@consiliency/agent-board-schema 1.59.0 → 1.63.0

package/tests/agent_board_sidowner_read_class.test.sql

@@ -0,0 +1,171 @@
+-- SIDOWNER read surface: catalog-derived projection and ACL claims.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(24);
+
+select has_function('agent_board', 'list_session_children', array['uuid'],
+  'EC-SIDOWNER-1: scoped children reader exists');
+select has_function('agent_board', 'get_session_identity_state', array['uuid'],
+  'EC-SIDOWNER-1: scoped state reader exists');
+select ok(has_function_privilege('authenticated', 'agent_board.list_session_children(uuid)', 'EXECUTE')
+  and has_function_privilege('service_role', 'agent_board.list_session_children(uuid)', 'EXECUTE')
+  and not has_function_privilege('public', 'agent_board.list_session_children(uuid)', 'EXECUTE')
+  and not has_function_privilege('anon', 'agent_board.list_session_children(uuid)', 'EXECUTE'),
+  'EC-SIDOWNER-1: children reader is authenticated/service-only');
+select ok(has_function_privilege('authenticated', 'agent_board.get_session_identity_state(uuid)', 'EXECUTE')
+  and has_function_privilege('service_role', 'agent_board.get_session_identity_state(uuid)', 'EXECUTE')
+  and not has_function_privilege('public', 'agent_board.get_session_identity_state(uuid)', 'EXECUTE')
+  and not has_function_privilege('anon', 'agent_board.get_session_identity_state(uuid)', 'EXECUTE'),
+  'EC-SIDOWNER-1: state reader is authenticated/service-only');
+select is(has_table_privilege('authenticated', 'agent_board.session_identities', 'SELECT'), false,
+  'EC-SIDOWNER-1: readers do not relax identity table ACL');
+select is(has_table_privilege('authenticated', 'agent_board.session_id_aliases', 'SELECT'), false,
+  'EC-SIDOWNER-1: readers do not expose aliases');
+select ok(agent_board_test.stripped_body('agent_board.list_session_children(uuid)'::regprocedure, true)
+  like '%parent_agent_id%' and agent_board_test.stripped_body('agent_board.list_session_children(uuid)'::regprocedure, true)
+  not like '%forked_from%',
+  'EC-SIDOWNER-1: children traversal uses only parent lineage');
+select ok(pg_get_function_result('agent_board.get_session_identity_state(uuid)'::regprocedure)
+  !~ 'holder_secret_hash|credential_epoch|session_id_aliases|agent_credentials',
+  'EC-SIDOWNER-1: state projection excludes secrets and credential material');
+select ok(agent_board_test.stripped_body('agent_board._session_identity_read_allowed(uuid)'::regprocedure, true)
+  like '%_session_identity_owner%' and agent_board_test.stripped_body('agent_board._session_identity_read_allowed(uuid)'::regprocedure, true)
+  like '%current_agent_id%',
+  'EC-SIDOWNER-1: reader authorizes verified owner or lineage actor');
+select is(
+  (select coalesce(string_agg(p.oid::regprocedure::text, ', ' order by p.oid::regprocedure::text), '')
+     from pg_proc p
+     where p.pronamespace = 'agent_board'::regnamespace
+       and p.proname in ('list_session_children', 'get_session_identity_state')
+       and (has_function_privilege('public', p.oid, 'EXECUTE') or has_function_privilege('anon', p.oid, 'EXECUTE'))),
+  '', 'EC-SIDOWNER-1: catalog reader class has no public or anon route');
+select ok((select count(*) = 2 from pg_proc p where p.pronamespace = 'agent_board'::regnamespace
+  and p.proname in ('list_session_children', 'get_session_identity_state')),
+  'EC-SIDOWNER-1: catalog reader population is exact');
+select ok((select count(*) = 2 from pg_proc p where p.pronamespace = 'agent_board'::regnamespace
+  and p.proname in ('list_session_children', 'get_session_identity_state') and obj_description(p.oid, 'pg_proc') is not null),
+  'EC-SIDOWNER-1: every public SIDOWNER reader has a catalog contract');
+
+-- Discover table users and literal callers by effect, including private helpers.
+-- current_agent_id exposes only the existing fenced principal UUID, not readings;
+-- its positive classification is asserted below, not exempted from discovery.
+create temp table _owner_fns as
+select p.*, agent_board_test.stripped_body(p.oid) as body,
+  agent_board_test.stripped_body(p.oid,true) as literals
