@consiliency/agent-board-schema 1.60.0 → 1.64.0

package/tests/agent_board_session_identity_protected_actions.test.sql

@@ -0,0 +1,156 @@
+-- Real service-form mint/claim and resolver-form holder/owner calls. Frozen
+-- fixtures retain matching digests, isolating the freeze gate from mismatch.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(30);
+create temp table _sid_action_root(root_id uuid, owner_auth uuid, suffix text);
+create temp table _sid_action_children(label text primary key, agent_id uuid, key_id uuid, auth_id uuid);
+create temp table _sid_action_tokens(label text, epoch bigint, secret text);
+do $$
+declare v_root uuid := gen_random_uuid(); v_owner uuid; v_auth uuid;
+begin
+  v_owner := public.ensure_github_user('sid-action-owner-' || v_root, 'sid-action-owner-' || v_root || '@example.test', 'sid-action-owner-' || v_root, 'Action owner');
+  v_auth := public.ensure_github_user('sid-action-root-' || v_root, 'sid-action-root-' || v_root || '@example.test', 'sid-action-root-' || v_root, 'Action root');
+  insert into agent_board.agents(agent_type, handle, display_name, status, auth_user_id)
+  values ('human', 'sid-action-owner-' || v_root, 'Action owner', 'active', v_owner);
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_root, 'agent', 'sid-action-root-' || v_root, 'Action root', 'active', v_auth, v_owner);
+  insert into agent_board.session_identities(agent_id, root_agent_id, depth, approved_risky_digest, current_risky_digest)
+  values (v_root, v_root, 0, 'approved', 'approved');
+  insert into _sid_action_root values (v_root, v_owner, substr(v_root::text, 1, 8));
+end;
+$$;
+grant select on _sid_action_root, _sid_action_children to authenticated, service_role;
+grant insert on _sid_action_children to service_role;
+grant select, insert on _sid_action_tokens to service_role;
+create function pg_temp.sid_action_mint(p_label text, p_parent text default null, p_alias text default null, p_fork text default null)
+returns void language plpgsql as $$
+declare v_root record; v_parent uuid; v_result record;
+begin
+  select * into v_root from _sid_action_root;
+  v_parent := coalesce((select agent_id from _sid_action_children where label = p_parent), v_root.root_id);
+  select * into v_result from agent_board.mint_delegated_child(v_parent, 'sid-action-' || p_label || '-' || v_root.suffix,
+    '["read"]', public.test_pubkey(v_root.suffix || p_label), interval '8 hours', false, 'claude', coalesce(p_alias, 'action-' || p_label),
+    case when p_parent is null then null else '0' end, '[]',
+    '{"resolution":"resolved","risky_digest":"approved"}',
+    (select agent_id from _sid_action_children where label = p_fork));
+  insert into _sid_action_children select p_label, v_result.child_agent_id, v_result.signing_key_id, a.auth_user_id
+    from agent_board.agents a where a.id = v_result.child_agent_id;
+end;
+$$;
+create function pg_temp.sid_action_token(p_result text, p_first boolean default false)
+returns void language plpgsql as $$
+declare v_child record; v_challenge record;
+begin
+  select * into v_child from _sid_action_children where label = 'parent';
+  select * into v_challenge from agent_board.issue_signing_key_challenge(v_child.agent_id, 'delegated-ephemeral');
+  insert into _sid_action_tokens select p_result, m.identity_lease_epoch, m.holder_secret
+    from agent_board.mint_fleet_agent_session(v_challenge.challenge_id, split_part(v_challenge.challenge, ':', 3),
+      v_child.key_id, v_child.agent_id, 900,
+      case when p_first then null else (select secret from _sid_action_tokens where label = 'first') end,
+      'action-parent') m;
+end;
+$$;
+create function pg_temp.sid_action_refuse(p_call text)
+returns void language plpgsql as $$
+begin
+  execute p_call;
+  raise exception 'expected refusal but RPC succeeded' using errcode = 'P0001';
+end;
+$$;
+grant execute on function pg_temp.sid_action_mint(text,text,text,text), pg_temp.sid_action_token(text,boolean) to service_role;
+grant execute on function pg_temp.sid_action_refuse(text) to authenticated, service_role;
+select set_config('request.jwt.claims', '{}', true);
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sid_action_root), 'root_minted', '["read"]', 200, interval '7 days', true)$q$,
+  'EC-SIDSCHEMA-5-action-policy: trusted root configures policy');
+reset role;
+select is((select count(*) from agent_board.delegation_policies where root_agent_id = (select root_id from _sid_action_root)), 1::bigint,
+  'EC-SIDSCHEMA-5-action-policy-state: one policy exists');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_action_mint('parent'); select pg_temp.sid_action_token('first', true)$q$,
