@consiliency/agent-board-schema 1.59.0 → 1.63.0

package/tests/agent_board_grant_target_role.test.sql

@@ -0,0 +1,1118 @@
+-- #674 pgTAP: grant_board_role checks the TARGET's current role
+-- (plans/plan-674-grant-target-role.md v4, §5.0-§5.3).
+--
+-- THE RULE UNDER TEST. For a grantor that is not the target (self = the same agent id):
+--   C-A  grantor rank < admin          -> 42501 'grant on another member requires owner or admin role'
+--   C-B  grantor rank <= target's rank -> 42501 'grant requires a higher board role than the target'
+-- after the unchanged ceiling; P0002, the fleet gate and the delegate refusal keep their order.
+--
+-- FIXTURE ISOLATION (§5.0). Every case runs on its OWN fresh board built by
+-- pg_temp.g674_board(p_roles jsonb), by direct insert as the test owner (the seeding style of
+-- agent_board_rowid.test.sql). No case observes another case's writes, so a mutation that flips
+-- one case cannot cascade into the next case's preconditions. Every membership row is seeded with
+-- created_at = updated_at pinned in 2020, because now() is constant inside this transaction: a
+-- write shows as `written`, an untouched row as `pinned`.
+--
+-- NAMING (§5.0). Every case assertion is `<id>.pre` (the seeded rows of grantor and target,
+-- before the call -- never red; a red .pre is a fixture defect), `<id>.call` (throws_ok with the
+-- exact code and message, or lives_ok) and `<id>.post` (a SEPARATE state read: every row of the
+-- target, pinned or written, plus the board's active-owner count). scripts/mutations-674.mjs keys
+-- on those names.
+--
+-- CLAIMS. Runs as the postgres db role; request.jwt.claim.role/.sub select the caller exactly as
+-- agent_board_roomown.test.sql does ('' => service_role, 'authenticated' + sub => that agent).
+-- Authenticated cases pass p_grantor_agent_id = NULL, the shape UI hosts send (it is what makes
+-- the plan's M5 discriminate). The SID block of EC-2 uses set local role, as the SID suites do.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+grant usage on schema extensions to authenticated, service_role;
+
+select plan(215);
+
+-- ===========================================================================
+-- Fixture helpers
+-- ===========================================================================
+create temp table _g674_case(case_id text primary key, board uuid not null) on commit drop;
+create temp table _g674_agent(board uuid not null, label text not null, agent_id uuid not null,
+  auth_user uuid, key_row uuid, primary key (board, label)) on commit drop;
+grant select, insert on _g674_case, _g674_agent to authenticated, service_role;
+
+-- p_roles: { "<LABEL>": "<role>"                     -- one joined row
+--          | "<LABEL>": [{"state":..,"role":..}, ..]  -- rows in insertion (= created_at) order
+--          | "<LABEL>": []                            -- an agent with no row on the board
+--          , "_creator": "<LABEL>"    boards.created_by_agent_id (and every row's created_by)
+--          , "_gate": true            boards.role_gate_enforced
+--          , "_delegate": ["<LABEL>"] agents.is_delegate (a hosted delegate)
+--          , "_revoked": ["<LABEL>"]  an agent-subject fleet_revocation_events row
+--          , "_keys": ["<LABEL>"]     a proven active signing key (the signed route's signer)
+--          , "_human_of": {"<CHILD>": "<PARENT>"}  same human: CHILD.owner_user_id = PARENT's }
+create function pg_temp.g674_board(p_roles jsonb) returns uuid language plpgsql as $$
+declare
+  v_board uuid := gen_random_uuid();
+  v_sfx text := substr(replace(v_board::text, '-', ''), 1, 12);
+  v_label text; v_agent uuid; v_user uuid; v_creator uuid; v_row jsonb; v_n int := 0;
+  v_ts timestamptz; v_key uuid; v_rows jsonb;
+begin
+  for v_label in select k from jsonb_object_keys(p_roles) k where left(k, 1) <> '_' order by k loop
+    v_agent := gen_random_uuid();
+    v_user := gen_random_uuid();
+    insert into auth.users(id, instance_id, aud, role, email)
+    values (v_user, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+            'g674-' || lower(v_label) || '-' || v_sfx || '@t.test');
+    insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id, is_delegate)
+    values (v_agent, 'agent', 'g674-' || lower(v_label) || '-' || v_sfx, 'G674 ' || v_label, 'active',
+            v_user, v_user, coalesce(p_roles -> '_delegate' ? v_label, false));
+    v_key := null;
+    if coalesce(p_roles -> '_keys' ? v_label, false) then
+      insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format,
+                                                 fingerprint, status, proof_state)
+      values (v_agent, 'primary', 1, public.test_pubkey('g674-' || v_agent), 'raw_ed25519_base64url',
+              public.test_key_fingerprint('g674-' || v_agent), 'active', 'proven')
+      returning id into v_key;
+    end if;
+    insert into _g674_agent values (v_board, v_label, v_agent, v_user, v_key);
+  end loop;
+
+  for v_label in select k from jsonb_object_keys(coalesce(p_roles -> '_human_of', '{}'::jsonb)) k loop
+    update agent_board.agents
+       set owner_user_id = (select auth_user from _g674_agent where board = v_board and label = p_roles -> '_human_of' ->> v_label)
+     where id = (select agent_id from _g674_agent where board = v_board and label = v_label);
+  end loop;
+
+  v_creator := (select agent_id from _g674_agent where board = v_board and label = p_roles ->> '_creator');
+  if v_creator is null then
+    raise exception 'g674_board: _creator must name a label';
+  end if;
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status, role_gate_enforced)
+  values (v_board, 'g674-' || v_sfx, 'G674 ' || v_sfx, v_creator, 'private', 'active',
+          coalesce((p_roles ->> '_gate')::boolean, false));
+
+  for v_label in select k from jsonb_object_keys(p_roles) k where left(k, 1) <> '_' order by k loop
+    v_rows := case jsonb_typeof(p_roles -> v_label)
+                when 'string' then jsonb_build_array(jsonb_build_object('state', 'joined', 'role', p_roles ->> v_label))
+                else p_roles -> v_label end;
+    for v_row in select e from jsonb_array_elements(v_rows) with ordinality as t(e, n) order by n
+    loop
+      v_n := v_n + 1;
+      v_ts := timestamptz '2020-01-01 00:00:00+00' + v_n * interval '1 minute';
+      insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id,
+                                                left_at, created_at, updated_at)
+      values (v_board, (select agent_id from _g674_agent where board = v_board and label = v_label),
+              v_row ->> 'state', v_row ->> 'role', v_creator,
+              case when v_row ->> 'state' in ('left', 'removed') then v_ts end, v_ts, v_ts);
+    end loop;
+  end loop;
+
+  insert into agent_board.fleet_revocation_events(subject_kind, subject_id, agent_id, revoked_by_agent_id, revocation_reason)
+  select 'agent', a.agent_id, a.agent_id, v_creator, 'g674-fixture'
+    from _g674_agent a
+   where a.board = v_board and coalesce(p_roles -> '_revoked' ? a.label, false);
+  return v_board;
+end;
+$$;
+
+create function pg_temp.g674_b(p_case text) returns uuid language sql stable as $$
+  select board from _g674_case where case_id = p_case
+$$;
+create function pg_temp.g674_a(p_case text, p_label text) returns uuid language sql stable as $$
+  select a.agent_id from _g674_agent a join _g674_case c on c.board = a.board
+   where c.case_id = p_case and a.label = p_label
+$$;
+-- The seeded rows of the named labels (every row, any state), in label then insertion order.
+create function pg_temp.g674_rows(p_case text, p_labels text)
+returns table(label text, membership_state text, role text) language sql stable as $$
+  select a.label, bm.membership_state, bm.role
+    from _g674_case c
+    join _g674_agent a on a.board = c.board and a.label = any(string_to_array(p_labels, ','))
+    join agent_board.board_memberships bm on bm.board_id = c.board and bm.agent_id = a.agent_id
+   where c.case_id = p_case
+   order by a.label, bm.created_at, bm.id
+$$;
+-- The post-call state: every row of the label (state/role/pinned|written), then the board's
+-- active-owner count.
