@consiliency/agent-board-schema 1.60.0 → 1.64.0

package/tests/agent_board_session_identity_lease.test.sql

@@ -0,0 +1,235 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(56);
+
+create temp table _sid_fixture(label text primary key, root_id uuid, agent_id uuid, key_id uuid, auth_id uuid);
+create temp table _sid_results(label text, session_id text, expires_at timestamptz, epoch bigint, secret text);
+do $$
+declare v_label text; v_root uuid; v_agent uuid; v_key uuid; v_auth uuid; v_alias uuid;
+begin
+  foreach v_label in array array['codex', 'claude', 'legacy'] loop
+    v_root := gen_random_uuid(); v_agent := gen_random_uuid(); v_key := gen_random_uuid();
+    v_auth := public.ensure_github_user('sid-' || v_agent, 'sid-' || v_agent || '@example.test', 'sid-' || v_agent, 'SID');
+    insert into agent_board.agents(id, agent_type, handle, display_name, status)
+    values (v_root, 'agent', 'sid-root-' || v_root, 'SID root', 'active');
+    insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, parent_agent_id, root_agent_id)
+    values (v_agent, 'agent', 'sid-' || v_agent, 'SID', 'active', v_auth, v_root, v_root);
+    insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+    values (v_key, v_agent, 'primary', 1, public.test_pubkey(v_key::text), 'raw_ed25519_base64url', public.test_key_fingerprint(v_key::text), 'active', 'proven');
+    insert into agent_board.session_identities(agent_id, root_agent_id, depth)
+    values (v_root, v_root, 0);
+    insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth, identity_kind, harness, approved_risky_digest, current_risky_digest)
+    values (v_agent, v_root, v_root, 1, case when v_label = 'legacy' then 'legacy' else 'session' end,
+      case when v_label = 'legacy' then null else v_label end, 'approved', 'approved');
+    if v_label <> 'legacy' then
+      insert into agent_board.session_id_aliases(identity_agent_id, root_agent_id, harness, session_id)
+      values (v_agent, v_root, v_label, 'bound-' || v_label) returning id into v_alias;
+      update agent_board.session_identities set lease_alias_id = v_alias where agent_id = v_agent;
+    end if;
+    insert into _sid_fixture values (v_label, v_root, v_agent, v_key, v_auth);
+  end loop;
+end;
+$$;
+grant select on _sid_fixture to service_role, authenticated;
+grant select, insert on _sid_results to service_role;
+
+-- INVOKER, so the actual RPC runs as service_role rather than a fixture definer.
+create function pg_temp.sid_mint(p_label text, p_result text, p_secret text default null, p_alias text default null)
+returns void language plpgsql as $$
+declare v_fx record; v_issued record;
+begin
+  select * into v_fx from _sid_fixture where label = p_label;
+  select * into v_issued from agent_board.issue_signing_key_challenge(v_fx.agent_id, 'primary');
+  insert into _sid_results
+  select p_result, m.session_id, m.expires_at, m.identity_lease_epoch, m.holder_secret
+    from agent_board.mint_fleet_agent_session(v_issued.challenge_id, split_part(v_issued.challenge, ':', 3), v_fx.key_id, v_fx.agent_id, 900, p_secret, p_alias) m;
+end;
+$$;
+grant execute on function pg_temp.sid_mint(text, text, text, text) to service_role;
+-- A successful refusal probe raises a distinct sentinel, rolling its writes
+-- back in throws_ok's subtransaction instead of poisoning independent cases.
+-- Only the RPC's original refusal can pass the assertion.