+  'EC-SIDSCHEMA-5-action-fixture: real approved mint and key challenge create the current holder');
+reset role;
+select ok((select epoch = 0 and secret is not null from _sid_action_tokens where label = 'first'),
+  'EC-SIDSCHEMA-5-action-fixture-state: first claim returned its epoch and holder secret');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_action_token('holder')$q$, 'EC-SIDSCHEMA-5-token-control: unfrozen holder can mint a token');
+reset role;
+select is((select count(*) from _sid_action_tokens where label = 'holder'), 1::bigint, 'EC-SIDSCHEMA-5-token-control-state: one token result was returned');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_action_mint('child', 'parent')$q$, 'EC-SIDSCHEMA-5-child-control: unfrozen depth-one parent mints a child');
+reset role;
+select is((select depth from agent_board.session_identities where agent_id = (select agent_id from _sid_action_children where label = 'child')), 2::smallint,
+  'EC-SIDSCHEMA-5-child-control-state: real child is depth two');
+select set_config('request.jwt.claim.sub', (select auth_id::text from _sid_action_children where label = 'parent'), true);
+select set_config('request.jwt.claim.identity_lease_epoch', '0', true);
+set local role service_role;
+select lives_ok($q$select agent_board.link_session_alias((select agent_id from _sid_action_children where label = 'parent'), '0', 'action-linked')$q$,
+  'EC-SIDSCHEMA-5-link-control: verified unfrozen holder links an alias');
+reset role;
+select is((select count(*) from agent_board.session_id_aliases where identity_agent_id = (select agent_id from _sid_action_children where label = 'parent')), 2::bigint,
+  'EC-SIDSCHEMA-5-link-control-state: exactly one alias was added');
+set local role service_role;
+select lives_ok($q$select agent_board.renew_session_identity((select agent_id from _sid_action_children where label = 'parent'), 'approved')$q$,
+  'EC-SIDSCHEMA-5-renew-control: verified unfrozen holder renews');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_action_children where label = 'parent')), now() + interval '7 days',
+  'EC-SIDSCHEMA-5-renew-control-state: same grant reaches the approved effective ceiling');
+update agent_board.session_identities set last_heartbeat = now() - interval '60 seconds'
+where agent_id = (select agent_id from _sid_action_children where label = 'parent');
+select set_config('request.jwt.claim.role', 'authenticated', true);
+set local role authenticated;
+select lives_ok($q$select agent_board.heartbeat_session_identity((select agent_id from _sid_action_children where label = 'parent'))$q$,
+  'EC-SIDSCHEMA-5-heartbeat-control: unfrozen current epoch refreshes the live lease');
+reset role;
+select is((select last_heartbeat from agent_board.session_identities where agent_id = (select agent_id from _sid_action_children where label = 'parent')), now(),
+  'EC-SIDSCHEMA-5-heartbeat-control-state: heartbeat changed');
+update agent_board.session_identities set resolution_state = 'frozen', last_heartbeat = now() - interval '60 seconds'
+where agent_id = (select agent_id from _sid_action_children where label = 'parent');
+select ok((select resolution_state = 'frozen' and approved_risky_digest = current_risky_digest
+  from agent_board.session_identities where agent_id = (select agent_id from _sid_action_children where label = 'parent')),
+  'EC-SIDSCHEMA-5-frozen-fixture: explicit freeze is isolated from digest mismatch');
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_action_refuse(%L)', $q$select pg_temp.sid_action_token('frozen')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-frozen-token: frozen holder cannot mint a token');
+select throws_ok(format('select pg_temp.sid_action_refuse(%L)', $q$select pg_temp.sid_action_mint('frozen-child', 'parent')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-frozen-child: frozen parent cannot mint a child');
+select throws_ok(format('select pg_temp.sid_action_refuse(%L)', $q$select agent_board.link_session_alias((select agent_id from _sid_action_children where label = 'parent'), '0', 'action-frozen')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-frozen-link: frozen holder cannot link');
+select throws_ok(format('select pg_temp.sid_action_refuse(%L)', $q$select agent_board.renew_session_identity((select agent_id from _sid_action_children where label = 'parent'), 'approved')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-frozen-renew: frozen holder cannot renew');
+reset role;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_action_refuse(%L)', $q$select agent_board.heartbeat_session_identity((select agent_id from _sid_action_children where label = 'parent'))$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-frozen-heartbeat: frozen holder cannot heartbeat');