+create function pg_temp.g674_post(p_case text, p_label text) returns text language sql stable as $$
+  select p_label || '[' || coalesce((
+           select string_agg(bm.membership_state || '/' || bm.role || '/' ||
+                             case when bm.updated_at < timestamptz '2021-01-01 00:00:00+00' then 'pinned' else 'written' end,
+                             ',' order by bm.created_at, bm.id)
+             from agent_board.board_memberships bm
+            where bm.board_id = pg_temp.g674_b(p_case) and bm.agent_id = pg_temp.g674_a(p_case, p_label)), '')
+         || '] owners=' || (select count(*) from agent_board.board_memberships bm
+                             where bm.board_id = pg_temp.g674_b(p_case)
+                               and bm.membership_state in ('joined', 'subscribed') and bm.role = 'owner')
+$$;
+-- Several labels at once (the EC-2 bystander reads).
+create function pg_temp.g674_who(p_case text, p_labels text) returns text language sql stable as $$
+  select string_agg(pg_temp.g674_post(p_case, l), ' ' order by l)
+    from unnest(string_to_array(p_labels, ',')) l
+$$;
+-- The same rows WITHOUT the owner count, for a before/after comparison across a call that
+-- legitimately changes other rows on the board.
+create function pg_temp.g674_rows_only(p_case text, p_labels text) returns text language sql stable as $$
+  select string_agg(l || '[' || coalesce((
+           select string_agg(bm.membership_state || '/' || bm.role || '/' ||
+                             case when bm.updated_at < timestamptz '2021-01-01 00:00:00+00' then 'pinned' else 'written' end,
+                             ',' order by bm.created_at, bm.id)
+             from agent_board.board_memberships bm
+            where bm.board_id = pg_temp.g674_b(p_case) and bm.agent_id = pg_temp.g674_a(p_case, l)), '') || ']',
+         ' ' order by l)
+    from unnest(string_to_array(p_labels, ',')) l
+$$;
+-- Evidence rows the signed wrapper recorded for THIS board and target (scoped, not agent-wide).
+create function pg_temp.g674_evidence(p_case text, p_label text) returns text language sql stable as $$
+  select count(*)::text from agent_board.signature_evidence
+   where operation = 'grant_board_role'
+     and external_evidence_ref = 'board-authority:grant_board_role:' || pg_temp.g674_b(p_case) || ':'
+                                 || pg_temp.g674_a(p_case, p_label)
+$$;
+create function pg_temp.g674_as(p_case text, p_label text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub',
+    (select a.auth_user::text from _g674_agent a join _g674_case c on c.board = a.board
+      where c.case_id = p_case and a.label = p_label), true);
+end;
+$$;
+create function pg_temp.g674_service() returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claim.role', '', true);
+  perform set_config('request.jwt.claim.sub', '', true);
+end;
+$$;
+-- The gateway decision the signed wrapper is called with; agent_id is the VERIFIED signer.
+create function pg_temp.g674_gw(p_actor uuid) returns jsonb language sql stable as $$
+  select jsonb_build_object(
+    'agent_id', p_actor,
+    'signing_key_id', (select key_row from _g674_agent where agent_id = p_actor),
+    'key_id', 'primary',
+    'key_version', 1,
+    'algorithm', 'Ed25519',
+    'verification_status', 'verified',
+    'payload_digest', 'sha256:' || repeat('a', 64),
+    'signature_digest', 'sha256:' || repeat('b', 64),
+    'canonicalization_version', 'agent-provenance-jcs.v1',
+    'enforcement_mode', 'require_for_agent_writes',
+    'redacted', true)
+$$;
+
+-- ===========================================================================
+-- §5.1 cases. Ranks: owner 4, admin 3, member 2, observer 1. Each case: its own board, then
+-- <id>.pre (seeded rows), <id>.call, <id>.post. Refusals read back an UNCHANGED target (every
+-- row `pinned`) and an unchanged active-owner count; allows read back the active row `written`
+-- with the new role. G9/A12 additionally count the signed wrapper's evidence rows for that board
+-- and target: a state read only (O007) -- a raise anywhere rolls the insert back, so it is not
+-- evidence of the wrapper's ordering and counts toward no mutation.
+-- ===========================================================================
+-- G1: admin -> owner, member: C-B (3<=4)
+insert into _g674_case values ('G1', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "owner", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G1', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'owner')$$,
+  'G1.pre');
+select pg_temp.g674_as('G1', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G1'), pg_temp.g674_a('G1', 'T'), 'member'), '42501', 'grant requires a higher board role than the target', 'G1.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G1', 'T'), 'T[joined/owner/pinned] owners=2', 'G1.post');
+
+-- G1b: admin -> owner, observer: C-B
+insert into _g674_case values ('G1b', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "owner", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G1b', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'owner')$$,
+  'G1b.pre');
+select pg_temp.g674_as('G1b', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G1b'), pg_temp.g674_a('G1b', 'T'), 'observer'), '42501', 'grant requires a higher board role than the target', 'G1b.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G1b', 'T'), 'T[joined/owner/pinned] owners=2', 'G1b.post');
+
+-- G2: member -> owner, member: C-A (2<3) before C-B
+insert into _g674_case values ('G2', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "owner", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G2', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'owner')$$,
+  'G2.pre');
+select pg_temp.g674_as('G2', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G2'), pg_temp.g674_a('G2', 'T'), 'member'), '42501', 'grant on another member requires owner or admin role', 'G2.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G2', 'T'), 'T[joined/owner/pinned] owners=2', 'G2.post');
+
+-- G2b: member -> owner, observer: C-A
+insert into _g674_case values ('G2b', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "owner", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G2b', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'owner')$$,
+  'G2b.pre');
+select pg_temp.g674_as('G2b', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G2b'), pg_temp.g674_a('G2b', 'T'), 'observer'), '42501', 'grant on another member requires owner or admin role', 'G2b.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G2b', 'T'), 'T[joined/owner/pinned] owners=2', 'G2b.post');
+
+-- G3: observer -> creator-owner, observer: C-A
+insert into _g674_case values ('G3', pg_temp.g674_board('{"G": "observer", "T": "owner", "_creator": "T"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G3', 'G,T'),
+  $$values ('G', 'joined', 'observer'), ('T', 'joined', 'owner')$$,
+  'G3.pre');
+select pg_temp.g674_as('G3', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G3'), pg_temp.g674_a('G3', 'T'), 'observer'), '42501', 'grant on another member requires owner or admin role', 'G3.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G3', 'T'), 'T[joined/owner/pinned] owners=1', 'G3.post');
+
+-- G4: member -> admin, observer: C-A
+insert into _g674_case values ('G4', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "admin", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G4', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'admin')$$,
+  'G4.pre');
+select pg_temp.g674_as('G4', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G4'), pg_temp.g674_a('G4', 'T'), 'observer'), '42501', 'grant on another member requires owner or admin role', 'G4.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G4', 'T'), 'T[joined/admin/pinned] owners=1', 'G4.post');
+
+-- G5: admin -> admin, member: C-B (3<=3)
+insert into _g674_case values ('G5', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "admin", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G5', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'admin')$$,
+  'G5.pre');
+select pg_temp.g674_as('G5', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G5'), pg_temp.g674_a('G5', 'T'), 'member'), '42501', 'grant requires a higher board role than the target', 'G5.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G5', 'T'), 'T[joined/admin/pinned] owners=1', 'G5.post');
+
+-- G5b: admin -> admin, observer: C-B
+insert into _g674_case values ('G5b', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "admin", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G5b', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'admin')$$,
+  'G5b.pre');
+select pg_temp.g674_as('G5b', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G5b'), pg_temp.g674_a('G5b', 'T'), 'observer'), '42501', 'grant requires a higher board role than the target', 'G5b.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G5b', 'T'), 'T[joined/admin/pinned] owners=1', 'G5b.post');
+
+-- G6: owner -> owner, admin: C-B (4<=4)
+insert into _g674_case values ('G6', pg_temp.g674_board('{"G": "owner", "T": "owner", "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G6', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'owner')$$,
+  'G6.pre');
+select pg_temp.g674_as('G6', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G6'), pg_temp.g674_a('G6', 'T'), 'admin'), '42501', 'grant requires a higher board role than the target', 'G6.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G6', 'T'), 'T[joined/owner/pinned] owners=2', 'G6.post');
+
+-- G6b: owner -> owner, member: C-B
+insert into _g674_case values ('G6b', pg_temp.g674_board('{"G": "owner", "T": "owner", "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G6b', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'owner')$$,
