label') from agent_board.board_memberships
+  where board_id='9c000000-0000-4000-8000-000000000001' and agent_id='9b000000-0000-4000-8000-000000000002'),
+  200,'R1-label-boundary-state: exact boundary is stored');
+
+select is(
+  (select membership_state || '/' || role from agent_board.board_memberships
+    where board_id = '9c000000-0000-4000-8000-000000000001'
+      and agent_id = '9b000000-0000-4000-8000-000000000002'),
+  'joined/member',
+  'EC-SIDSCHEMA-6-label-state: a label changes neither membership state nor role'
+);
+
+select is(
+  (select count(*)::int from agent_board.board_membership_events
+    where board_id = '9c000000-0000-4000-8000-000000000001'),
+  (select event_count from _label_before),
+  'EC-SIDSCHEMA-6-label-no-consent-event: metadata-only labels create no membership transition event'
+);
+
+select is(
+  (select handle || '/' || display_name from agent_board.agents
+    where id = '9b000000-0000-4000-8000-000000000002'),
+  'sid-label-member/Member display',
+  'EC-SIDSCHEMA-6-label-no-global-name: a local label changes neither handle nor display name'
+);
+
+select throws_ok(
+  $$select agent_board.set_board_member_label(
+    '9c000000-0000-4000-8000-000000000001',
+    '9b000000-0000-4000-8000-000000000003', 'Cross-board')$$,
+  'P0002', 'membership not found on this board',
+  'EC-SIDSCHEMA-6-label-cross-board: an admin cannot label an identity with no membership on that board'
+);
+
+select set_config('request.jwt.claims', json_build_object(
+  'role', 'authenticated', 'sub', '9a000000-0000-4000-8000-000000000002'
+)::text, true);
+
+select throws_ok(
+  $$select agent_board.set_board_member_label(
+    '9c000000-0000-4000-8000-000000000001',
+    '9b000000-0000-4000-8000-000000000002', 'Unauthorized')$$,
+  '42501', 'board label requires a board owner or admin',
+  'EC-SIDSCHEMA-6-label-authority: a non-admin membership cannot set a local label'
+);
+
+create temp table _sid_labels(owner_auth uuid, other_auth uuid, target_auth uuid,
+  owner_id uuid, other_id uuid, target_id uuid, board_a uuid, board_b uuid, handle text);
+do $$
+declare r _sid_labels%rowtype; s text := gen_random_uuid()::text;
+begin
+  r.owner_auth := public.ensure_github_user('sid-label-owner-' || s, 'owner-' || s || '@example.test', 'owner-' || s, 'Owner');
+  r.other_auth := public.ensure_github_user('sid-label-other-' || s, 'other-' || s || '@example.test', 'other-' || s, 'Other');
+  r.target_auth := public.ensure_github_user('sid-label-target-' || s, 'target-' || s || '@example.test', 'target-' || s, 'Target');
+  r.owner_id := gen_random_uuid(); r.other_id := gen_random_uuid(); r.target_id := gen_random_uuid();
+  r.board_a := gen_random_uuid(); r.board_b := gen_random_uuid(); r.handle := 'sid-label-target-' || s;
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (r.owner_id, 'human', 'sid-label-owner-' || s, 'Owner', 'active', r.owner_auth, null),
+    (r.other_id, 'human', 'sid-label-other-' || s, 'Other', 'active', r.other_auth, null),
+    (r.target_id, 'agent', r.handle, 'Original', 'active', r.target_auth, r.owner_auth);
+  insert into agent_board.boards(id, slug, name, created_by_agent_id)
+  values (r.board_a, 'sid-label-a-' || s, 'Label A', r.owner_id),
+    (r.board_b, 'sid-label-b-' || s, 'Label B', r.other_id);
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role)
+  values (r.board_a, r.owner_id, 'joined', 'admin'), (r.board_b, r.owner_id, 'joined', 'observer'),
+    (r.board_b, r.other_id, 'joined', 'admin'), (r.board_a, r.target_id, 'joined', 'member'),
+    (r.board_b, r.target_id, 'joined', 'member');
+  insert into _sid_labels select r.*;
+end;
+$$;
+grant select on _sid_labels to authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select owner_auth::text from _sid_labels), true);
+set local role authenticated;
+select lives_ok('select agent_board.rename_agent((select target_id from _sid_labels), ''Owned name'')',
+  'EC-SIDSCHEMA-6-rename-owner: human owner can rename the global display name');
+reset role;
+select is((select display_name from agent_board.agents where id = (select target_id from _sid_labels)), 'Owned name',
+  'EC-SIDSCHEMA-6-rename-state: the requested global display name is stored');
+select is((select handle from agent_board.agents where id = (select target_id from _sid_labels)), (select handle from _sid_labels),
+  'EC-SIDSCHEMA-6-rename-handle: global rename never changes the unique handle');
+select set_config('request.jwt.claim.sub', (select other_auth::text from _sid_labels), true);
+set local role authenticated;
+select throws_ok('select agent_board.rename_agent((select target_id from _sid_labels), ''Stolen name'')',
+  '42501', 'agent rename requires the human owner', 'EC-SIDSCHEMA-6-rename-nonowner: unrelated board admin cannot rename globally');
+reset role;
+select is((select display_name from agent_board.agents where id = (select target_id from _sid_labels)), 'Owned name',
+  'EC-SIDSCHEMA-6-rename-refusal-state: non-owner refusal leaves the global name unchanged');