+from pg_proc p where p.pronamespace='agent_board'::regnamespace and p.prokind='f';
+create temp table _owner_calls as select * from agent_board_test.fn_call_closure();
+create temp view _owner_direct as
+select f.* from _owner_fns f where f.body ~ agent_board_test.re(
+  agent_board_test.qname_frag('session_identities',agent_board_test.bare_ok(f.oid)) || '|'
+  || agent_board_test.qname_frag('session_id_aliases',agent_board_test.bare_ok(f.oid)));
+create temp table _owner_dml as
+select distinct f.oid from _owner_fns f join pg_class t on t.relnamespace='agent_board'::regnamespace
+  and t.relkind in ('r','p') where f.body ~ agent_board_test.re(
+    agent_board_test.qname_frag(t.relname,agent_board_test.bare_ok(f.oid)))
+  and f.body ~ agent_board_test.re(
+    agent_board_test.write_frag(t.relname,agent_board_test.bare_ok(f.oid)));
+create temp view _owner_mutators as
+select distinct c.root_oid as oid from _owner_calls c
+join _owner_dml w on w.oid=c.reached_oid join _owner_fns f on f.oid=c.root_oid
+where not has_function_privilege('authenticated',f.oid,'EXECUTE')
+  or pg_get_function_result(f.oid) not in ('json','jsonb','record');
+create temp view _owner_principal as
+select f.oid from _owner_direct f where f.proname='current_agent_id'
+  and pg_get_function_result(f.oid)='uuid'
+  and f.body ~ agent_board_test.call_re('auth.uid',false)
+  and f.literals like '%identity_kind is distinct from ''session'' or c.lease_epoch = si.credential_epoch::text%';
+create temp view _owner_internal as
+select f.oid from _owner_direct f
+where pg_get_function_result(f.oid) in ('boolean','void','trigger','timestamp with time zone')
+  and not has_function_privilege('authenticated',f.oid,'EXECUTE')
+  and not has_function_privilege('public',f.oid,'EXECUTE')
+  and not has_function_privilege('anon',f.oid,'EXECUTE');
+create temp view _owner_scoped as
+select f.oid from _owner_fns f where f.proname in ('get_session_identity_state','list_session_children')
+  and f.prosecdef and f.provolatile='s' and f.proconfig @> array['search_path=""']
+  and f.body ~ agent_board_test.call_re('_session_identity_read_allowed')
+  and f.literals like '%raise exception ''identity_read_forbidden'' using errcode = ''42501''%';
+create temp view _owner_unclassified_direct as
+select f.oid,f.proname from _owner_direct f
+where f.oid not in (select oid from _owner_mutators union select oid from _owner_principal
+  union select oid from _owner_internal union select oid from _owner_scoped);
+create temp view _owner_routes as
+select distinct f.oid,f.proname from _owner_fns f join _owner_calls c on c.root_oid=f.oid
+join _owner_direct d on d.oid=c.reached_oid
+where d.oid not in (select oid from _owner_principal);
+create temp view _owner_unclassified_routes as
+select f.* from _owner_routes f
+where f.oid not in (select oid from _owner_mutators union select oid from _owner_internal union select oid from _owner_scoped);
+select is((select count(*) from _owner_principal),1::bigint,
+  'SIDOWNER-principal-positive: existing resolver returns only the session-epoch-fenced actor UUID');
+select ok((select count(*)>=20 from _owner_direct),
+  'SIDOWNER-reader-population: catalog discovery includes existing table users, not just two names');
+select is((select coalesce(string_agg(proname,', ' order by proname),'') from _owner_unclassified_direct),'',
+  'SIDOWNER-reader-class: every direct table user is positively classified; a new reader names itself');
+select is((select coalesce(string_agg(proname,', ' order by proname),'') from _owner_unclassified_routes),'',
+  'SIDOWNER-reader-route-class: every sensitive literal caller is positively classified; a new wrapper names itself');
+select is((select coalesce(string_agg(proname,', ' order by proname),'') from _owner_routes
+  where has_function_privilege('public',oid,'EXECUTE') or has_function_privilege('anon',oid,'EXECUTE')),'',
+  'SIDOWNER-reader-route-acl: discovered sensitive routes have no public or anonymous execution');
+select is((select count(*) from _owner_scoped),2::bigint,
+  'SIDOWNER-scoped-positive: both scoped readers are stable definers with empty paths and named authorization');