+reset role;
+select is((select count(*) from _sid_action_tokens), 2::bigint, 'EC-SIDSCHEMA-5-frozen-token-state: refusals returned no further token result');
+select is((select count(*) from _sid_action_children), 2::bigint, 'EC-SIDSCHEMA-5-frozen-child-state: refusal left no child');
+select is((select count(*) from agent_board.session_id_aliases where identity_agent_id = (select agent_id from _sid_action_children where label = 'parent')), 2::bigint,
+  'EC-SIDSCHEMA-5-frozen-link-state: refusal left aliases unchanged');
+select is((select last_heartbeat from agent_board.session_identities where agent_id = (select agent_id from _sid_action_children where label = 'parent')), now() - interval '60 seconds',
+  'EC-SIDSCHEMA-5-frozen-lease-state: neither renewal nor heartbeat refreshed the lease');
+select set_config('request.jwt.claim.sub', (select owner_auth::text from _sid_action_root), true);
+set local role authenticated;
+select lives_ok($q$select agent_board.revoke_session_identity((select agent_id from _sid_action_children where label = 'parent'))$q$,
+  'EC-SIDSCHEMA-5-tombstone-control: human owner revokes the selected frozen identity');
+reset role;
+select is((select count(*) from agent_board.session_identities where agent_id in (select agent_id from _sid_action_children) and tombstoned_at is not null), 2::bigint,
+  'EC-SIDSCHEMA-5-tombstone-control-state: parent and descendant are tombstoned');
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_action_refuse(%L)', $q$select pg_temp.sid_action_mint('remint', null, 'action-parent')$q$),
+  '42501', 'identity_tombstoned', 'EC-SIDSCHEMA-5-tombstone-remint: tombstoned alias cannot re-mint a principal');
+select throws_ok(format('select pg_temp.sid_action_refuse(%L)', $q$select pg_temp.sid_action_mint('fork', null, null, 'parent')$q$),
+  '42501', 'identity_tombstoned', 'EC-SIDSCHEMA-5-tombstone-fork: tombstoned identity cannot supply fork ancestry');
+reset role;
+select is((select count(*) from _sid_action_children), 2::bigint, 'EC-SIDSCHEMA-5-tombstone-refusal-state: neither refusal created a new identity');
+select is((select credential_epoch from agent_board.session_identities where agent_id = (select agent_id from _sid_action_children where label = 'parent')), 1::bigint,
+  'EC-SIDSCHEMA-5-tombstone-epoch: revocation fenced the old holder');
+select finish();
+rollback;

package/tests/agent_board_session_identity_revoke_closure.test.sql

@@ -0,0 +1,131 @@
+-- Fork siblings are outside the legacy grant subtree. Each legacy entrypoint
+-- must still close their identities, aliases and every principal credential.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(74);
+grant usage on schema extensions to service_role, authenticated;
+create temp table _sid_revoke_roots(route text primary key, root_id uuid, owner_auth uuid);
+create temp table _sid_revoke_children(route text, label text, agent_id uuid, key_id uuid, primary key(route,label));
+create function pg_temp.sid_revoke_fixture(p_route text)
+returns void language plpgsql security definer set search_path = pg_temp, pg_catalog as $$
+declare r uuid := gen_random_uuid(); u uuid; m record; item record; parent uuid; fork uuid;
+begin
+  u := public.ensure_github_user('sid-revoke-' || r, 'sid-revoke-' || r || '@example.test', 'sid-revoke-' || r, 'Revoke owner');
+  if p_route='hosted-instance' then
+    u := agent_board._ensure_agent_auth_user(agent_board._federated_identity_slug('https://sid-revoke.example.test',r::text));
+  end if;
+  insert into agent_board.agents(agent_type, handle, display_name, status, auth_user_id)
+  values ('human', 'sid-revoke-human-' || r, 'Revoke owner', 'active', u);
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id,is_delegate)
+  values (r, 'agent', 'sid-revoke-root-' || r, 'Revoke root', 'active', u,p_route='hosted-instance');
+  insert into agent_board.session_identities(agent_id, root_agent_id, depth, current_risky_digest, approved_risky_digest)
+  values (r, r, 0, 'approved', 'approved');
+  insert into _sid_revoke_roots values (p_route,r,u);
+  perform agent_board.upsert_delegation_policy(r, 'root_minted', '["read"]', 200, interval '7 days', true);
+  for item in select * from (values ('source',null::text,null::text), ('fork',null,'source'),
+    ('transitive-fork',null,'fork'), ('descendant','fork',null)) v(label,parent_label,fork_label)
+  loop
+    parent := coalesce((select agent_id from _sid_revoke_children where route=p_route and label=item.parent_label),r);
+    fork := (select agent_id from _sid_revoke_children where route=p_route and label=item.fork_label);
+    select * into m from agent_board.mint_delegated_child(parent,