+create function pg_temp.sid_refuse(p_call text)
+returns void language plpgsql as $$
+begin
+  execute p_call;
+  raise exception 'expected refusal but RPC succeeded' using errcode = 'P0001';
+end;
+$$;
+grant execute on function pg_temp.sid_refuse(text) to authenticated, service_role;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select auth_id::text from _sid_fixture where label = 'codex'), true);
+select set_config('request.jwt.claims', '{}', true);
+select set_config('request.jwt.claim.identity_lease_epoch', '', true);
+set local role authenticated;
+select is(agent_board.current_agent_id(), null::uuid,
+  'EC-SIDSCHEMA-1-epoch-unclaimed: immutable session kind fences even before the first lease');
+reset role;
+set local role service_role;
+select set_config('request.jwt.claim.role', 'service_role', true);
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$select pg_temp.sid_mint('codex', 'wrong-first', null, 'other')$q$),
+  '42501', 'identity_continuity_refused', 'EC-SIDSCHEMA-1-first-id: unclaimed claim must equal its reserved alias');
+select lives_ok($q$select pg_temp.sid_mint('codex', 'first', null, 'bound-codex')$q$,
+  'EC-SIDSCHEMA-1-first: a non-Claude initial claim succeeds without a holder secret');
+reset role;
+select is((select count(*) from _sid_results where label = 'first'), 1::bigint,
+  'EC-SIDSCHEMA-1-first-state: the first claim returns one result');
+select is((select epoch from _sid_results where label = 'first'), 0::bigint,
+  'EC-SIDSCHEMA-1-first-epoch: first claim keeps epoch zero');
+select ok((select secret ~ '^[0-9a-f]{64}$' from _sid_results where label = 'first'),
+  'EC-SIDSCHEMA-1-first-secret: first claim returns 256 bits of holder secret');
+select is((select si.holder_secret_hash from agent_board.session_identities si join _sid_fixture f on si.agent_id = f.agent_id where f.label = 'codex'),
+  (select digest(secret, 'sha256') from _sid_results where label = 'first'),
+  'EC-SIDSCHEMA-1-secret-hash: only the sha256 is stored');
+select is((select si.last_heartbeat from agent_board.session_identities si join _sid_fixture f on si.agent_id = f.agent_id where f.label = 'codex'), now(),
+  'EC-SIDSCHEMA-1-first-heartbeat: claim starts its heartbeat');
+select ok(not exists (select 1 from agent_board.session_identities si cross join _sid_results r
+  where r.label = 'first' and to_jsonb(si)::text like '%' || r.secret || '%'),
+  'EC-SIDSCHEMA-1-secret-identity: no identity column stores the plaintext secret');
+select ok(not exists (select 1 from agent_board.nonfleet_sessions s cross join _sid_results r
+  where r.label = 'first' and to_jsonb(s)::text like '%' || r.secret || '%'),
+  'EC-SIDSCHEMA-1-secret-session: no token session column stores the plaintext secret');
+
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$select pg_temp.sid_mint('codex', 'wrong', 'former-holder', 'bound-codex')$q$),
+  '42501', 'identity_lease_not_held', 'EC-SIDSCHEMA-1-live-wrong: a wrong secret cannot claim the live lease');
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$select pg_temp.sid_mint('codex', 'duplicate', null, 'bound-codex')$q$),
+  '42501', 'duplicate_live_session', 'EC-SIDSCHEMA-1-live-duplicate: no secret with the identical bound id refuses duplicate');
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$select pg_temp.sid_mint('codex', 'other', null, 'other')$q$),
+  '42501', 'identity_lease_live', 'EC-SIDSCHEMA-1-live-other: no secret with another id refuses live');
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$select pg_temp.sid_mint('codex', 'absent', null, null)$q$),
+  '42501', 'identity_lease_live', 'EC-SIDSCHEMA-1-live-absent: no secret and no id refuses live');
+select lives_ok($q$select pg_temp.sid_mint('codex', 'holder', (select secret from _sid_results where label = 'first'), null)$q$,
+  'EC-SIDSCHEMA-1-live-holder: matching holder secret mints without rotating');
+select throws_ok((select format('select pg_temp.sid_refuse(%L)', format('select agent_board.link_session_alias(%L, %L, %L)', agent_id, '0', 'new-codex-id')) from _sid_fixture where label = 'codex'),
+  '42501', 'identity_continuity_refused', 'EC-SIDSCHEMA-1-link-nonclaude: live non-Claude holder cannot bind a new id');
+select throws_ok((select format('select pg_temp.sid_refuse(%L)', format('select agent_board.link_session_alias(%L, %L, %L)', agent_id, '1', 'bound-codex')) from _sid_fixture where label = 'codex'),
+  '42501', 'identity_lease_not_held', 'EC-SIDSCHEMA-1-link-epoch: a stale forwarded epoch cannot link');
+reset role;
+select is((select count(*) from agent_board.session_id_aliases where identity_agent_id = (select agent_id from _sid_fixture where label = 'codex')), 1::bigint,
+  'EC-SIDSCHEMA-1-link-refusal-state: refused links bind no aliases');
+select is((select epoch from _sid_results where label = 'holder'), 0::bigint,
+  'EC-SIDSCHEMA-1-live-epoch: matching holder keeps its epoch');
+select is((select secret from _sid_results where label = 'holder'), null::text,
+  'EC-SIDSCHEMA-1-live-secret: non-rotating mint never returns the secret');