+select set_config('request.jwt.claim.sub', (select target_auth::text from _sid_labels), true);
+set local role authenticated;
+select throws_ok('select agent_board.rename_agent((select target_id from _sid_labels), ''Self renamed'')',
+  '42501', 'agent rename requires the human owner', 'EC-SIDSCHEMA-6-rename-agent: agent credential cannot exercise human-owner rename');
+reset role;
+select set_config('request.jwt.claim.sub', (select owner_auth::text from _sid_labels), true);
+set local role authenticated;
+select throws_ok('select agent_board.rename_agent((select target_id from _sid_labels), '''')',
+  '22023', 'display name is required', 'EC-SIDSCHEMA-6-rename-empty: empty global display name is refused');
+select lives_ok('select agent_board.set_board_member_label((select board_a from _sid_labels), (select target_id from _sid_labels), ''Local A'')',
+  'EC-SIDSCHEMA-6-label-admin: active admin labels a member on its own board');
+reset role;
+select is((select metadata ->> 'label' from agent_board.board_memberships where board_id = (select board_a from _sid_labels) and agent_id = (select target_id from _sid_labels)), 'Local A',
+  'EC-SIDSCHEMA-6-label-metadata-state: requested label is stored on the named membership');
+select is((select metadata ->> 'label' from agent_board.board_memberships where board_id = (select board_b from _sid_labels) and agent_id = (select target_id from _sid_labels)), null::text,
+  'EC-SIDSCHEMA-6-label-other-state: label never writes another board membership');
+select ok((select display_name = 'Owned name' and handle = (select handle from _sid_labels) from agent_board.agents where id = (select target_id from _sid_labels)),
+  'EC-SIDSCHEMA-6-label-global-state: board label never changes global name or handle');
+set local role authenticated;
+select throws_ok('select agent_board.set_board_member_label((select board_b from _sid_labels), (select target_id from _sid_labels), ''Cross board'')',
+  '42501', 'board label requires a board owner or admin', 'EC-SIDSCHEMA-6-label-cross-board-actor: admin on A cannot label on B as an observer');
+reset role;
+select is((select metadata ->> 'label' from agent_board.board_memberships where board_id = (select board_b from _sid_labels) and agent_id = (select target_id from _sid_labels)), null::text,
+  'EC-SIDSCHEMA-6-label-refusal-state: cross-board refusal preserves the other membership');
+select set_config('request.jwt.claim.sub', (select other_auth::text from _sid_labels), true);
+set local role authenticated;
+select lives_ok('select agent_board.set_board_member_label((select board_b from _sid_labels), (select target_id from _sid_labels), ''Local B'')',
+  'EC-SIDSCHEMA-6-label-other-admin: B admin independently labels on B');
+reset role;
+select is((select metadata ->> 'label' from agent_board.board_memberships where board_id = (select board_b from _sid_labels) and agent_id = (select target_id from _sid_labels)), 'Local B',
+  'EC-SIDSCHEMA-6-label-other-admin-state: independent board-local label is stored');
+set local role authenticated;
+select throws_ok('select agent_board.set_board_member_label((select board_a from _sid_labels), (select target_id from _sid_labels), ''Wrong board'')',
+  '42501', 'board label requires a board owner or admin', 'EC-SIDSCHEMA-6-label-unjoined: another board admin with no membership on A is refused');
+reset role;
+-- Historical inconsistent role state: install only in this rolled-back scratch
+-- fixture, without the normal role-reset trigger repairing it before the gate.
+alter table agent_board.board_memberships disable trigger user;
+update agent_board.board_memberships set membership_state = 'left', left_at = now(), role = 'admin' where board_id = (select board_a from _sid_labels) and agent_id = (select owner_id from _sid_labels);
+alter table agent_board.board_memberships enable trigger user;
+select ok((select membership_state = 'left' and role = 'admin' from agent_board.board_memberships where board_id = (select board_a from _sid_labels) and agent_id = (select owner_id from _sid_labels)),
+  'EC-SIDSCHEMA-6-label-inactive-fixture: retained admin role cannot stand in for active membership');
+select set_config('request.jwt.claim.sub', (select owner_auth::text from _sid_labels), true);
+set local role authenticated;
+select throws_ok('select agent_board.set_board_member_label((select board_a from _sid_labels), (select target_id from _sid_labels), ''Inactive admin'')',
+  '42501', 'board label requires a board owner or admin', 'EC-SIDSCHEMA-6-label-inactive: departed admin cannot label using its retained role');
+reset role;
+update agent_board.agents set status = 'suspended' where id = (select owner_id from _sid_labels);
+set local role authenticated;
+select throws_ok('select agent_board.set_board_member_label((select board_a from _sid_labels), (select target_id from _sid_labels), ''Suspended admin'')',
+  '42501', 'board label requires a board owner or admin', 'EC-SIDSCHEMA-6-label-suspended: suspended principal has no label authority');
+reset role;
+
+select * from finish();
+rollback;