+  'G6b.pre');
+select pg_temp.g674_as('G6b', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G6b'), pg_temp.g674_a('G6b', 'T'), 'member'), '42501', 'grant requires a higher board role than the target', 'G6b.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G6b', 'T'), 'T[joined/owner/pinned] owners=2', 'G6b.post');
+
+-- G7.1: G1 with the role gate on: C-B
+insert into _g674_case values ('G7.1', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "owner", "_creator": "O", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G7.1', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'owner')$$,
+  'G7.1.pre');
+select pg_temp.g674_as('G7.1', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G7.1'), pg_temp.g674_a('G7.1', 'T'), 'member'), '42501', 'grant requires a higher board role than the target', 'G7.1.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G7.1', 'T'), 'T[joined/owner/pinned] owners=2', 'G7.1.post');
+
+-- G7.2: G2 with the role gate on: C-A
+insert into _g674_case values ('G7.2', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "owner", "_creator": "O", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G7.2', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'owner')$$,
+  'G7.2.pre');
+select pg_temp.g674_as('G7.2', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G7.2'), pg_temp.g674_a('G7.2', 'T'), 'member'), '42501', 'grant on another member requires owner or admin role', 'G7.2.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G7.2', 'T'), 'T[joined/owner/pinned] owners=2', 'G7.2.post');
+
+-- G7.3: G3 with the role gate on: C-A
+insert into _g674_case values ('G7.3', pg_temp.g674_board('{"G": "observer", "T": "owner", "_creator": "T", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G7.3', 'G,T'),
+  $$values ('G', 'joined', 'observer'), ('T', 'joined', 'owner')$$,
+  'G7.3.pre');
+select pg_temp.g674_as('G7.3', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G7.3'), pg_temp.g674_a('G7.3', 'T'), 'observer'), '42501', 'grant on another member requires owner or admin role', 'G7.3.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G7.3', 'T'), 'T[joined/owner/pinned] owners=1', 'G7.3.post');
+
+-- G7.4: G4 with the role gate on: C-A
+insert into _g674_case values ('G7.4', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "admin", "_creator": "O", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G7.4', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'admin')$$,
+  'G7.4.pre');
+select pg_temp.g674_as('G7.4', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G7.4'), pg_temp.g674_a('G7.4', 'T'), 'observer'), '42501', 'grant on another member requires owner or admin role', 'G7.4.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G7.4', 'T'), 'T[joined/admin/pinned] owners=1', 'G7.4.post');
+
+-- G8: service, supplied grantor admin -> owner: C-B
+insert into _g674_case values ('G8', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "owner", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G8', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'owner')$$,
+  'G8.pre');
+select pg_temp.g674_service();
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, %L::uuid)', pg_temp.g674_b('G8'), pg_temp.g674_a('G8', 'T'), 'member', pg_temp.g674_a('G8', 'G')), '42501', 'grant requires a higher board role than the target', 'G8.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G8', 'T'), 'T[joined/owner/pinned] owners=2', 'G8.post');
+
+-- G8b: service, supplied grantor member -> observer: C-A
+insert into _g674_case values ('G8b', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "observer", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G8b', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'observer')$$,
+  'G8b.pre');
+select pg_temp.g674_service();
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, %L::uuid)', pg_temp.g674_b('G8b'), pg_temp.g674_a('G8b', 'T'), 'member', pg_temp.g674_a('G8b', 'G')), '42501', 'grant on another member requires owner or admin role', 'G8b.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G8b', 'T'), 'T[joined/observer/pinned] owners=1', 'G8b.post');
+
+-- G9: signed, actor admin -> owner: C-B; no evidence row (state read only, O007)
+insert into _g674_case values ('G9', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "owner", "_creator": "O", "_keys": ["G"]}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G9', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'owner')$$,
+  'G9.pre');
+select pg_temp.g674_service();
+select throws_ok(format('select * from agent_board.signed_grant_board_role(jsonb_build_object(''p_board_id'', %L, ''p_agent_id'', %L, ''p_grantee_role'', %L), pg_temp.g674_gw(%L::uuid))', pg_temp.g674_b('G9'), pg_temp.g674_a('G9', 'T'), 'member', pg_temp.g674_a('G9', 'G')), '42501', 'grant requires a higher board role than the target', 'G9.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G9', 'T') || ' evidence=' || pg_temp.g674_evidence('G9', 'T'), 'T[joined/owner/pinned] owners=2 evidence=0', 'G9.post');
+
+-- G10: member -> observer, member: C-A
+insert into _g674_case values ('G10', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "observer", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G10', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'observer')$$,
+  'G10.pre');
+select pg_temp.g674_as('G10', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G10'), pg_temp.g674_a('G10', 'T'), 'member'), '42501', 'grant on another member requires owner or admin role', 'G10.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G10', 'T'), 'T[joined/observer/pinned] owners=1', 'G10.post');
+
+-- G10b: member -> observer, observer: C-A
+insert into _g674_case values ('G10b', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "observer", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G10b', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'observer')$$,
+  'G10b.pre');
+select pg_temp.g674_as('G10b', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G10b'), pg_temp.g674_a('G10b', 'T'), 'observer'), '42501', 'grant on another member requires owner or admin role', 'G10b.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G10b', 'T'), 'T[joined/observer/pinned] owners=1', 'G10b.post');
+
+-- G11: owner -> owner, owner (a retry): C-B (4<=4)
+insert into _g674_case values ('G11', pg_temp.g674_board('{"G": "owner", "T": "owner", "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G11', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'owner')$$,
+  'G11.pre');
+select pg_temp.g674_as('G11', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G11'), pg_temp.g674_a('G11', 'T'), 'owner'), '42501', 'grant requires a higher board role than the target', 'G11.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G11', 'T'), 'T[joined/owner/pinned] owners=2', 'G11.post');
+
+-- G12a: target whose only row is left/member: P0002
+insert into _g674_case values ('G12a', pg_temp.g674_board('{"G": "owner", "T": [{"state": "left", "role": "member"}], "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G12a', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'left', 'member')$$,
+  'G12a.pre');
+select pg_temp.g674_as('G12a', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G12a'), pg_temp.g674_a('G12a', 'T'), 'member'), 'P0002', 'grantee has no membership on this board', 'G12a.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G12a', 'T'), 'T[left/member/pinned] owners=1', 'G12a.post');
+
+-- G12b: target whose only row is invited/member: P0002
+insert into _g674_case values ('G12b', pg_temp.g674_board('{"G": "owner", "T": [{"state": "invited", "role": "member"}], "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G12b', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'invited', 'member')$$,
+  'G12b.pre');
+select pg_temp.g674_as('G12b', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G12b'), pg_temp.g674_a('G12b', 'T'), 'member'), 'P0002', 'grantee has no membership on this board', 'G12b.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G12b', 'T'), 'T[invited/member/pinned] owners=1', 'G12b.post');
+
+-- G12c: target whose only row is removed/admin: P0002
+insert into _g674_case values ('G12c', pg_temp.g674_board('{"G": "owner", "T": [{"state": "removed", "role": "admin"}], "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G12c', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'removed', 'admin')$$,
+  'G12c.pre');
+select pg_temp.g674_as('G12c', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G12c'), pg_temp.g674_a('G12c', 'T'), 'member'), 'P0002', 'grantee has no membership on this board', 'G12c.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G12c', 'T'), 'T[removed/admin/pinned] owners=1', 'G12c.post');
+
+-- G12d: target whose only row is left/OWNER (the D.end shape; M16 witness): P0002
+insert into _g674_case values ('G12d', pg_temp.g674_board('{"G": "owner", "T": [{"state": "left", "role": "owner"}], "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G12d', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'left', 'owner')$$,
+  'G12d.pre');
+select pg_temp.g674_as('G12d', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G12d'), pg_temp.g674_a('G12d', 'T'), 'member'), 'P0002', 'grantee has no membership on this board', 'G12d.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G12d', 'T'), 'T[left/owner/pinned] owners=1', 'G12d.post');
+
+-- G12e: absent target: P0002
+insert into _g674_case values ('G12e', pg_temp.g674_board('{"G": "owner", "T": [], "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G12e', 'G,T'),
+  $$values ('G', 'joined', 'owner')$$,
+  'G12e.pre');
+select pg_temp.g674_as('G12e', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G12e'), pg_temp.g674_a('G12e', 'T'), 'member'), 'P0002', 'grantee has no membership on this board', 'G12e.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G12e', 'T'), 'T[] owners=1', 'G12e.post');