+select is((select count(*) from _sid_results), 2::bigint,
+  'EC-SIDSCHEMA-1-live-state: refusing attempts write no result');
+
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select auth_id::text from _sid_fixture where label = 'codex'), true);
+select set_config('request.jwt.claims', '{}', true);
+select set_config('request.jwt.claim.identity_lease_epoch', '', true);
+set local role authenticated;
+select is(agent_board.current_agent_id(), null::uuid, 'EC-SIDSCHEMA-1-epoch-absent: a session identity requires an epoch');
+select set_config('request.jwt.claim.identity_lease_epoch', 'garbage', true);
+select is(agent_board.current_agent_id(), null::uuid, 'EC-SIDSCHEMA-1-epoch-malformed: malformed epoch denies without casting');
+select set_config('request.jwt.claim.identity_lease_epoch', '0', true);
+select is(agent_board.current_agent_id(), (select agent_id from _sid_fixture where label = 'codex'),
+  'EC-SIDSCHEMA-1-epoch-scalar: scalar JWT GUC resolves the current epoch');
+select set_config('request.jwt.claim.identity_lease_epoch', '', true);
+select set_config('request.jwt.claims', '{"identity_lease_epoch":"0"}', true);
+select is(agent_board.current_agent_id(), (select agent_id from _sid_fixture where label = 'codex'),
+  'EC-SIDSCHEMA-1-epoch-json: Realtime JSON JWT GUC resolves the current epoch');
+reset role;
+update agent_board.session_identities set last_heartbeat = now() - interval '60 seconds'
+  where agent_id = (select agent_id from _sid_fixture where label = 'codex');
+set local role authenticated;
+select lives_ok($q$select agent_board.heartbeat_session_identity((select agent_id from _sid_fixture where label = 'codex'))$q$,
+  'EC-SIDSCHEMA-1-heartbeat-live: current holder refreshes a live lease');
+reset role;
+select is((select last_heartbeat from agent_board.session_identities where agent_id = (select agent_id from _sid_fixture where label = 'codex')), now(),
+  'EC-SIDSCHEMA-1-heartbeat-state: live heartbeat updates the stored time');
+update agent_board.session_identities set last_heartbeat = now() - interval '180 seconds'
+  where agent_id = (select agent_id from _sid_fixture where label = 'codex');
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$select agent_board.heartbeat_session_identity((select agent_id from _sid_fixture where label = 'codex'))$q$),
+  '42501', 'identity_lease_lapsed', 'EC-SIDSCHEMA-1-heartbeat-lapsed: heartbeat cannot revive a lapsed lease');
+reset role;
+select is((select last_heartbeat from agent_board.session_identities where agent_id = (select agent_id from _sid_fixture where label = 'codex')), now() - interval '180 seconds',
+  'EC-SIDSCHEMA-1-heartbeat-refused-state: refused heartbeat writes nothing');
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select throws_ok((select format('select agent_board.link_session_alias(%L, %L, %L)', agent_id, '0', 'bound-codex') from _sid_fixture where label = 'codex'),
+  '42501', 'identity_lease_lapsed', 'EC-SIDSCHEMA-1-link-lapsed: link never reclaims a lapsed lease');
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$select pg_temp.sid_mint('codex', 'discontinuous', null, 'new-codex-id')$q$),
+  '42501', 'identity_continuity_refused', 'EC-SIDSCHEMA-1-reclaim-nonclaude: new non-Claude id is not continuity');
+select lives_ok($q$select pg_temp.sid_mint('codex', 'reclaimed', null, 'bound-codex')$q$,
+  'EC-SIDSCHEMA-1-reclaim: exactly 180 seconds old can be reclaimed with PoP and a bound alias');
+reset role;
+select is((select epoch from _sid_results where label = 'reclaimed'), 1::bigint,
+  'EC-SIDSCHEMA-1-reclaim-epoch: reclaim increments the epoch');
+select ok((select secret is not null and secret <> (select secret from _sid_results where label = 'first') from _sid_results where label = 'reclaimed'),
+  'EC-SIDSCHEMA-1-reclaim-secret: reclaim rotates the secret');
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claims', '{"identity_lease_epoch":"0"}', true);
+set local role authenticated;
+select is(agent_board.current_agent_id(), null::uuid, 'EC-SIDSCHEMA-1-epoch-stale: reclaim fences the old credential immediately');
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$select agent_board.heartbeat_session_identity((select agent_id from _sid_fixture where label = 'codex'))$q$),
+  '42501', 'identity_lease_not_held', 'EC-SIDSCHEMA-1-heartbeat-stale: old holder cannot heartbeat after reclaim');
+reset role;
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$select pg_temp.sid_mint('codex', 'former', (select secret from _sid_results where label = 'first'), 'bound-codex')$q$),
+  '42501', 'identity_lease_not_held', 'EC-SIDSCHEMA-1-former-secret: same key with the former secret cannot reclaim a live lease');
+select lives_ok($q$select pg_temp.sid_mint('claude', 'claude-first', null, 'bound-claude')$q$,
+  'EC-SIDSCHEMA-1-claude-first: Claude initial reserved alias claims');
+select set_config('request.jwt.claim.sub', (select auth_id::text from _sid_fixture where label = 'claude'), true);
+reset role;
+select is((select count(*) from _sid_results where label = 'claude-first'), 1::bigint,