+      'sid-revoke-' || item.label || '-' || substr(r::text,1,8), '["read"]',
+      public.test_pubkey(r::text || item.label), interval '1 hour', false, 'claude',
+      p_route || '-' || item.label, case when parent=r then null else '0' end, '[]',
+      '{"resolution":"resolved","risky_digest":"approved"}',fork);
+    insert into _sid_revoke_children values (p_route,item.label,m.child_agent_id,m.signing_key_id);
+    perform * from agent_board._issue_agent_credential(m.child_agent_id,'closure-fixture');
+  end loop;
+  if p_route='hosted-instance' then
+    insert into agent_board.delegate_instances(instance_id,owner_user_id,owner_issuer,owner_subject,agent_id)
+    values(r::text,u,'https://sid-revoke.example.test',r::text,r);
+    insert into agent_board.boards(id,slug,name,created_by_agent_id,visibility,status)
+    values(r,'sid-revoke-board-' || r,'Revoke board',r,'private','active');
+    insert into agent_board.board_memberships(board_id,agent_id,role,membership_state,created_by_agent_id)
+    values(r,r,'member','joined',r);
+  end if;
+end $$;
+create function pg_temp.sid_revoke_call(p_route text)
+returns void language plpgsql as $$
+declare r record; target uuid;
+begin
+  select * into r from _sid_revoke_roots where route=p_route;
+  select agent_id into target from _sid_revoke_children where route=p_route and label='source';
+  perform set_config('request.jwt.claim.sub',r.owner_auth::text,true);
+  case p_route
+    when 'principal' then perform agent_board._revoke_agent_principal(target,r.root_id,'closure fixture');
+    when 'agent-subtree' then perform * from agent_board.revoke_agent_subtree(target,r.root_id,'closure fixture');
+    when 'human-subtree' then perform * from agent_board.revoke_human_subtree(r.owner_auth,r.root_id,'closure fixture');
+    when 'fleet-agent' then perform * from agent_board.revoke_fleet_subject('agent',target,r.root_id,'closure fixture');
+    when 'admin-agent' then perform * from agent_board.revoke_agent(target,'closure fixture');
+    when 'hosted-instance' then perform * from agent_board.tombstone_delegate_instance(r.root_id::text,
+      'https://sid-revoke.example.test',r.root_id::text,'owner_revoked');
+    when 'session-owner' then
+      perform set_config('request.jwt.claim.sub',r.owner_auth::text,true);
+      perform agent_board.revoke_session_identity(target);
+  end case;
+end $$;
+grant execute on function pg_temp.sid_revoke_fixture(text), pg_temp.sid_revoke_call(text) to service_role;
+grant execute on function pg_temp.sid_revoke_call(text) to authenticated;
+grant select,insert on _sid_revoke_roots,_sid_revoke_children to service_role;
+grant select on _sid_revoke_roots,_sid_revoke_children to authenticated;
+select set_config('request.jwt.claim.role','service_role',true);
+set local role service_role;
+select lives_ok(format('select pg_temp.sid_revoke_fixture(%L)',route),
+  'EC-SIDSCHEMA-5-closure-fixture-' || route || ': real minted fork, fork-of-fork, descendant and legacy credentials')
+from unnest(array['principal','agent-subtree','human-subtree','fleet-agent','admin-agent','session-owner','hosted-instance']) route;
+reset role;
+select is((select count(*) from _sid_revoke_children where route=r.route),4::bigint,
+  'EC-SIDSCHEMA-5-closure-fixture-state-' || route || ': four real children exist') from _sid_revoke_roots r order by route;
+set local role service_role;
+select lives_ok(format('select pg_temp.sid_revoke_call(%L)',route),
+  'EC-SIDSCHEMA-5-closure-call-' || route || ': authorized entrypoint executes') from _sid_revoke_roots where route <> 'session-owner' order by route;
+reset role;
+select set_config('request.jwt.claim.role','authenticated',true);
+select set_config('request.jwt.claim.sub',(select owner_auth::text from _sid_revoke_roots where route='session-owner'),true);
+set local role authenticated;
+select lives_ok($$select pg_temp.sid_revoke_call('session-owner')$$,
+  'EC-SIDSCHEMA-5-closure-call-session-owner: authenticated human owner executes the session entrypoint');
+reset role;
+select is((select count(*) from _sid_revoke_children c join agent_board.session_identities si on si.agent_id=c.agent_id
+  where c.route=r.route and si.tombstoned_at is not null),4::bigint,
+  'EC-SIDSCHEMA-5-closure-tombstones-' || route || ': source, transitive forks and descendant are tombstoned') from _sid_revoke_roots r order by route;
+select is((select count(*) from _sid_revoke_children c join agent_board.session_identities si on si.agent_id=c.agent_id
+  where c.route=r.route and si.credential_epoch=1),4::bigint,
+  'EC-SIDSCHEMA-5-closure-epochs-' || route || ': each identity epoch is fenced exactly once') from _sid_revoke_roots r order by route;