+
+-- G13: member -> owner, admin: the ceiling (3>2) before C-A
+insert into _g674_case values ('G13', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "owner", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G13', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'owner')$$,
+  'G13.pre');
+select pg_temp.g674_as('G13', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G13'), pg_temp.g674_a('G13', 'T'), 'admin'), '42501', 'grant exceeds grantor role or board authority ceiling', 'G13.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G13', 'T'), 'T[joined/owner/pinned] owners=2', 'G13.post');
+
+-- G14a: fleet-revoked owner -> member: the fleet gate
+insert into _g674_case values ('G14a', pg_temp.g674_board('{"G": "owner", "T": "member", "_creator": "G", "_revoked": ["G"]}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G14a', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'member')$$,
+  'G14a.pre');
+select pg_temp.g674_as('G14a', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G14a'), pg_temp.g674_a('G14a', 'T'), 'admin'), '42501', 'fleet_revoked: grant_board_role is not permitted for a fleet-revoked agent', 'G14a.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G14a', 'T'), 'T[joined/member/pinned] owners=1', 'G14a.post');
+
+-- G14b: owner -> hosted-delegate target: step 2
+insert into _g674_case values ('G14b', pg_temp.g674_board('{"G": "owner", "T": "member", "_creator": "G", "_delegate": ["T"]}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G14b', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'member')$$,
+  'G14b.pre');
+select pg_temp.g674_as('G14b', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G14b'), pg_temp.g674_a('G14b', 'T'), 'admin'), '42501', 'grant_board_role cannot place or raise a hosted delegate; add_delegate_to_board is its only way onto a board', 'G14b.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G14b', 'T'), 'T[joined/member/pinned] owners=1', 'G14b.post');
+
+-- G16.C2: evidence C.2: admin -> granted owner: C-B
+insert into _g674_case values ('G16.C2', pg_temp.g674_board('{"C": "owner", "G": "admin", "T": "owner", "_creator": "C"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G16.C2', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'owner')$$,
+  'G16.C2.pre');
+select pg_temp.g674_as('G16.C2', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G16.C2'), pg_temp.g674_a('G16.C2', 'T'), 'member'), '42501', 'grant requires a higher board role than the target', 'G16.C2.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G16.C2', 'T'), 'T[joined/owner/pinned] owners=2', 'G16.C2.post');
+
+-- G16.C4: evidence C.4: admin -> creator-owner: C-B
+insert into _g674_case values ('G16.C4', pg_temp.g674_board('{"G": "admin", "T": "owner", "_creator": "T"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G16.C4', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'owner')$$,
+  'G16.C4.pre');
+select pg_temp.g674_as('G16.C4', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G16.C4'), pg_temp.g674_a('G16.C4', 'T'), 'member'), '42501', 'grant requires a higher board role than the target', 'G16.C4.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G16.C4', 'T'), 'T[joined/owner/pinned] owners=1', 'G16.C4.post');
+
+-- G16.C7: evidence C.7: member -> admin: C-A
+insert into _g674_case values ('G16.C7', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "admin", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G16.C7', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'admin')$$,
+  'G16.C7.pre');
+select pg_temp.g674_as('G16.C7', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G16.C7'), pg_temp.g674_a('G16.C7', 'T'), 'observer'), '42501', 'grant on another member requires owner or admin role', 'G16.C7.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G16.C7', 'T'), 'T[joined/admin/pinned] owners=1', 'G16.C7.post');
+
+-- G16.E1: evidence E.1: member -> owner: C-A
+insert into _g674_case values ('G16.E1', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "owner", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G16.E1', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'owner')$$,
+  'G16.E1.pre');
+select pg_temp.g674_as('G16.E1', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G16.E1'), pg_temp.g674_a('G16.E1', 'T'), 'member'), '42501', 'grant on another member requires owner or admin role', 'G16.E1.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G16.E1', 'T'), 'T[joined/owner/pinned] owners=2', 'G16.E1.post');
+
+-- G16.E3: evidence E.3: observer -> creator-owner: C-A
+insert into _g674_case values ('G16.E3', pg_temp.g674_board('{"G": "observer", "T": "owner", "_creator": "T"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G16.E3', 'G,T'),
+  $$values ('G', 'joined', 'observer'), ('T', 'joined', 'owner')$$,
+  'G16.E3.pre');
+select pg_temp.g674_as('G16.E3', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G16.E3'), pg_temp.g674_a('G16.E3', 'T'), 'observer'), '42501', 'grant on another member requires owner or admin role', 'G16.E3.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G16.E3', 'T'), 'T[joined/owner/pinned] owners=1', 'G16.E3.post');
+
+-- G16.E4b: evidence E.4b: member -> owner, gate on: C-A
+insert into _g674_case values ('G16.E4b', pg_temp.g674_board('{"O": "owner", "G": "member", "T": "owner", "_creator": "O", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G16.E4b', 'G,T'),
+  $$values ('G', 'joined', 'member'), ('T', 'joined', 'owner')$$,
+  'G16.E4b.pre');
+select pg_temp.g674_as('G16.E4b', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G16.E4b'), pg_temp.g674_a('G16.E4b', 'T'), 'member'), '42501', 'grant on another member requires owner or admin role', 'G16.E4b.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G16.E4b', 'T'), 'T[joined/owner/pinned] owners=2', 'G16.E4b.post');
+
+-- G16.E4c: evidence E.4c: observer -> creator-owner, gate on: C-A
+insert into _g674_case values ('G16.E4c', pg_temp.g674_board('{"G": "observer", "T": "owner", "_creator": "T", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G16.E4c', 'G,T'),
+  $$values ('G', 'joined', 'observer'), ('T', 'joined', 'owner')$$,
+  'G16.E4c.pre');
+select pg_temp.g674_as('G16.E4c', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G16.E4c'), pg_temp.g674_a('G16.E4c', 'T'), 'observer'), '42501', 'grant on another member requires owner or admin role', 'G16.E4c.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G16.E4c', 'T'), 'T[joined/owner/pinned] owners=1', 'G16.E4c.post');
+
+-- G17: admin -> admin, admin (a retry): C-B (3<=3)
+insert into _g674_case values ('G17', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "admin", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G17', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'admin')$$,
+  'G17.pre');
+select pg_temp.g674_as('G17', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G17'), pg_temp.g674_a('G17', 'T'), 'admin'), '42501', 'grant requires a higher board role than the target', 'G17.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G17', 'T'), 'T[joined/admin/pinned] owners=1', 'G17.post');
+
+-- G19: owner R -> R's child C (owner, same human, different agent id): C-B
+insert into _g674_case values ('G19', pg_temp.g674_board('{"R": "owner", "T": "owner", "_creator": "R", "_human_of": {"T": "R"}}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G19', 'R,T'),
+  $$values ('R', 'joined', 'owner'), ('T', 'joined', 'owner')$$,
+  'G19.pre');
+select pg_temp.g674_as('G19', 'R');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G19'), pg_temp.g674_a('G19', 'T'), 'member'), '42501', 'grant requires a higher board role than the target', 'G19.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G19', 'T'), 'T[joined/owner/pinned] owners=2', 'G19.post');
+
+-- G21: admin -> admin; grantor also holds an OLDER removed/owner row (M17 witness): C-B (3<=3)
+insert into _g674_case values ('G21', pg_temp.g674_board('{"O": "owner", "G": [{"state": "removed", "role": "owner"}, {"state": "joined", "role": "admin"}], "T": "admin", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G21', 'G,T'),
+  $$values ('G', 'removed', 'owner'), ('G', 'joined', 'admin'), ('T', 'joined', 'admin')$$,
+  'G21.pre');
+select pg_temp.g674_as('G21', 'G');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G21'), pg_temp.g674_a('G21', 'T'), 'member'), '42501', 'grant requires a higher board role than the target', 'G21.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G21', 'T'), 'T[joined/admin/pinned] owners=1', 'G21.post');
+
+-- A1: owner -> admin, member: 4>3
+insert into _g674_case values ('A1', pg_temp.g674_board('{"G": "owner", "T": "admin", "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A1', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'admin')$$,
+  'A1.pre');
+select pg_temp.g674_as('A1', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A1'), pg_temp.g674_a('A1', 'T'), 'member'), 'A1.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A1', 'T'), 'T[joined/member/written] owners=1', 'A1.post');
+
+-- A2: admin -> member, observer: 3>2
+insert into _g674_case values ('A2', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "member", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A2', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'member')$$,
+  'A2.pre');
+select pg_temp.g674_as('A2', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A2'), pg_temp.g674_a('A2', 'T'), 'observer'), 'A2.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A2', 'T'), 'T[joined/observer/written] owners=1', 'A2.post');
+
+-- A3: creator-owner -> itself, admin: self