+  'EC-SIDSCHEMA-1-claude-first-state: first Claude claim returns once');
+set local role service_role;
+select lives_ok((select format('select agent_board.link_session_alias(%L, %L, %L)', agent_id, '0', 'linked-claude') from _sid_fixture where label = 'claude'),
+  'EC-SIDSCHEMA-1-link-live: verified live Claude holder binds a new continuity alias');
+reset role;
+select is((select count(*) from agent_board.session_id_aliases where identity_agent_id = (select agent_id from _sid_fixture where label = 'claude') and session_id = 'linked-claude'), 1::bigint,
+  'EC-SIDSCHEMA-1-link-state: allowed link writes exactly its new alias');
+set local role service_role;
+select lives_ok((select format('select agent_board.link_session_alias(%L, %L, %L)', agent_id, '0', 'linked-claude') from _sid_fixture where label = 'claude'),
+  'EC-SIDSCHEMA-1-link-idempotent: an already-bound live alias can be linked again');
+reset role;
+select is((select count(*) from agent_board.session_id_aliases where identity_agent_id = (select agent_id from _sid_fixture where label = 'claude') and session_id = 'linked-claude'), 1::bigint,
+  'EC-SIDSCHEMA-1-link-idempotent-state: repeated link preserves exactly one alias');
+update agent_board.session_identities set last_heartbeat = now() - interval '180 seconds'
+  where agent_id = (select agent_id from _sid_fixture where label = 'claude');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_mint('claude', 'claude-reclaim', null, 'continued-claude')$q$,
+  'EC-SIDSCHEMA-1-claude-reclaim: trusted Claude new-id continuity reclaims a lapsed lease');
+reset role;
+select is((select count(*) from agent_board.session_id_aliases where identity_agent_id = (select agent_id from _sid_fixture where label = 'claude') and session_id = 'continued-claude'), 1::bigint,
+  'EC-SIDSCHEMA-1-claude-alias: reclaim binds its new alias');
+select is((select epoch from _sid_results where label = 'claude-reclaim'), 1::bigint,
+  'EC-SIDSCHEMA-1-claude-epoch: new-alias reclaim also fences the prior holder');
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$update agent_board.session_identities set identity_kind = 'legacy', harness = null where agent_id = (select agent_id from _sid_fixture where label = 'codex')$q$),
+  '42501', 'session identity kind is immutable', 'EC-SIDSCHEMA-1-kind: session identity kind cannot be changed');
+select throws_ok(format('select pg_temp.sid_refuse(%L)', $q$update agent_board.session_identities set holder_secret_hash = null where agent_id = (select agent_id from _sid_fixture where label = 'codex')$q$),
+  '42501', 'a claimed session lease cannot be cleared', 'EC-SIDSCHEMA-1-lease-preserved: claimed lease cannot be nulled to bypass fencing');
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select auth_id::text from _sid_fixture where label = 'legacy'), true);
+select set_config('request.jwt.claims', '{}', true);
+select set_config('request.jwt.claim.identity_lease_epoch', '', true);
+set local role authenticated;
+select is(agent_board.current_agent_id(), (select agent_id from _sid_fixture where label = 'legacy'),
+  'EC-SIDSCHEMA-1-legacy: legacy identity still resolves without an epoch');
+reset role;
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_mint('legacy', 'legacy', null, null)$q$,
+  'EC-SIDSCHEMA-1-legacy-mint: legacy key PoP still mints without session context');
+reset role;
+select is((select epoch from _sid_results where label = 'legacy'), null::bigint,
+  'EC-SIDSCHEMA-1-legacy-epoch: legacy mint introduces no lease epoch');
+select is((select secret from _sid_results where label = 'legacy'), null::text,
+  'EC-SIDSCHEMA-1-legacy-secret: legacy mint introduces no holder secret');
+select is(has_function_privilege('service_role', 'agent_board._mint_fleet_agent_session_legacy(uuid,text,uuid,uuid,integer)', 'EXECUTE'), false,
+  'EC-SIDSCHEMA-1-private-token: renamed implementation cannot bypass the fenced mint');
+select is(to_regprocedure('agent_board._mint_delegated_child_legacy(uuid,text,jsonb,text,interval,boolean)'), null::regprocedure,
+  'EC-SIDSCHEMA-1-private-child: no legacy child implementation can bypass the single session child mint');
+select ok((select bool_and(expires_at <= now() + interval '900 seconds') from _sid_results),
+  'EC-SIDSCHEMA-6-token-cap: every session token stays within 900 seconds');
+select ok((select count(*) > 0 and bool_and(s.expires_at <= now() + interval '900 seconds')
+  from agent_board.nonfleet_sessions s join _sid_fixture f on f.agent_id = s.agent_id),
+  'EC-SIDSCHEMA-6-token-stored-cap: issued fixture tokens exist and their stored expiry also stays within 900 seconds');
+select finish();
+rollback;

package/tests/agent_board_session_identity_lifetime.test.sql

@@ -0,0 +1,230 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(45);
+create temp table _sid_lifetime_root(root_id uuid, root_auth uuid);
+create temp table _sid_lifetime_children(label text primary key, agent_id uuid, key_id uuid, expires_at timestamptz);
+create temp table _sid_lifetime_tokens(label text, expires_at timestamptz, epoch bigint);