+select is((select coalesce(string_agg(distinct c.root_name,', ' order by c.root_name),'')
+  from _owner_calls c join _owner_dml d on d.oid=c.reached_oid
+  where c.root_name in ('get_session_identity_state','list_session_children')),'',
+  'SIDOWNER-select-only: neither scoped reader nor any literal callee writes any board table');
+select ok((select count(*)>=5 from _owner_internal),
+  'SIDOWNER-internal-positive: internal table readers return nonprojecting scalar/trigger results and are not authenticated callable');
+create function agent_board.sidowner_unclassified_reader() returns jsonb
+language sql security definer set search_path='' as $probe$
+  SELECT to_jsonb(si) FROM agent_board.session_identities si LIMIT 1;
+$probe$;
+revoke all on function agent_board.sidowner_unclassified_reader() from public,anon;
+grant execute on function agent_board.sidowner_unclassified_reader() to authenticated,service_role;
+create function agent_board.sidowner_unclassified_wrapper() returns jsonb
+language sql security definer set search_path='' as $probe$
+  SELECT agent_board.sidowner_unclassified_reader(/* no direct table reference */);
+$probe$;
+revoke all on function agent_board.sidowner_unclassified_wrapper() from public,anon;
+grant execute on function agent_board.sidowner_unclassified_wrapper() to authenticated,service_role;
+create function agent_board.sidowner_unclassified_mutating_reader() returns jsonb
+language plpgsql security definer set search_path='' as $probe$
+begin
+  UPDATE agent_board.presence SET availability=availability WHERE false;
+  return (SELECT to_jsonb(si) FROM agent_board.session_identities si LIMIT 1);
+end;
+$probe$;
+revoke all on function agent_board.sidowner_unclassified_mutating_reader() from public,anon;
+grant execute on function agent_board.sidowner_unclassified_mutating_reader() to authenticated,service_role;
+-- Refresh from the actual catalog after adding the canaries, including their
+-- transitive call graph. Caching avoids repeatedly stripping every routine.
+insert into _owner_fns
+select p.*, agent_board_test.stripped_body(p.oid) as body,
+  agent_board_test.stripped_body(p.oid,true) as literals
+from pg_proc p where p.oid in ('agent_board.sidowner_unclassified_reader()'::regprocedure,
+  'agent_board.sidowner_unclassified_wrapper()'::regprocedure,
+  'agent_board.sidowner_unclassified_mutating_reader()'::regprocedure);
+truncate _owner_calls;
+insert into _owner_calls select * from agent_board_test.fn_call_closure();
+truncate _owner_dml;
+insert into _owner_dml
+select distinct f.oid from _owner_fns f join pg_class t on t.relnamespace='agent_board'::regnamespace
+  and t.relkind in ('r','p') where f.body ~ agent_board_test.re(
+    agent_board_test.qname_frag(t.relname,agent_board_test.bare_ok(f.oid)))
+  and f.body ~ agent_board_test.re(
+    agent_board_test.write_frag(t.relname,agent_board_test.bare_ok(f.oid)));
+select is((select string_agg(proname,', ' order by proname) from _owner_unclassified_direct
+  where proname='sidowner_unclassified_reader'),'sidowner_unclassified_reader',
+  'SIDOWNER-reader-canary: new authenticated uppercase reader names itself without a PUBLIC grant');
+select is((select string_agg(proname,', ' order by proname) from _owner_unclassified_routes
+  where proname in ('sidowner_unclassified_reader','sidowner_unclassified_wrapper')),
+  'sidowner_unclassified_reader, sidowner_unclassified_wrapper',
+  'SIDOWNER-wrapper-canary: indirect reader also names itself in literal-call closure');
+select is((select count(*) from _owner_mutators where oid in (
+  'agent_board.sidowner_unclassified_reader()'::regprocedure,'agent_board.sidowner_unclassified_wrapper()'::regprocedure)),0::bigint,
+  'SIDOWNER-positive-classification-canary: a SELECT-only secret reader is not mislabeled as a lifecycle writer');
+select is((select proname::text from _owner_unclassified_direct
+  where proname='sidowner_unclassified_mutating_reader'),'sidowner_unclassified_mutating_reader',
+  'SIDOWNER-unrelated-write-canary: unrelated no-op DML cannot classify an authenticated JSON reader as safe');
+select * from finish();
+rollback;