+insert into _g674_case values ('A3', pg_temp.g674_board('{"G": "owner", "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A3', 'G'),
+  $$values ('G', 'joined', 'owner')$$,
+  'A3.pre');
+select pg_temp.g674_as('A3', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A3'), pg_temp.g674_a('A3', 'G'), 'admin'), 'A3.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A3', 'G'), 'G[joined/admin/written] owners=0', 'A3.post');
+
+-- A4: admin -> member, admin: ceiling 3<=3, then 3>2
+insert into _g674_case values ('A4', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "member", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A4', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'member')$$,
+  'A4.pre');
+select pg_temp.g674_as('A4', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A4'), pg_temp.g674_a('A4', 'T'), 'admin'), 'A4.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A4', 'T'), 'T[joined/admin/written] owners=1', 'A4.post');
+
+-- A5: admin -> itself, member: self
+insert into _g674_case values ('A5', pg_temp.g674_board('{"O": "owner", "G": "admin", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A5', 'G'),
+  $$values ('G', 'joined', 'admin')$$,
+  'A5.pre');
+select pg_temp.g674_as('A5', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A5'), pg_temp.g674_a('A5', 'G'), 'member'), 'A5.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A5', 'G'), 'G[joined/member/written] owners=1', 'A5.post');
+
+-- A6: owner -> admin, owner: ceiling 4<=4, then 4>3
+insert into _g674_case values ('A6', pg_temp.g674_board('{"G": "owner", "T": "admin", "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A6', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'admin')$$,
+  'A6.pre');
+select pg_temp.g674_as('A6', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A6'), pg_temp.g674_a('A6', 'T'), 'owner'), 'A6.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A6', 'T'), 'T[joined/owner/written] owners=2', 'A6.post');
+
+-- A7: admin -> observer, member: 3>1
+insert into _g674_case values ('A7', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "observer", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A7', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'observer')$$,
+  'A7.pre');
+select pg_temp.g674_as('A7', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A7'), pg_temp.g674_a('A7', 'T'), 'member'), 'A7.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A7', 'T'), 'T[joined/member/written] owners=1', 'A7.post');
+
+-- A8: owner -> admin, admin: 4>3
+insert into _g674_case values ('A8', pg_temp.g674_board('{"G": "owner", "T": "admin", "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A8', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'admin')$$,
+  'A8.pre');
+select pg_temp.g674_as('A8', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A8'), pg_temp.g674_a('A8', 'T'), 'admin'), 'A8.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A8', 'T'), 'T[joined/admin/written] owners=1', 'A8.post');
+
+-- A9.1: member -> itself, observer: self
+insert into _g674_case values ('A9.1', pg_temp.g674_board('{"O": "owner", "G": "member", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A9.1', 'G'),
+  $$values ('G', 'joined', 'member')$$,
+  'A9.1.pre');
+select pg_temp.g674_as('A9.1', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A9.1'), pg_temp.g674_a('A9.1', 'G'), 'observer'), 'A9.1.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A9.1', 'G'), 'G[joined/observer/written] owners=1', 'A9.1.post');
+
+-- A9.2: observer -> itself, observer: self
+insert into _g674_case values ('A9.2', pg_temp.g674_board('{"O": "owner", "G": "observer", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A9.2', 'G'),
+  $$values ('G', 'joined', 'observer')$$,
+  'A9.2.pre');
+select pg_temp.g674_as('A9.2', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A9.2'), pg_temp.g674_a('A9.2', 'G'), 'observer'), 'A9.2.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A9.2', 'G'), 'G[joined/observer/written] owners=1', 'A9.2.post');
+
+-- A10.1: A1 with the role gate on
+insert into _g674_case values ('A10.1', pg_temp.g674_board('{"G": "owner", "T": "admin", "_creator": "G", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A10.1', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'admin')$$,
+  'A10.1.pre');
+select pg_temp.g674_as('A10.1', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A10.1'), pg_temp.g674_a('A10.1', 'T'), 'member'), 'A10.1.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A10.1', 'T'), 'T[joined/member/written] owners=1', 'A10.1.post');
+
+-- A10.2: A2 with the role gate on
+insert into _g674_case values ('A10.2', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "member", "_creator": "O", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A10.2', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'member')$$,
+  'A10.2.pre');
+select pg_temp.g674_as('A10.2', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A10.2'), pg_temp.g674_a('A10.2', 'T'), 'observer'), 'A10.2.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A10.2', 'T'), 'T[joined/observer/written] owners=1', 'A10.2.post');
+
+-- A10.3: A3 with the role gate on
+insert into _g674_case values ('A10.3', pg_temp.g674_board('{"G": "owner", "_creator": "G", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A10.3', 'G'),
+  $$values ('G', 'joined', 'owner')$$,
+  'A10.3.pre');
+select pg_temp.g674_as('A10.3', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A10.3'), pg_temp.g674_a('A10.3', 'G'), 'admin'), 'A10.3.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A10.3', 'G'), 'G[joined/admin/written] owners=0', 'A10.3.post');
+
+-- A10.4: A4 with the role gate on
+insert into _g674_case values ('A10.4', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "member", "_creator": "O", "_gate": true}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A10.4', 'G,T'),
+  $$values ('G', 'joined', 'admin'), ('T', 'joined', 'member')$$,
+  'A10.4.pre');
+select pg_temp.g674_as('A10.4', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A10.4'), pg_temp.g674_a('A10.4', 'T'), 'admin'), 'A10.4.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A10.4', 'T'), 'T[joined/admin/written] owners=1', 'A10.4.post');
+
+-- A11: service, supplied grantor owner -> admin, member: 4>3
+insert into _g674_case values ('A11', pg_temp.g674_board('{"G": "owner", "T": "admin", "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A11', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'admin')$$,
+  'A11.pre');
+select pg_temp.g674_service();
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, %L::uuid)', pg_temp.g674_b('A11'), pg_temp.g674_a('A11', 'T'), 'member', pg_temp.g674_a('A11', 'G')), 'A11.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A11', 'T'), 'T[joined/member/written] owners=1', 'A11.post');
+
+-- A12: signed, actor owner -> admin, member: 4>3; exactly one evidence row
+insert into _g674_case values ('A12', pg_temp.g674_board('{"G": "owner", "T": "admin", "_creator": "G", "_keys": ["G"]}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'A12', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'joined', 'admin')$$,
+  'A12.pre');
+select pg_temp.g674_service();
+select lives_ok(format('select * from agent_board.signed_grant_board_role(jsonb_build_object(''p_board_id'', %L, ''p_agent_id'', %L, ''p_grantee_role'', %L), pg_temp.g674_gw(%L::uuid))', pg_temp.g674_b('A12'), pg_temp.g674_a('A12', 'T'), 'member', pg_temp.g674_a('A12', 'G')), 'A12.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('A12', 'T') || ' evidence=' || pg_temp.g674_evidence('A12', 'T'), 'T[joined/member/written] owners=1 evidence=1', 'A12.post');
+
+-- G8c: service, p_grantor_agent_id = p_agent_id = an owner: the D8 self-exemption keyed on the SUPPLIED id (recorded, not endorsed)
+insert into _g674_case values ('G8c', pg_temp.g674_board('{"O": "owner", "G": "owner", "_creator": "O"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G8c', 'G'),
+  $$values ('G', 'joined', 'owner')$$,
+  'G8c.pre');
+select pg_temp.g674_service();
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, %L::uuid)', pg_temp.g674_b('G8c'), pg_temp.g674_a('G8c', 'G'), 'member', pg_temp.g674_a('G8c', 'G')), 'G8c.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G8c', 'G'), 'G[joined/member/written] owners=1', 'G8c.post');
+
+-- G20: owner -> member with an OLDER left/member row (M15 witness): 4>2, only the active row changes
+insert into _g674_case values ('G20', pg_temp.g674_board('{"G": "owner", "T": [{"state": "left", "role": "member"}, {"state": "joined", "role": "member"}], "_creator": "G"}'::jsonb));
+select results_eq(format('select label, membership_state, role from pg_temp.g674_rows(%L, %L)', 'G20', 'G,T'),
+  $$values ('G', 'joined', 'owner'), ('T', 'left', 'member'), ('T', 'joined', 'member')$$,
+  'G20.pre');
+select pg_temp.g674_as('G20', 'G');
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('G20'), pg_temp.g674_a('G20', 'T'), 'observer'), 'G20.call');
+select pg_temp.g674_service();
+select is(pg_temp.g674_post('G20', 'T'), 'T[left/member/pinned,joined/observer/written] owners=1', 'G20.post');
+
+
+-- ===========================================================================
+-- EC-1 (rule 1): the caller set of grant_board_role, from the catalog (O006)
+-- ===========================================================================
+-- Every namespace except the system ones, pg_temp* (this file's own helpers call the RPC) and
+-- the test tooling (agent_board_test, and pgTAP itself wherever it is installed: excluded as an
+-- extension member, not by a schema name). The subject KEEPS literals (stripped_body(oid, true)),
+-- so a dynamic-SQL caller -- execute 'select agent_board.grant_board_role(...' -- is caught. A
+-- false positive names itself, which is the safe direction.