+do $$
+declare v_root uuid := gen_random_uuid(); v_auth uuid;
+begin
+  v_auth := public.ensure_github_user('sid-life-' || v_root, 'sid-life-' || v_root || '@example.test', 'sid-life-' || v_root, 'Lifetime root');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_root, 'agent', 'sid-life-' || v_root, 'Lifetime root', 'active', v_auth, v_auth);
+  insert into agent_board.session_identities(agent_id, root_agent_id, depth, current_risky_digest, approved_risky_digest)
+  values (v_root, v_root, 0, 'approved', 'approved');
+  insert into _sid_lifetime_root values (v_root, v_auth);
+end;
+$$;
+grant select on _sid_lifetime_root, _sid_lifetime_children to authenticated, service_role;
+grant insert on _sid_lifetime_children, _sid_lifetime_tokens to service_role;
+create function pg_temp.sid_lifetime_mint(p_label text, p_parent text default null)
+returns void language plpgsql as $$
+declare v_parent uuid; v_session boolean := p_label <> 'legacy';
+begin
+  v_parent := coalesce((select agent_id from _sid_lifetime_children where label = p_parent), (select root_id from _sid_lifetime_root));
+  insert into _sid_lifetime_children
+  select p_label, m.child_agent_id, m.signing_key_id, m.grant_expires_at
+  from agent_board.mint_delegated_child(v_parent, 'sid-life-' || p_label || '-' || substr(v_parent::text, 1, 8), '[]',
+    public.test_pubkey(p_label || v_parent), interval '30 days', false,
+    case when v_session then 'claude' end, case when v_session then 'life-' || p_label end,
+    case when p_parent is not null then '0' end, '[]',
+    case when v_session then '{"resolution":"resolved","risky_digest":"approved"}'::jsonb end) m;
+end;
+$$;
+create function pg_temp.sid_lifetime_token(p_label text)
+returns void language plpgsql as $$
+declare v_child record; v_challenge record;
+begin
+  select * into v_child from _sid_lifetime_children where label = p_label;
+  select * into v_challenge from agent_board.issue_signing_key_challenge(v_child.agent_id, 'delegated-ephemeral');
+  insert into _sid_lifetime_tokens
+  select p_label, m.expires_at, m.identity_lease_epoch from agent_board.mint_fleet_agent_session(
+    v_challenge.challenge_id, split_part(v_challenge.challenge, ':', 3), v_child.key_id, v_child.agent_id, 900, null, 'life-' || p_label) m;
+end;
+$$;
+create function pg_temp.sid_lifetime_refuse(p_call text)
+returns void language plpgsql as $$
+begin
+  execute p_call;
+  raise exception 'expected refusal but RPC succeeded' using errcode = 'P0001';
+end;
+$$;
+grant execute on function pg_temp.sid_lifetime_mint(text, text), pg_temp.sid_lifetime_token(text), pg_temp.sid_lifetime_refuse(text) to service_role, authenticated;
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sid_lifetime_root), 'root_minted', '[]', 200, interval '30 days', true)$q$,
+  'EC-SIDSCHEMA-4-policy-control: operator configures its legacy lifetime latitude');
+reset role;
+select is((select operator_child_ttl_ceiling from agent_board.delegation_policies where root_agent_id = (select root_id from _sid_lifetime_root)), interval '30 days',
+  'EC-SIDSCHEMA-4-policy-state: operator ceiling is stored');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_lifetime_mint('parent'); select pg_temp.sid_lifetime_mint('child', 'parent'); select pg_temp.sid_lifetime_mint('legacy')$q$,
+  'EC-SIDSCHEMA-4-mint-control: attested and legacy mints enter the real issuer');
+reset role;
+select is((select count(*) from _sid_lifetime_children), 3::bigint, 'EC-SIDSCHEMA-4-mint-state: all three distinct principals exist');
+select is((select expires_at from _sid_lifetime_children where label = 'parent'), now() + interval '7 days',
+  'EC-SIDSCHEMA-4-mint-attested: approved session mint has a seven-day ceiling');
+select is((select expires_at from _sid_lifetime_children where label = 'legacy'), now() + interval '30 days',
+  'EC-SIDSCHEMA-4-mint-legacy: operator legacy mint preserves its latitude');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_lifetime_token('parent'); select pg_temp.sid_lifetime_token('child')$q$,
+  'EC-SIDSCHEMA-4-token-control: real challenge and key gates claim both session leases');
+reset role;
+select is((select count(*) from _sid_lifetime_tokens), 2::bigint, 'EC-SIDSCHEMA-4-token-state: both claims produced epoch-fenced tokens');
+select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where id = (select agent_id from _sid_lifetime_children where label = 'parent')), true);
+select set_config('request.jwt.claim.identity_lease_epoch', '0', true);
+update agent_board.delegation_grants set grant_expires_at = now() + interval '1 hour' where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'parent');
+set local role service_role;
+select lives_ok($q$select agent_board.renew_session_identity((select agent_id from _sid_lifetime_children where label = 'parent'), 'approved')$q$,
+  'EC-SIDSCHEMA-4-renew-control: forwarded current-epoch holder renews an unchanged approved fingerprint');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'parent')), now() + interval '7 days',