+select is((select count(*) from _sid_revoke_children c join agent_board.agents a on a.id=c.agent_id
+  join agent_board.agent_signing_keys k on k.id=c.key_id join agent_board.delegation_grants g on g.child_agent_id=c.agent_id
+  where c.route=r.route and a.status='revoked' and k.status='revoked' and k.proof_state='revoked' and g.revoked_at is not null),4::bigint,
+  'EC-SIDSCHEMA-5-closure-principals-' || route || ': status, keys and grants write through') from _sid_revoke_roots r order by route;
+select is((select count(*) from _sid_revoke_children c join agent_board.agent_credentials ac on ac.agent_id=c.agent_id
+  where c.route=r.route and ac.revoked_at is not null),4::bigint,
+  'EC-SIDSCHEMA-5-closure-credentials-' || route || ': legacy credential issuer state writes through') from _sid_revoke_roots r order by route;
+select is((select count(*) from _sid_revoke_children c join agent_board.session_id_aliases a on a.identity_agent_id=c.agent_id
+  join agent_board.session_identities si on si.agent_id=a.identity_agent_id
+  where c.route=r.route and si.tombstoned_at is not null),4::bigint,
+  'EC-SIDSCHEMA-5-closure-aliases-' || route || ': all reserved alias targets are tombstoned') from _sid_revoke_roots r order by route;
+select is((select count(*) from _sid_revoke_children c join agent_board.session_identities si on si.agent_id=c.agent_id
+  where c.route=r.route and c.label in ('fork','transitive-fork') and si.tombstoned_at is not null),2::bigint,
+  'EC-SIDSCHEMA-5-closure-forks-' || route || ': both fork generations are independently tombstoned') from _sid_revoke_roots r order by route;
+select is((select count(*) from _sid_revoke_children c join agent_board.session_identities si on si.agent_id=c.agent_id
+  where c.route=r.route and c.label='descendant' and si.tombstoned_at is not null),1::bigint,
+  'EC-SIDSCHEMA-5-closure-descendants-' || route || ': descendant tombstone is checked independently of forks') from _sid_revoke_roots r order by route;
+select set_config('request.jwt.claim.role','service_role',true);
+set local role service_role;
+select throws_ok($$select agent_board.mint_delegated_child((select root_id from _sid_revoke_roots where route='principal'),
+  'sid-revoked-alias-' || gen_random_uuid(),'["read"]',public.test_pubkey('revoked-alias'),interval '1 hour',false,
+  'claude','principal-source',null,'[]','{"resolution":"resolved","risky_digest":"approved"}')$$,
+  '42501','identity_tombstoned','EC-SIDSCHEMA-5-closure-alias-refusal: a legacy principal revoke reserves its tombstoned session alias against re-mint');
+reset role;
+select is((select count(*) from agent_board.session_identities where root_agent_id=(select root_id from _sid_revoke_roots where route='principal')),5::bigint,
+  'EC-SIDSCHEMA-5-closure-alias-refusal-state: alias refusal leaves only the root and four original identities');
+select is((select membership_state || '/' || role from agent_board.board_memberships
+  where board_id=(select root_id from _sid_revoke_roots where route='hosted-instance')
+    and agent_id=(select root_id from _sid_revoke_roots where route='hosted-instance')),
+  'left/member','EC-SIDSCHEMA-5-instance-withdrawal-state: the real verified-instance tombstone withdraws its membership without elevating its role');
+select is((select count(*) from agent_board.board_membership_events
+  where board_id=(select root_id from _sid_revoke_roots where route='hosted-instance')
+    and event_kind='operator_removal'),1::bigint,
+  'EC-SIDSCHEMA-5-instance-withdrawal-event: withdrawal writes exactly one append-only operator removal for this board');
+select finish();
+rollback;

package/tests/agent_board_sidowner_leases.test.sql

@@ -0,0 +1,107 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(18);
+
+create temp table _owner_lease_fixture(label text primary key, agent_id uuid, auth_id uuid);
+do $$
+declare v_label text; v_id uuid; v_auth uuid; v_root uuid; v_root_auth uuid; v_a uuid; v_b uuid; v_live uuid;
+begin
+  foreach v_label in array array['root','branch-a','branch-b','unclaimed','live','lapsed','boundary','cross-parent-fork'] loop
+    v_id := gen_random_uuid();
+    v_auth := public.ensure_github_user('owner-lease-' || v_id, v_id || '@example.test', v_id::text, v_label);
+    if v_label='root' then v_root := v_id; v_root_auth := v_auth; end if;
+    if v_label='branch-a' then v_a := v_id; end if;
+    if v_label='branch-b' then v_b := v_id; end if;
+    if v_label='live' then v_live := v_id; end if;
+    insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id, parent_agent_id, root_agent_id)
+    values(v_id,'agent','owner-lease-' || v_id,v_label,'active',v_auth,v_root_auth,
+      case when v_label='root' then null when v_label in ('branch-a','branch-b') then v_root