+select is(
+  (select coalesce(string_agg(n.nspname || '.' || p.proname, ',' order by n.nspname, p.proname), '(none)')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname not in ('pg_catalog', 'information_schema', 'pg_toast', 'agent_board_test')
+      and left(n.nspname, 7) <> 'pg_temp' and left(n.nspname, 13) <> 'pg_toast_temp'
+      and p.prokind in ('f', 'p')
+      and not exists (select 1 from pg_depend d
+                       where d.classid = 'pg_proc'::regclass and d.objid = p.oid and d.deptype = 'e')
+      and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.call_re('grant_board_role')),
+  'agent_board.signed_grant_board_role',
+  'EC-1.callers: the only function in any non-system namespace that calls grant_board_role is signed_grant_board_role (literals kept, so dynamic SQL counts)');
+select is(
+  (select coalesce(string_agg(n.nspname || '.' || c.relname, ',' order by n.nspname, c.relname), '(none)')
+     from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where c.relkind in ('v', 'm')
+      and n.nspname not in ('pg_catalog', 'information_schema', 'agent_board_test')
+      and agent_board_test.stripped_viewdef(c.oid) ~ agent_board_test.call_re('grant_board_role')),
+  '(none)',
+  'EC-1.views: no view calls grant_board_role (triggers resolve to functions, covered above)');
+
+-- ===========================================================================
+-- EC-2 (rule 1): every writer of board_memberships.role, as a closed-world registry
+-- ===========================================================================
+-- The class is the agent_board_delegate_role_class.test.sql derivation: every agent_board
+-- function whose stripped body matches col_write_re('board_memberships', 'role'), plus the sink.
+-- Each member carries exactly one disposition; the registry must EQUAL the derived set, both
+-- directions, so a new writer (or a deleted one) names itself. Each disposition is then proved
+-- POSITIVELY, by behavior, below: bystanders U (owner) and W (admin) keep their role and
+-- updated_at, and the only role written is the one the disposition names.
+create temp table _674_disposition(proname text primary key, disposition text not null) on commit drop;
+insert into _674_disposition values
+  ('grant_board_role',                    'gated: C-A + C-B (cases G1-G21, A1-A12)'),
+  ('create_board',                        'new boards only: the creator, on the board it just inserted'),
+  ('bootstrap_board_owner_memberships',   'service: seats or raises the CREATOR to owner only'),
+  ('_fedsession_autojoin_default_board',  'inserts a new row for the joining agent only'),
+  ('_redeem_unbounded_invite_for_agent',  'rank-max on the redeemer''s own row only'),
+  ('mint_delegated_child',                'service: a fresh agent only, bounded by the parent'),
+  ('link_session_alias',                  'service: narrows the identity lineage only'),
+  ('readmit_session_identity',            'a fresh agent only, role <= the old one'),
+  ('_upsert_board_membership_state',      'the sink: member only, on non-active -> active re-entry');
+create temp view _674_role_writers as
+select p.proname::text as proname
+  from pg_proc p
+ where p.pronamespace = 'agent_board'::regnamespace
+   and agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('board_memberships', 'role')
+union
+select '_upsert_board_membership_state';
+select is(
+  (select coalesce(string_agg(x, ', ' order by x), '')
+     from (select 'derived, not registered: ' || w.proname as x from _674_role_writers w
+            where not exists (select 1 from _674_disposition d where d.proname = w.proname)
+           union all
+           select 'registered, not derived: ' || d.proname from _674_disposition d
+            where not exists (select 1 from _674_role_writers w where w.proname = d.proname)) s),
+  '',
+  'EC-2.registry: the board_memberships.role writers derived from pg_proc equal the disposition registry, both directions');
+
+-- grant_board_role: gated. The D6a and D6b literals are present in the one body (loud-literal).
+-- source-scan: loud-literal one body, named by regprocedure; a miss fails
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board.grant_board_role(uuid,uuid,text,uuid)'::regprocedure, true),
+         'grant on another member requires owner or admin role') > 0,
+  'EC-2.grant.D6a: grant_board_role carries the C-A refusal');
+-- source-scan: loud-literal one body, named by regprocedure; a miss fails
+select ok(
+  strpos(agent_board_test.stripped_body('agent_board.grant_board_role(uuid,uuid,text,uuid)'::regprocedure, true),
+         'grant requires a higher board role than the target') > 0,
+  'EC-2.grant.D6b: grant_board_role carries the C-B refusal');
+
+-- create_board: new boards only (G2-002). Its only board_memberships write is the new-slug
+-- branch; the slug-collision branch writes boards only and refuses a non-owner.
+-- source-scan: loud-literal one body, named by regprocedure; a miss fails
+select ok(
+  strpos(lower(agent_board_test.stripped_body('agent_board.create_board(uuid,text,text,text,jsonb,text)'::regprocedure)),
+         'insert into agent_board.board_memberships') > 0,
+  'EC-2.create_board.pin: the new-branch membership insert is present');
+insert into _g674_case values ('EC2.cb', pg_temp.g674_board('{"O": "owner", "U": "owner", "W": "admin", "_creator": "O"}'::jsonb));
+select pg_temp.g674_as('EC2.cb', 'O');
+select lives_ok(
+  format('select * from agent_board.create_board(%L::uuid, %L, %L, null, ''{}''::jsonb, ''private'')',
+         pg_temp.g674_a('EC2.cb', 'O'), 'g674-ec2-new-' || pg_temp.g674_b('EC2.cb'), 'EC2 new board'),
+  'EC-2.create_board.a.call: a new slug creates a board');
+select pg_temp.g674_service();
+select is(
+  (select string_agg(a.label || '/' || bm.membership_state || '/' || bm.role, ',')
+     from agent_board.boards b
+     join agent_board.board_memberships bm on bm.board_id = b.id
+     left join _g674_agent a on a.agent_id = bm.agent_id and a.board = pg_temp.g674_b('EC2.cb')
+    where b.slug = 'g674-ec2-new-' || pg_temp.g674_b('EC2.cb')),
+  'O/joined/owner',
+  'EC-2.create_board.a.post: the new board has exactly one membership, the creator as owner');
+select is(pg_temp.g674_who('EC2.cb', 'O,U,W'),
+  'O[joined/owner/pinned] owners=2 U[joined/owner/pinned] owners=2 W[joined/admin/pinned] owners=2',
+  'EC-2.create_board.a.bystanders: no row on the creator''s existing board changed');
+select pg_temp.g674_as('EC2.cb', 'O');
+select lives_ok(
+  format('select * from agent_board.create_board(%L::uuid, %L, %L, null, ''{}''::jsonb, ''private'')',
+         pg_temp.g674_a('EC2.cb', 'O'), (select slug from agent_board.boards where id = pg_temp.g674_b('EC2.cb')), 'EC2 renamed'),
+  'EC-2.create_board.b.call: the current owner''s slug collision is admitted (boards-only update)');
+select pg_temp.g674_service();
+select is(pg_temp.g674_who('EC2.cb', 'O,U,W'),
+  'O[joined/owner/pinned] owners=2 U[joined/owner/pinned] owners=2 W[joined/admin/pinned] owners=2',
+  'EC-2.create_board.b.post: an owner''s collision leaves every membership row (role and updated_at) unchanged');
+select pg_temp.g674_as('EC2.cb', 'W');
+select throws_ok(
+  format('select * from agent_board.create_board(%L::uuid, %L, %L, null, ''{}''::jsonb, ''open'')',
+         pg_temp.g674_a('EC2.cb', 'W'), (select slug from agent_board.boards where id = pg_temp.g674_b('EC2.cb')), 'HIJACK'),
+  '42501', 'board slug already in use',
+  'EC-2.create_board.c.call: an admin''s slug collision is refused');
+select pg_temp.g674_service();
+select is(pg_temp.g674_who('EC2.cb', 'O,U,W'),
+  'O[joined/owner/pinned] owners=2 U[joined/owner/pinned] owners=2 W[joined/admin/pinned] owners=2',
+  'EC-2.create_board.c.post: the refused collision changed nothing');
+
+-- bootstrap_board_owner_memberships (service): seats the CREATOR as owner; bystanders unchanged.