+  'EC-SIDSCHEMA-4-renew-attested: renewal actually extends the same principal grant up to seven days');
+select is((select credential_epoch from agent_board.session_identities where agent_id = (select agent_id from _sid_lifetime_children where label = 'parent')), 0::bigint,
+  'EC-SIDSCHEMA-4-renew-stable: ordinary renewal preserves the identity and holder epoch');
+set local role service_role;
+select lives_ok($q$select agent_board.renew_delegated_grant((select agent_id from _sid_lifetime_children where label = 'parent'), interval '30 days')$q$,
+  'EC-SIDSCHEMA-4-renew-legacy-attested-control: the approved-session legacy entry point reaches its own TTL ceiling');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'parent')), now() + interval '7 days',
+  'EC-SIDSCHEMA-4-renew-legacy-attested: a longer legacy entry-point request cannot bypass the attested seven-day ceiling');
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_lifetime_refuse(%L)', $q$select agent_board.renew_session_identity((select agent_id from _sid_lifetime_children where label = 'parent'), 'changed')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-4-renew-fresh: mismatched risky attestation cannot extend a grant');
+reset role;
+update agent_board.session_identities set current_risky_digest = 'changed' where agent_id = (select agent_id from _sid_lifetime_children where label = 'parent');
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_lifetime_refuse(%L)', $q$select agent_board.renew_session_identity((select agent_id from _sid_lifetime_children where label = 'parent'), 'approved')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-4-renew-stored: quoting the old approved digest cannot hide a recorded risky change');
+select throws_ok(format('select pg_temp.sid_lifetime_refuse(%L)', $q$select agent_board.renew_delegated_grant((select agent_id from _sid_lifetime_children where label = 'parent'), interval '30 days')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-4-legacy-door: legacy renewal cannot bypass a session fingerprint gate');
+reset role;
+update agent_board.session_identities set current_risky_digest = 'approved' where agent_id = (select agent_id from _sid_lifetime_children where label = 'parent');
+update agent_board.delegation_policies set child_ttl_ceiling = interval '30 days', operator_child_ttl_ceiling = interval '2 hours' where root_agent_id = (select root_id from _sid_lifetime_root);
+set local role service_role;
+select lives_ok($q$select agent_board.renew_delegated_grant((select agent_id from _sid_lifetime_children where label = 'legacy'), interval '30 days')$q$,
+  'EC-SIDSCHEMA-4-legacy-renew-control: legacy service renewal remains usable');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'legacy')), now() + interval '2 hours',
+  'EC-SIDSCHEMA-4-legacy-operator: legacy renewal consumes the durable tighter operator ceiling');
+set local role service_role;
+select lives_ok($q$select agent_board.renew_session_identity((select agent_id from _sid_lifetime_children where label = 'parent'), 'approved')$q$,
+  'EC-SIDSCHEMA-4-renew-operator-control: approved renewal honors a newly tightened operator policy');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'parent')), now() + interval '2 hours',
+  'EC-SIDSCHEMA-4-renew-operator: attested renewal also consumes the tighter operator ceiling');
+select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where id = (select agent_id from _sid_lifetime_children where label = 'child')), true);
+update agent_board.delegation_policies set operator_child_ttl_ceiling = interval '30 days' where root_agent_id = (select root_id from _sid_lifetime_root);
+set local role service_role;
+select lives_ok($q$select agent_board.renew_session_identity((select agent_id from _sid_lifetime_children where label = 'child'), 'approved')$q$,
+  'EC-SIDSCHEMA-4-renew-ancestor-control: depth-two renewal enters the same bounded writer');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'child')), now() + interval '2 hours',
+  'EC-SIDSCHEMA-4-renew-ancestor: renewal cannot outlive its current parent grant');
+update agent_board.delegation_grants set grant_expires_at = now() - interval '1 second' where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'parent');
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_lifetime_refuse(%L)', $q$select agent_board.renew_session_identity((select agent_id from _sid_lifetime_children where label = 'child'), 'approved')$q$),
+  '42501', 'identity_parent_inactive', 'EC-SIDSCHEMA-4-renew-expired-ancestor: expired parent refuses depth-two renewal');
+select throws_ok(format('select pg_temp.sid_lifetime_refuse(%L)', $q$select pg_temp.sid_lifetime_token('child')$q$),
+  '42501', 'identity_parent_inactive', 'EC-SIDSCHEMA-2-token-ancestor-expiry: token issuer checks every ancestor grant');
+reset role;
+update agent_board.delegation_grants set grant_expires_at = now() + interval '2 hours', revoked_at = now() where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'parent');
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_lifetime_refuse(%L)', $q$select pg_temp.sid_lifetime_token('child')$q$),