+        when v_label in ('boundary','cross-parent-fork') then v_b else v_a end,
+      case when v_label='root' then null else v_root end);
+    insert into agent_board.session_identities(agent_id,parent_agent_id,root_agent_id,depth,identity_kind,harness,
+      holder_secret_hash,last_heartbeat,credential_epoch,current_risky_digest,approved_risky_digest,recorded_fingerprint,forked_from)
+    values(v_id,case when v_label='root' then null when v_label in ('branch-a','branch-b') then v_root
+        when v_label in ('boundary','cross-parent-fork') then v_b else v_a end,v_root,
+      case when v_label='root' then 0 when v_label in ('branch-a','branch-b') then 1 else 2 end,
+      case when v_label in ('root','branch-a','branch-b') then 'legacy' else 'session' end,
+      case when v_label in ('root','branch-a','branch-b') then null else 'codex' end,
+      case when v_label in ('live','lapsed','boundary') then digest(v_label,'sha256') else null end,
+      case when v_label='live' then now()-interval '179 seconds'
+        when v_label='lapsed' then now()-interval '181 seconds'
+        when v_label='boundary' then now()-interval '180 seconds' else null end,
+      7,repeat('a',64),repeat('b',64),jsonb_build_object('resolution','resolved','recorded',jsonb_build_object('risky_inputs','{}'::jsonb)),
+      case when v_label='cross-parent-fork' then v_live else null end);
+    insert into _owner_lease_fixture values(v_label,v_id,v_auth);
+  end loop;
+end;
+$$;
+set constraints all immediate;
+set constraints all deferred;
+grant select on _owner_lease_fixture to authenticated;
+create temp table _owner_lease_before as
+select jsonb_agg(to_jsonb(si) order by si.agent_id) as rows from agent_board.session_identities si
+join _owner_lease_fixture f on f.agent_id=si.agent_id;
+grant select on _owner_lease_before to authenticated;
+select set_config('request.jwt.claims','{}',true);
+select set_config('request.jwt.claim.sub',(select auth_id::text from _owner_lease_fixture where label='root'),true);
+select set_config('request.jwt.claim.role','authenticated',true);
+select set_config('request.jwt.claim.agent_credential_id','',true);
+select set_config('request.jwt.claim.identity_lease_epoch','',true);
+set local role authenticated;
+create temp table _owner_lease_states as select * from agent_board.list_session_children((select agent_id from _owner_lease_fixture where label='root')) with no data;
+select lives_ok($$insert into _owner_lease_states select * from agent_board.list_session_children((select agent_id from _owner_lease_fixture where label='root'))$$,
+  'SIDOWNER-lease-control: root enters reader with all lease states');
+select is((select lease_state from _owner_lease_states where agent_id=(select agent_id from _owner_lease_fixture where label='live')),
+  'live','SIDOWNER-lease-live: 179-second heartbeat is live');
+select is((select lease_state from _owner_lease_states where agent_id=(select agent_id from _owner_lease_fixture where label='lapsed')),
+  'lapsed','SIDOWNER-lease-lapsed: 181-second heartbeat is lapsed');
+select is((select lease_state from _owner_lease_states where agent_id=(select agent_id from _owner_lease_fixture where label='boundary')),
+  'lapsed','SIDOWNER-lease-boundary: exactly 180 seconds is lapsed');
+select is((select lease_state from _owner_lease_states where agent_id=(select agent_id from _owner_lease_fixture where label='unclaimed')),
+  'unclaimed','SIDOWNER-lease-unclaimed: reserved identity has no claimed holder');
+select is((select lease_state from _owner_lease_states where agent_id=(select agent_id from _owner_lease_fixture where label='branch-a')),
+  'not_applicable','SIDOWNER-lease-legacy: legacy child has no session lease');
+select is((select harness from _owner_lease_states where agent_id=(select agent_id from _owner_lease_fixture where label='live')),
+  'codex','SIDOWNER-harness: normalized projection preserves session harness');
+create temp table _owner_lease_branch as select * from agent_board.list_session_children((select agent_id from _owner_lease_fixture where label='branch-a')) with no data;
+select lives_ok($$insert into _owner_lease_branch select * from agent_board.list_session_children((select agent_id from _owner_lease_fixture where label='branch-a'))$$,
+  'SIDOWNER-fork-control: ancestor enters branch reader');
+select is((select count(*) from _owner_lease_branch),3::bigint,
+  'SIDOWNER-branch-subtree: selected branch contains every strict child');
+select is((select count(*) from _owner_lease_branch where agent_id=(select agent_id from _owner_lease_fixture where label='cross-parent-fork')),0::bigint,
+  'SIDOWNER-fork-edge: fork provenance never traverses another parent');