+insert into _g674_case values ('EC2.boot', pg_temp.g674_board('{"Z": [], "U": "owner", "W": "admin", "_creator": "Z"}'::jsonb));
+select pg_temp.g674_service();
+select lives_ok('select * from agent_board.bootstrap_board_owner_memberships()',
+  'EC-2.bootstrap.call: the service repair runs');
+select is(pg_temp.g674_who('EC2.boot', 'U,W,Z'),
+  'U[joined/owner/pinned] owners=2 W[joined/admin/pinned] owners=2 Z[joined/owner/written] owners=2',
+  'EC-2.bootstrap.post: only the creator''s row is written (as owner); U and W unchanged');
+
+-- _fedsession_autojoin_default_board: inserts a NEW row for the joining agent only.
+insert into _g674_case values ('EC2.fed', pg_temp.g674_board('{"H": [], "U": "owner", "W": "admin", "_creator": "U"}'::jsonb));
+insert into agent_board.identity_providers(issuer, audience, supported, policy_approved, allowed_agent_kinds, default_board_id)
+values ('https://g674-' || pg_temp.g674_b('EC2.fed') || '.test', 'message-board', true, true, '{human}', pg_temp.g674_b('EC2.fed'));
+select lives_ok(
+  format('select agent_board._fedsession_autojoin_default_board(ip, %L::uuid) from agent_board.identity_providers ip where ip.issuer = %L',
+         pg_temp.g674_a('EC2.fed', 'H'), 'https://g674-' || pg_temp.g674_b('EC2.fed') || '.test'),
+  'EC-2.autojoin.call: the default-board auto-join runs');
+select is(pg_temp.g674_who('EC2.fed', 'H,U,W'),
+  'H[joined/member/written] owners=1 U[joined/owner/pinned] owners=1 W[joined/admin/pinned] owners=1',
+  'EC-2.autojoin.post: one new member row for the joining agent; U and W unchanged');
+
+-- _redeem_unbounded_invite_for_agent: rank-max on the REDEEMER's own row only. A member
+-- redeeming a lower (observer) preset keeps member (as agent_board_roomlink.test.sql R-LINK-1).
+-- source-scan: loud-literal one body, named by regprocedure; a miss fails
+select ok(
+  strpos(lower(agent_board_test.stripped_body('agent_board._redeem_unbounded_invite_for_agent(text,uuid)'::regprocedure)),
+         'agent_board._role_rank(excluded.role) >') > 0,
+  'EC-2.redeem.pin: the rank-max CASE (_role_rank(excluded.role) >) is present');
+insert into _g674_case values ('EC2.redeem', pg_temp.g674_board('{"M": "member", "U": "owner", "W": "admin", "_creator": "U"}'::jsonb));
+create temp table _674_link on commit drop as
+select code from agent_board.create_invite_link(pg_temp.g674_b('EC2.redeem'), 'observer', 'joined', null, null,
+                                                pg_temp.g674_a('EC2.redeem', 'U'), '{}'::jsonb);
+select lives_ok(
+  format('select * from agent_board._redeem_unbounded_invite_for_agent(%L, %L::uuid)',
+         (select code from _674_link), pg_temp.g674_a('EC2.redeem', 'M')),
+  'EC-2.redeem.call: a member redeems an observer-preset link');
+select is(pg_temp.g674_who('EC2.redeem', 'M,U,W'),
+  'M[joined/member/written] owners=1 U[joined/owner/pinned] owners=1 W[joined/admin/pinned] owners=1',
+  'EC-2.redeem.post: the redeemer keeps member (rank-max, never lowered); U and W unchanged');
+
+-- The sink: role is written only as member, on non-active -> active re-entry.
+insert into _g674_case values ('EC2.sink', pg_temp.g674_board('{"B": "admin", "U": "owner", "W": "admin", "_creator": "U"}'::jsonb));
+select lives_ok(
+  format('select agent_board._upsert_board_membership_state(%L::uuid, %L::uuid, ''left'')',
+         pg_temp.g674_b('EC2.sink'), pg_temp.g674_a('EC2.sink', 'B')),
+  'EC-2.sink.leave.call: a bystander admin leaves through the sink');
+select lives_ok(
+  format('select agent_board._upsert_board_membership_state(%L::uuid, %L::uuid, ''joined'')',
+         pg_temp.g674_b('EC2.sink'), pg_temp.g674_a('EC2.sink', 'B')),
+  'EC-2.sink.rejoin.call: and rejoins through the sink');
+select is(
+  (select bm.role from agent_board.board_memberships bm
+    where bm.board_id = pg_temp.g674_b('EC2.sink') and bm.agent_id = pg_temp.g674_a('EC2.sink', 'B')
+      and bm.membership_state in ('joined', 'subscribed')),
+  'member',
+  'EC-2.sink.post: re-entry is clamped to member (ROLERESET)');
+select is(pg_temp.g674_who('EC2.sink', 'U,W'),
+  'U[joined/owner/pinned] owners=1 W[joined/admin/pinned] owners=1',
+  'EC-2.sink.bystanders: U and W unchanged across the leave and rejoin');
+
+-- The session-identity writers, on one board seating root R (owner), its human owner HO
+-- (owner), and bystanders U (owner) and W (admin). The fixture follows
+-- agent_board_session_identity_link.test.sql: a real root policy, real mints, real lease claims.
+insert into _g674_case values ('EC2.sid',
+  pg_temp.g674_board('{"HO": "owner", "R": "owner", "U": "owner", "W": "admin", "_creator": "R", "_human_of": {"R": "HO"}}'::jsonb));
+create temp table _674_sid(label text primary key, agent_id uuid, key_id uuid, auth_id uuid, epoch bigint) on commit drop;
+grant select, insert, update on _674_sid to authenticated, service_role;
+grant execute on function public.test_pubkey(text) to authenticated;
+update agent_board.agents set agent_type = 'human' where id = pg_temp.g674_a('EC2.sid', 'HO');
+insert into agent_board.session_identities(agent_id, root_agent_id, depth, approved_risky_digest, current_risky_digest)
+values (pg_temp.g674_a('EC2.sid', 'R'), pg_temp.g674_a('EC2.sid', 'R'), 0, 'approved', 'approved');
+create function pg_temp.g674_mint(p_label text, p_parent text, p_role text, p_fork text default null) returns void language plpgsql as $$
+declare v_parent uuid; v_res record;
+begin
+  v_parent := coalesce((select agent_id from _674_sid where label = p_parent), pg_temp.g674_a('EC2.sid', 'R'));
+  select * into v_res from agent_board.mint_delegated_child(v_parent,
+    'g674-sid-' || lower(p_label) || '-' || substr(replace(pg_temp.g674_b('EC2.sid')::text, '-', ''), 1, 12),
+    '["read","write"]', public.test_pubkey('g674-sid-' || p_label || pg_temp.g674_b('EC2.sid')), interval '8 hours', false,
+    'claude', 'g674-sid-' || p_label, case when p_parent is null then null else '0' end,
+    jsonb_build_array(jsonb_build_object('board_id', pg_temp.g674_b('EC2.sid'), 'role', p_role)),
+    '{"resolution":"resolved","risky_digest":"approved"}', (select agent_id from _674_sid where label = p_fork));
+  insert into _674_sid select p_label, v_res.child_agent_id, v_res.signing_key_id, a.auth_user_id, null
+    from agent_board.agents a where a.id = v_res.child_agent_id;
+end;
+$$;
+create function pg_temp.g674_claim(p_label text) returns void language plpgsql as $$
+declare v_child record; v_challenge record;
+begin
+  select * into v_child from _674_sid where label = p_label;
+  select * into v_challenge from agent_board.issue_signing_key_challenge(v_child.agent_id, 'delegated-ephemeral');
+  update _674_sid set epoch = (
+    select m.identity_lease_epoch from agent_board.mint_fleet_agent_session(v_challenge.challenge_id,
+      split_part(v_challenge.challenge, ':', 3), v_child.key_id, v_child.agent_id, 900, null, 'g674-sid-' || p_label) m)
+   where label = p_label;
+end;
+$$;
+create function pg_temp.g674_link(p_label text, p_alias text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claim.sub', (select auth_id::text from _674_sid where label = p_label), true);
+  perform set_config('request.jwt.claim.identity_lease_epoch', (select epoch::text from _674_sid where label = p_label), true);
+  perform agent_board.link_session_alias((select agent_id from _674_sid where label = p_label),
+    (select epoch::text from _674_sid where label = p_label), p_alias);
+end;
+$$;
+create function pg_temp.g674_sid_role(p_label text) returns text language sql stable as $$
+  select coalesce(string_agg(bm.membership_state || '/' || bm.role, ',' order by bm.created_at, bm.id), '(none)')
+    from agent_board.board_memberships bm
+   where bm.board_id = pg_temp.g674_b('EC2.sid') and bm.agent_id = (select agent_id from _674_sid where label = p_label)
+$$;
+grant execute on function pg_temp.g674_mint(text, text, text, text), pg_temp.g674_claim(text), pg_temp.g674_link(text, text),
+  pg_temp.g674_sid_role(text), pg_temp.g674_b(text), pg_temp.g674_a(text, text) to service_role, authenticated;
+
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok(format('select agent_board.upsert_delegation_policy(%L::uuid, ''root_minted'', ''["read","write"]'', 200, interval ''7 days'', true)',
+                       pg_temp.g674_a('EC2.sid', 'R')),
+  'EC-2.sid.policy: a real root policy permits the fixture');
+
+-- mint_delegated_child: a fresh agent only, bounded by the parent.