+  '42501', 'identity_parent_inactive', 'EC-SIDSCHEMA-2-token-ancestor-revoke: revoked ancestor refuses token issuance');
+reset role;
+update agent_board.delegation_grants set revoked_at = null where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'parent');
+update agent_board.session_identities set resolution_state = 'frozen' where agent_id = (select root_id from _sid_lifetime_root);
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_lifetime_refuse(%L)', $q$select pg_temp.sid_lifetime_token('child')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-2-token-ancestor-freeze: frozen root refuses depth-two token issuance');
+reset role;
+update agent_board.session_identities set resolution_state = 'active' where agent_id = (select root_id from _sid_lifetime_root);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select root_auth::text from _sid_lifetime_root), true);
+set local role authenticated;
+select lives_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sid_lifetime_root), 'root_minted', '[]', 200, interval '24 hours', false)$q$,
+  'EC-SIDSCHEMA-6-policy-raised: self-service may choose the accepted 200-child root limit');
+reset role;
+select is((select max_active_children from agent_board.delegation_policies where root_agent_id = (select root_id from _sid_lifetime_root)), 200,
+  'EC-SIDSCHEMA-6-policy-raised-state: the old 25-child clamp is gone');
+select is((select max_depth from agent_board.delegation_policies where root_agent_id = (select root_id from _sid_lifetime_root)), 2,
+  'EC-SIDSCHEMA-6-policy-depth: policy supports the accepted depth two');
+set local role authenticated;
+select throws_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sid_lifetime_root), 'root_minted', '[]', 201)$q$,
+  '22023', null, 'EC-SIDSCHEMA-6-policy-upper: self-service cannot exceed 200');
+select throws_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sid_lifetime_root), 'root_minted', '[]', 200, interval '7 days')$q$,
+  '22023', null, 'EC-SIDSCHEMA-4-policy-legacy: unattributed self-service policy retains its 24-hour cap');
+reset role;
+select is((select operator_child_ttl_ceiling from agent_board.delegation_policies where root_agent_id = (select root_id from _sid_lifetime_root)), interval '30 days',
+  'EC-SIDSCHEMA-4-policy-durable: self-service preserves the operator ceiling');
+select is(has_function_privilege('authenticated', 'agent_board.renew_session_identity(uuid,text)', 'EXECUTE'), false,
+  'EC-SIDSCHEMA-4-renew-trust: caller-asserted fresh fingerprint is service-role-only until SIDSERVER binds it');
+select is((select count(*) from agent_board.session_identities where root_agent_id = (select root_id from _sid_lifetime_root)), 4::bigint,
+  'EC-SIDSCHEMA-4-stable-count: renewals and refusals create no new identities');
+update agent_board.delegation_grants set grant_expires_at = now() + interval '120 seconds' where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'parent');
+update agent_board.session_identities set last_heartbeat = now() - interval '181 seconds' where agent_id = (select agent_id from _sid_lifetime_children where label = 'child');
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_lifetime_token('child')$q$,
+  'EC-SIDSCHEMA-4-token-short-ancestor-control: a valid short-lived parent permits the real reclaim issuer');
+reset role;
+select is((select min(expires_at) from _sid_lifetime_tokens where label = 'child'), now() + interval '120 seconds',
+  'EC-SIDSCHEMA-4-token-short-ancestor: returned token cannot outlive current ancestor authority');
+select is((select min(expires_at) from agent_board.nonfleet_sessions where agent_id = (select agent_id from _sid_lifetime_children where label = 'child')), now() + interval '120 seconds',
+  'EC-SIDSCHEMA-4-token-short-stored: the stored credential has the same effective ceiling');
+update agent_board.delegation_grants set grant_expires_at = now() + interval '60 seconds' where child_agent_id = (select agent_id from _sid_lifetime_children where label = 'child');
+update agent_board.session_identities set last_heartbeat = now() - interval '181 seconds' where agent_id = (select agent_id from _sid_lifetime_children where label = 'child');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_lifetime_token('child')$q$,
+  'EC-SIDSCHEMA-4-token-short-own-control: the actual issuer permits a valid shorter child grant');
+reset role;
+select is((select min(expires_at) from _sid_lifetime_tokens where label = 'child'), now() + interval '60 seconds',
+  'EC-SIDSCHEMA-4-token-short-own: returned token also consumes its own remaining grant');
+select is((select min(expires_at) from agent_board.nonfleet_sessions where agent_id = (select agent_id from _sid_lifetime_children where label = 'child')), now() + interval '60 seconds',
+  'EC-SIDSCHEMA-4-token-short-own-stored: stored token consumes the shorter own grant too');
+
+-- Derive the direct grant-expiry writers from the catalog. The population pin
+-- names any new member until it has its own positive path and mutation receipt.