+select is((select current_risky_digest from _owner_lease_states where agent_id=(select agent_id from _owner_lease_fixture where label='live')),
+  repeat('a',64),'SIDOWNER-current-digest: current digest is not replaced by approval');
+select is((select approved_risky_digest from _owner_lease_states where agent_id=(select agent_id from _owner_lease_fixture where label='live')),
+  repeat('b',64),'SIDOWNER-approved-digest: distinct stored approval is preserved');
+select is((select recorded_fingerprint from _owner_lease_states where agent_id=(select agent_id from _owner_lease_fixture where label='live')),
+  jsonb_build_object('resolution','resolved','recorded',jsonb_build_object('risky_inputs','{}'::jsonb)),
+  'SIDOWNER-reading-projection: state returns only the stored normalized reading');
+reset role;
+select is((select jsonb_agg(to_jsonb(si) order by si.agent_id) from agent_board.session_identities si
+  join _owner_lease_fixture f on f.agent_id=si.agent_id),(select rows from _owner_lease_before),
+  'SIDOWNER-full-row-read-only: readers leave every stored identity field byte-equivalent');
+select set_config('request.jwt.claim.sub',(select auth_id::text from _owner_lease_fixture where label='live'),true);
+select set_config('request.jwt.claim.identity_lease_epoch','7',true);
+set local role authenticated;
+select lives_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_lease_fixture where label='live'))$$,
+  'SIDOWNER-session-self-control: current-epoch session reads its own state');
+select set_config('request.jwt.claim.identity_lease_epoch','6',true);
+select throws_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_lease_fixture where label='live'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-stale-epoch: stale session credential cannot read its own state');
+reset role;
+select set_config('request.jwt.claim.sub',(select auth_id::text from _owner_lease_fixture where label='root'),true);
+select set_config('request.jwt.claim.identity_lease_epoch','',true);
+update agent_board.session_identities set tombstoned_at=now(),tombstone_reason='revoked'
+where agent_id=(select agent_id from _owner_lease_fixture where label='live');
+set local role authenticated;
+create temp table _owner_lease_tombstone as select * from agent_board.get_session_identity_state((select agent_id from _owner_lease_fixture where label='live')) with no data;
+select lives_ok($$insert into _owner_lease_tombstone select * from agent_board.get_session_identity_state((select agent_id from _owner_lease_fixture where label='live'))$$,
+  'SIDOWNER-tombstone-lease-control: ancestor reads claimed tombstone');
+select is((select lease_state from _owner_lease_tombstone),'lapsed',
+  'SIDOWNER-tombstone-lease: tombstoned claimed identity follows the existing not-live helper');
+reset role;
+select * from finish();
+rollback;

package/tests/agent_board_sidowner_owner_required.test.sql

@@ -0,0 +1,97 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to service_role;
+select plan(15);
+create temp table _sidowner_n1(label text primary key, agent_id uuid, auth_id uuid, before_state jsonb);
+do $$
+declare v_label text; v_id uuid; v_auth uuid; v_human uuid; v_inactive uuid; v_gotrue uuid;
+begin
+  v_id := gen_random_uuid();
+  v_human := public.ensure_github_user('n1-human-' || v_id, v_id || '@example.test', v_id::text, 'N1 human');
+  insert into agent_board.agents(agent_type,handle,display_name,status,auth_user_id)
+    values ('human','n1-human-' || v_id,'N1 human','active',v_human);
+  v_id := gen_random_uuid();
+  v_inactive := public.ensure_github_user('n1-inactive-' || v_id, v_id || '@example.test', v_id::text, 'N1 inactive human');
+  insert into agent_board.agents(agent_type,handle,display_name,status,auth_user_id)
+    values ('human','n1-inactive-' || v_id,'N1 inactive human','suspended',v_inactive);
+  v_gotrue := gen_random_uuid();
+  insert into auth.users(id,email) values (v_gotrue,v_gotrue || '@example.test');
+  foreach v_label in array array['human-owned','self-owned','gotrue-owned','inactive-human'] loop
+    v_id := gen_random_uuid();
+    v_auth := public.ensure_github_user('n1-root-' || v_id, v_id || '@example.test', v_id::text, 'N1 root');
+    insert into agent_board.agents(id,agent_type,handle,display_name,status,auth_user_id,owner_user_id)
+      values(v_id,'agent','n1-root-' || v_id,'N1 root','active',v_auth,
+        case v_label when 'human-owned' then v_human when 'self-owned' then v_auth
+          when 'gotrue-owned' then v_gotrue else v_inactive end);
+    insert into _sidowner_n1 values(v_label,v_id,v_auth,null);
+  end loop;
+end;
+$$;
+set constraints all immediate;