+-- source-scan: loud-literal one body, named by regprocedure; a miss fails
+select ok(
+  strpos(lower(agent_board_test.stripped_body('agent_board.mint_delegated_child(uuid,text,jsonb,text,interval,boolean,text,text,text,jsonb,jsonb,uuid)'::regprocedure)),
+         'where id = v_membership.id') > 0,
+  'EC-2.mint.pin: mint sets role only on the membership row it just seated');
+select lives_ok($q$select pg_temp.g674_mint('I', null, 'owner')$q$,
+  'EC-2.mint.call: the root mints identity I onto the board as owner');
+reset role;
+select is(pg_temp.g674_sid_role('I'), 'joined/owner', 'EC-2.mint.post: the fresh child holds the requested role');
+select is(pg_temp.g674_who('EC2.sid', 'HO,R,U,W'),
+  'HO[joined/owner/pinned] owners=4 R[joined/owner/pinned] owners=4 U[joined/owner/pinned] owners=4 W[joined/admin/pinned] owners=4',
+  'EC-2.mint.bystanders: the root, its human owner, U and W are unchanged');
+set local role service_role;
+select lives_ok($q$select pg_temp.g674_claim('I'); select pg_temp.g674_mint('C', 'I', 'owner'); select pg_temp.g674_claim('C')$q$,
+  'EC-2.sid.fixture: I claims its lease and mints its own child C (owner)');
+reset role;
+select is(pg_temp.g674_sid_role('C'), 'joined/owner', 'EC-2.sid.fixture-state: I and C both hold owner');
+
+-- Narrow the parent (the root) to admin through its own self-grant (service, supplied = target).
+select pg_temp.g674_service();
+select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, ''admin'', %L::uuid)',
+                       pg_temp.g674_b('EC2.sid'), pg_temp.g674_a('EC2.sid', 'R'), pg_temp.g674_a('EC2.sid', 'R')),
+  'EC-2.link.narrow: the parent R is narrowed to admin by its own self-grant');
+
+-- mint above the parent's role is refused.
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select throws_ok($q$select pg_temp.g674_mint('X', null, 'owner')$q$,
+  '42501', 'room_authority_exceeded',
+  'EC-2.mint.above.call: a mint above the parent''s (now admin) role is refused');
+reset role;
+select is((select count(*)::int from _674_sid where label = 'X'), 0, 'EC-2.mint.above.post: no child was minted');
+
+-- link_session_alias: narrows only the identity lineage (I and its child C), clamped to the
+-- parent's role. U, W, R and HO are outside the lineage and unchanged.
+create temp table _674_before on commit drop as
+select pg_temp.g674_rows_only('EC2.sid', 'HO,R,U,W') as who;
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select pg_temp.g674_link('I', 'g674-sid-I-later')$q$,
+  'EC-2.link.call: I''s verified holder links a new alias');
+reset role;
+select is(pg_temp.g674_sid_role('I') || ' ' || pg_temp.g674_sid_role('C'), 'joined/admin joined/admin',
+  'EC-2.link.post: I and its descendant C are clamped to the parent''s admin');
+select is(pg_temp.g674_rows_only('EC2.sid', 'HO,R,U,W'), (select who from _674_before),
+  'EC-2.link.bystanders: R, HO, U and W are outside the lineage and unchanged');
+
+-- readmit_session_identity: the human owner readmits a revoked identity as a FRESH agent with a
+-- role no higher than the old one. U and W are unchanged.
+-- source-scan: loud-literal one body, named by regprocedure; a miss fails
+select ok(
+  strpos(lower(agent_board_test.stripped_body('agent_board.readmit_session_identity(uuid,text,text,jsonb,jsonb,interval)'::regprocedure)),
+         'where id = v_membership.id') > 0,
+  'EC-2.readmit.pin: readmit sets role only on the membership row it just seated');
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select pg_temp.g674_mint('F', null, 'admin', 'I')$q$,
+  'EC-2.readmit.fixture: the root mints F, a fork of I, as admin (readmission needs a revoked fork)');
+reset role;
+create temp table _674_readmit(child_agent_id uuid, grant_expires_at timestamptz, signing_key_id uuid) on commit drop;
+grant insert, select on _674_readmit to authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select auth_user::text from _g674_agent where agent_id = pg_temp.g674_a('EC2.sid', 'HO')), true);
+set local role authenticated;
+select lives_ok(format('select agent_board.revoke_session_identity(%L::uuid)', (select agent_id from _674_sid where label = 'F')),
+  'EC-2.readmit.revoke: the human owner revokes F');
+select lives_ok(format($q$insert into _674_readmit select * from agent_board.readmit_session_identity(%L::uuid, %L, %L, '["read"]',
+                         jsonb_build_array(jsonb_build_object('board_id', %L::uuid, 'role', 'observer')), interval '14 days')$q$,
+                       (select agent_id from _674_sid where label = 'F'),
+                       'g674-sid-readmit-' || substr(replace(pg_temp.g674_b('EC2.sid')::text, '-', ''), 1, 12),
+                       public.test_pubkey('g674-readmit-' || pg_temp.g674_b('EC2.sid')), pg_temp.g674_b('EC2.sid')),
+  'EC-2.readmit.call: the human owner readmits F as a fresh principal');
+reset role;
+select pg_temp.g674_service();
+select is(
+  (select bm.membership_state || '/' || bm.role from agent_board.board_memberships bm
+    where bm.board_id = pg_temp.g674_b('EC2.sid') and bm.agent_id = (select child_agent_id from _674_readmit)),
+  'joined/observer',
+  'EC-2.readmit.post: only the fresh agent''s row carries the (lower) readmitted role');
+select is(pg_temp.g674_who('EC2.sid', 'U,W'),
+  'U[joined/owner/pinned] owners=2 W[joined/admin/pinned] owners=2',
+  'EC-2.readmit.bystanders: U and W unchanged');
+
+-- ===========================================================================
+-- EC-3: the chokepoint's posture after the redefinition
+-- ===========================================================================
+select is(
+  (select has_function_privilege('anon', p.oid, 'EXECUTE')::text || '/' ||
+          has_function_privilege('authenticated', p.oid, 'EXECUTE')::text || '/' ||
+          has_function_privilege('service_role', p.oid, 'EXECUTE')::text || '/' ||
+          has_function_privilege('agent_board_delegate', p.oid, 'EXECUTE')::text
+     from pg_proc p where p.oid = 'agent_board.grant_board_role(uuid,uuid,text,uuid)'::regprocedure),  -- pgtap-allow-raise-checked: a regprocedure literal names the RPC, nothing calls it
+  'false/true/true/false',
+  'EC-3.acl: grant_board_role EXECUTE is anon f, authenticated t, service_role t, agent_board_delegate f');
+select is(
+  (select p.prosecdef::text || ' ' || coalesce(array_to_string(p.proconfig, ';'), '(none)')
+     from pg_proc p where p.oid = 'agent_board.grant_board_role(uuid,uuid,text,uuid)'::regprocedure),  -- pgtap-allow-raise-checked: a regprocedure literal names the RPC, nothing calls it
+  'true search_path=agent_board, public',
+  'EC-3.secdef: still SECURITY DEFINER with the unchanged search_path');
+select ok(
+  coalesce(obj_description('agent_board.grant_board_role(uuid,uuid,text,uuid)'::regprocedure, 'pg_proc'), '') like '%#674%',
+  'EC-3.comment: the restated COMMENT names #674');
+select is(
+  (select count(*)::int from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace and p.proname = 'grant_board_role'),
+  1,
+  'EC-3.overloads: exactly one grant_board_role');
+select * from finish();
+rollback;