package/tests/agent_board_sidowner_reads.test.sql

@@ -0,0 +1,136 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(31);
+create temp table _owner_fixture(label text primary key, agent_id uuid, auth_id uuid);
+do $$
+declare v_owner uuid; v_root uuid; v_parent uuid; v_id uuid; v_auth uuid; v_label text;
+begin
+  foreach v_label in array array['owner','other-owner','root','parent','sibling','grandchild','other-root'] loop
+    v_id := gen_random_uuid();
+    v_auth := public.ensure_github_user('sidowner-' || v_id, v_id || '@example.test', v_id::text, v_label);
+    if v_label = 'owner' then v_owner := v_auth; end if;
+    if v_label = 'root' then v_root := v_id; end if;
+    if v_label = 'parent' then v_parent := v_id; end if;
+    insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id, parent_agent_id, root_agent_id)
+    values (v_id, case when v_label in ('owner','other-owner') then 'human' else 'agent' end,
+      'sidowner-' || v_id, v_label, 'active', v_auth,
+      case when v_label in ('root','parent','sibling','grandchild') then v_owner else v_auth end,
+      case when v_label in ('parent','sibling') then v_root when v_label = 'grandchild' then v_parent else null end,
+      case when v_label in ('parent','sibling','grandchild') then v_root else null end);
+    insert into _owner_fixture values (v_label, v_id, v_auth);
+  end loop;
+end;
+$$;
+set constraints all immediate;
+set constraints all deferred;
+grant select on _owner_fixture to authenticated, service_role;
+create function pg_temp.owner_actor(p_label text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', '{}', true);
+  perform set_config('request.jwt.claim.sub', coalesce((select auth_id::text from _owner_fixture where label=p_label), ''), true);
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.agent_credential_id', '', true);
+end;
+$$;
+select pg_temp.owner_actor('owner');
+set local role authenticated;
+create temp table _owner_children as select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root')) with no data;
+select lives_ok($$insert into _owner_children select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root'))$$,
+  'SIDOWNER-owner-control: human owner enters scoped children reader');
+select is((select count(*) from _owner_children), 3::bigint,
+  'SIDOWNER-subtree: all strict descendants at both depths returned');
+select is((select array_agg(depth order by ctid) from _owner_children), array[1,1,2]::smallint[],
+  'SIDOWNER-order: children ordered by depth and identity');
+select is((select array_agg(agent_id order by ctid) from _owner_children),
+  (select array_agg(agent_id order by depth,agent_id) from _owner_children),
+  'SIDOWNER-identity-order: emitted child rows retain depth then UUID ordering');
+select is((select count(*) from _owner_children where agent_id=(select agent_id from _owner_fixture where label='root')), 0::bigint,
+  'SIDOWNER-parent-excluded: selected parent is never included');
+select is((select count(*) from _owner_children where root_agent_id<>(select agent_id from _owner_fixture where label='root')), 0::bigint,
+  'SIDOWNER-root-filter: unrelated root is never returned');
+select is((select string_agg(attname, ',' order by attnum) from pg_attribute where attrelid='_owner_children'::regclass and attnum>0 and not attisdropped),
+  'agent_id,parent_agent_id,root_agent_id,handle,depth,harness,lease_state,resolution_state,fingerprint_resolution,current_risky_digest,approved_risky_digest,recorded_fingerprint,tombstoned_at,tombstone_reason',
+  'SIDOWNER-safe-columns: exact normalized projection excludes credential material');
+create temp table _owner_root as select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='root')) with no data;
+select lives_ok($$insert into _owner_root select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='root'))$$,
+  'SIDOWNER-owner-state-control: owner inspects root');
+select is((select string_agg(attname, ',' order by attnum) from pg_attribute where attrelid='_owner_root'::regclass and attnum>0 and not attisdropped),
+  'agent_id,parent_agent_id,root_agent_id,handle,depth,harness,lease_state,resolution_state,fingerprint_resolution,current_risky_digest,approved_risky_digest,recorded_fingerprint,tombstoned_at,tombstone_reason',
+  'SIDOWNER-state-safe-columns: single-state reader has the same exact safe projection');
+select is((select lease_state from _owner_root), 'not_applicable', 'SIDOWNER-legacy-lease: root is not a session lease');
+select is((select fingerprint_resolution from _owner_root), 'unresolved', 'SIDOWNER-missing-reading: backfill reading is unresolved');