+-- The scanner recognizes literal SQL writes, not dynamic SQL/variable callees;
+-- literals/comments cannot masquerade as executable ceiling code.
+create temp view _sid_expiry_writers as
+select p.oid, p.proname, b.body
+from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+cross join lateral (select agent_board_test.stripped_body(p.oid) as body) b
+where n.nspname = 'agent_board'
+  and b.body ~ agent_board_test.col_write_re('delegation_grants', 'grant_expires_at');
+select is((select string_agg(proname, ', ' order by proname) from _sid_expiry_writers),
+  'mint_delegated_child, readmit_session_identity, renew_delegated_grant',
+  'EC-SIDSCHEMA-4-expiry-population: every catalog-derived expiry writer has a positive path and independent ceiling mutation');
+create temp view _sid_unsafe_expiry as
+select * from _sid_expiry_writers
+where body !~ agent_board_test.re(agent_board_test.col_frag('v_ceiling') || '\s*:=\s*' || agent_board_test.ci_re('least') || '\(\s*v_policy.child_ttl_ceiling\s*,\s*v_policy.operator_child_ttl_ceiling')
+   or body !~ agent_board_test.re(agent_board_test.ci_re('least') || '\(\s*' || agent_board_test.ci_re('now') || '\(\)\s*\+\s*' || agent_board_test.ci_re('least') || '\(')
+   or body !~ agent_board_test.re(agent_board_test.col_frag('v_ancestor_expires'));
+create temp view _sid_unsafe_expiry_class as
+select distinct c.root_oid, c.root_name
+from agent_board_test.fn_call_closure() c join _sid_unsafe_expiry u on u.oid = c.reached_oid;
+select is((select coalesce(string_agg(root_name, ', ' order by root_name), '') from _sid_unsafe_expiry_class), '',
+  'EC-SIDSCHEMA-4-expiry-class: every discovered expiry writer and caller reaches an executable current-policy operator and ancestor ceiling');
+select is((select count(*) from _sid_expiry_writers), 3::bigint,
+  'EC-SIDSCHEMA-4-expiry-nonempty: the expiry class is not vacuous');
+create function agent_board.sid_expiry_unsafe_probe(p_child uuid)
+returns void language sql security definer set search_path = '' as $probe$
+  /* v_ceiling := least(v_policy.child_ttl_ceiling, v_policy.operator_child_ttl_ceiling);
+     least(now() + least(extend, ceiling), v_ancestor_expires) */
+  UPDATE agent_board.delegation_grants SET grant_expires_at = now() + interval '100 days' WHERE child_agent_id = p_child;
+$probe$;
+create function agent_board.sid_expiry_wrapper_probe(p_child uuid)
+returns void language sql security definer set search_path = '' as $probe$
+  SELECT agent_board.sid_expiry_unsafe_probe(/* wrapper/case/comment canary */ p_child);
+$probe$;
+select is((select string_agg(root_name, ', ' order by root_name) from _sid_unsafe_expiry_class where root_name in ('sid_expiry_unsafe_probe', 'sid_expiry_wrapper_probe')),
+  'sid_expiry_unsafe_probe, sid_expiry_wrapper_probe',
+  'EC-SIDSCHEMA-4-expiry-canary: unsafe uppercase writer and commented wrapper name themselves in the derived class');
+select is((select proname from _sid_unsafe_expiry where proname = 'sid_expiry_unsafe_probe'), 'sid_expiry_unsafe_probe',
+  'EC-SIDSCHEMA-4-expiry-decoy: a ceiling in a comment never exempts an unsafe production body');
+select finish();
+rollback;