+reset role;
+select pg_temp.owner_actor('root');
+set local role authenticated;
+select lives_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  'SIDOWNER-ancestor-control: strict ancestor reads parent subtree');
+select lives_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='grandchild'))$$,
+  'SIDOWNER-ancestor-state: ancestor reads depth two');
+reset role;
+select pg_temp.owner_actor('parent');
+set local role authenticated;
+select lives_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  'SIDOWNER-self-control: parent reads own children');
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='sibling'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-sibling: same-root sibling cannot read subtree');
+select throws_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-descendant: descendant cannot read ancestor');
+reset role;
+update agent_board.session_identities set resolution_state='frozen' where agent_id=(select agent_id from _owner_fixture where label='parent');
+set local role authenticated;
+select lives_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  'SIDOWNER-frozen-reader: freeze does not deny diagnosis');
+reset role;
+update agent_board.session_identities set tombstoned_at=now(), tombstone_reason='revoked'
+  where agent_id=(select agent_id from _owner_fixture where label='grandchild');
+set local role authenticated;
+create temp table _owner_tombstone as select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent')) with no data;
+select lives_ok($$insert into _owner_tombstone select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  'SIDOWNER-tombstone-control: parent reads tombstone');
+select is((select tombstone_reason from _owner_tombstone), 'revoked', 'SIDOWNER-tombstone: tombstoned descendants remain visible');
+reset role;
+select pg_temp.owner_actor('other-owner');
+set local role authenticated;
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-owner-filter: unrelated human cannot inspect root');
+select throws_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='grandchild'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-other-owner-state: unrelated human cannot inspect state');
+reset role;
+select pg_temp.owner_actor('other-root');
+set local role authenticated;
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-other-root: unrelated agent cannot inspect subtree');
+create temp table _owner_empty as select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='other-root')) with no data;
+select lives_ok($$insert into _owner_empty select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='other-root'))$$,
+  'SIDOWNER-empty-control: leaf is an authorized parent');
+select is((select count(*) from _owner_empty), 0::bigint,'SIDOWNER-empty: authorized leaf returns an empty array');
+select throws_ok($$select * from agent_board.list_session_children('00000000-0000-0000-0000-000000000000')$$,
+  '42501','identity_read_forbidden','SIDOWNER-missing: missing parent uses same refusal');
+select throws_ok($$select * from agent_board.get_session_identity_state('00000000-0000-0000-0000-000000000000')$$,
+  '42501','identity_read_forbidden','SIDOWNER-missing-state: missing state uses same refusal');
+reset role;
+select pg_temp.owner_actor('owner');
+select set_config('request.jwt.claim.agent_credential_id', gen_random_uuid()::text, true);
+set local role authenticated;
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-invalid-owner-credential: owner predicate cannot bypass invalid credential');
+reset role;
+select pg_temp.owner_actor('parent');
+update agent_board.agents set status='revoked' where id=(select agent_id from _owner_fixture where label='parent');
+set local role authenticated;
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-revoked-reader: revoked parent cannot inspect children');
+reset role;
+select pg_temp.owner_actor('none');
+set local role authenticated;
+select throws_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-null-actor: missing actor cannot read state');
+reset role;
+select is((select count(*) from agent_board.session_identities where root_agent_id=(select agent_id from _owner_fixture where label='root')), 4::bigint,
+  'SIDOWNER-read-only: reads preserve identity population');
+select is((select resolution_state from agent_board.session_identities where agent_id=(select agent_id from _owner_fixture where label='parent')), 'frozen',
+  'SIDOWNER-read-state: diagnosis preserves freeze');
+select * from finish();
+rollback;

package/tests/agent_board_signer_lifecycle.test.sql

@@ -38,7 +38,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(48);
+select plan(50);
 
 create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
 begin
@@ -693,7 +693,25 @@ select ok(
 --    would silently drop a site, which is the direction that hides a defect.
 -- ===========================================================================
 
-select is(
+create temp view _sid_instance_withdrawal as
+select p.oid,agent_board_test.stripped_body(p.oid,true) as b
+from pg_proc p where p.oid='agent_board.tombstone_delegate_instance(text,text,text,text)'::regprocedure;
+select ok((select b like '%perform agent_board.update_board_membership(v_board, v_row.agent_id, ''left'');%'
+  and b like '%if v_row.owner_user_id is distinct from v_owner then%'
+  and b like '%where di.instance_id = p_instance_id%'
+  and (select count(*) from regexp_matches(b,agent_board_test.call_re('update_board_membership'),'g'))=1
+  from _sid_instance_withdrawal),
+  'EC-SIDSCHEMA-5-instance-withdrawal-positive: the verified-instance revoker writes only left memberships for its bound principal, never a grant or admission; real closure tests check state and append-only provenance');
+select ok((select strpos(b, 'perform agent_board._lock_board_authority_ceiling(v_board);') > 0
+  and strpos(b, 'perform agent_board._lock_board_authority_ceiling(v_board);')
+    < strpos(b, 'v_owner := agent_board._ensure_agent_auth_user(v_owner_slug);')
+  and strpos(b, 'perform agent_board._lock_board_authority_ceiling(v_board);')
+    < strpos(b, 'insert into agent_board.delegate_instances')
+  and b like '%select b.id from agent_board.boards b order by b.id%'
+  from _sid_instance_withdrawal
+  where oid='agent_board.tombstone_delegate_instance(text,text,text,text)'::regprocedure),
+  'SID-INTEGRITY-lock-order: tombstone_delegate_instance locks the board universe in UUID order before owner/instance and identity-family locks');
+select is( -- pgtap-allow-raise-checked: catalog text comparison only; no RPC executes in this value expression.
   (with recursive fns as (
      select p.oid, p.proname, agent_board_test.stripped_body(p.oid) as b
        from pg_proc p join pg_namespace n on n.oid = p.pronamespace
@@ -736,10 +754,14 @@ select is(
     -- assertion deliberately requires mutual exclusion, which survives a lock being added
     -- downstream, and NOT a re-derived order, which does not.
     'grant_board_role => serialised by the board advisory lock',
+    'link_session_alias => serialised by the board advisory lock',
+    'mint_delegated_child => serialised by the board advisory lock',
     'onboard_federated_fleet_agent => serialised by the board advisory lock',
-    'signed_grant_board_role => serialised by the board advisory lock'
+    'readmit_session_identity => serialised by the board advisory lock',
+    'signed_grant_board_role => serialised by the board advisory lock',
+    'tombstone_delegate_instance => serialised by the board advisory lock'
   ]::text[],
-  'every function that EXPLICITLY row-locks both agents and board_memberships takes the board advisory lock (transitive; a new one names itself). FK-implied locks are invisible here and are covered by agent_board_fk_lock_edges.test.sql');
+  'every discovered agent+membership locker takes the board advisory lock (transitive; a new one names itself). FK-implied locks are covered by agent_board_fk_lock_edges.test.sql');
 
 select finish();
 

package/tests/agent_board_signing_challenge_pending_cap.test.sql

@@ -56,7 +56,7 @@ select has_function(
   'agent_board', 'issue_signing_key_challenge', array['uuid', 'text', 'interval'],
   'issue_signing_key_challenge exists');
 select has_function(
-  'agent_board', 'mint_fleet_agent_session', array['uuid', 'text', 'uuid', 'uuid', 'integer'],
+  'agent_board', 'mint_fleet_agent_session', array['uuid', 'text', 'uuid', 'uuid', 'integer', 'text', 'text'],
   'mint_fleet_agent_session exists');
 
 -- Seed one agent + key, then fill the key's sixteen pending slots.

package/tests/agent_board_v2_invariants.test.sql

@@ -323,8 +323,8 @@ select *
 
 select is(
   (select delivered_recipient_count from v2_board_delivery),
-  3,
-  'post_board_message only reaches active joined or subscribed board members (incl. the seeded owner-creator)'
+  2,
+  'post_board_message only reaches active joined or subscribed board members, not the author (#608: the author is the seeded owner-creator)'
 );
 
 select is(
@@ -369,8 +369,8 @@ select *
 
 select is(
   (select delivered_recipient_count from v2_tasking_delivery),
-  4,
-  'tasking counts explicit and board fan-out attempts before duplicate collapse (incl. the seeded owner-creator)'
+  3,
+  'tasking counts explicit and board fan-out attempts before duplicate collapse, not the creator (#608: the creator is the seeded owner-creator)'
 );
 
 select is(