+update _sidowner_n1 f set before_state = (select to_jsonb(si) from agent_board.session_identities si where si.agent_id=f.agent_id);
+grant select on _sidowner_n1 to service_role;
+create function pg_temp.sidowner_n1_subject(p_label text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims','{}',true);
+  perform set_config('request.jwt.claim.role','service_role',true);
+  perform set_config('request.jwt.claim.sub',(select auth_id::text from _sidowner_n1 where label=p_label),true);
+end;
+$$;
+grant execute on function pg_temp.sidowner_n1_subject(text) to service_role;
+
+select has_function('agent_board','_session_identity_has_human_owner',array['uuid'],'SIDOWNER-N1-owner-existence: SQL owner-existence guard exists');
+select ok(has_function_privilege('service_role','agent_board._session_identity_has_human_owner(uuid)','EXECUTE')
+  and not has_function_privilege('public','agent_board._session_identity_has_human_owner(uuid)','EXECUTE')
+  and not has_function_privilege('anon','agent_board._session_identity_has_human_owner(uuid)','EXECUTE')
+  and not has_function_privilege('authenticated','agent_board._session_identity_has_human_owner(uuid)','EXECUTE')
+  and obj_description('agent_board._session_identity_has_human_owner(uuid)'::regprocedure,'pg_proc') is not null,
+  'SIDOWNER-N1-private-guard: SQL helper is service-only and documented');
+select ok(has_function_privilege('service_role','agent_board.record_session_identity_state(uuid,jsonb)','EXECUTE')
+  and not has_function_privilege('public','agent_board.record_session_identity_state(uuid,jsonb)','EXECUTE')
+  and not has_function_privilege('anon','agent_board.record_session_identity_state(uuid,jsonb)','EXECUTE')
+  and not has_function_privilege('authenticated','agent_board.record_session_identity_state(uuid,jsonb)','EXECUTE'),
+  'SIDOWNER-N1-private-recording: recorder remains service-only');
+select is(agent_board._session_identity_has_human_owner((select agent_id from _sidowner_n1 where label='human-owned')),true,
+  'SIDOWNER-N1-human-existence: active human bound to the root owner exists');
+select is(agent_board._session_identity_has_human_owner((select agent_id from _sidowner_n1 where label='self-owned')),false,
+  'SIDOWNER-N1-self-existence: a self-owned agent is not a human owner');
+select is(agent_board._session_identity_has_human_owner((select agent_id from _sidowner_n1 where label='gotrue-owned')),false,
+  'SIDOWNER-N1-gotrue-existence: GoTrue user without a human agent is not a human owner');
+select is(agent_board._session_identity_has_human_owner((select agent_id from _sidowner_n1 where label='inactive-human')),false,
+  'SIDOWNER-N1-active-existence: inactive human is not an active human owner');
+set local role service_role;
+select pg_temp.sidowner_n1_subject('human-owned');
+select lives_ok($q$select agent_board.record_session_identity_state((select agent_id from _sidowner_n1 where label='human-owned'),
+  '{"resolution":"resolved","risky_digest":"n1-control","recorded":{}}')$q$,
+  'SIDOWNER-N1-human-owned-control: human-owned root records through the actual SQL recorder');
+reset role;
+select ok((select resolution_state='frozen' and current_risky_digest='n1-control' and recorded_fingerprint->>'resolution'='resolved'
+  from agent_board.session_identities where agent_id=(select agent_id from _sidowner_n1 where label='human-owned')),
+  'SIDOWNER-N1-human-owned-state: allowed recording really stores its reading and freeze');
+set local role service_role;
+select pg_temp.sidowner_n1_subject('self-owned');
+select throws_ok($q$select agent_board.record_session_identity_state((select agent_id from _sidowner_n1 where label='self-owned'),
+  '{"resolution":"resolved","risky_digest":"n1-probe","recorded":{}}')$q$,'42501','identity_human_owner_required',
+  'SIDOWNER-N1-self-owned-refusal: self-owned root without human owner is refused before recording');
+reset role;
+select is((select to_jsonb(si) from agent_board.session_identities si where agent_id=(select agent_id from _sidowner_n1 where label='self-owned')),
+  (select before_state from _sidowner_n1 where label='self-owned'),'SIDOWNER-N1-self-owned-unchanged: no reading or freeze is stored');
+set local role service_role;
+select pg_temp.sidowner_n1_subject('gotrue-owned');
+select throws_ok($q$select agent_board.record_session_identity_state((select agent_id from _sidowner_n1 where label='gotrue-owned'),
+  '{"resolution":"resolved","risky_digest":"n1-probe","recorded":{}}')$q$,'42501','identity_human_owner_required',
+  'SIDOWNER-N1-gotrue-refusal: GoTrue-owned root without human agent is refused before recording');
+reset role;
+select is((select to_jsonb(si) from agent_board.session_identities si where agent_id=(select agent_id from _sidowner_n1 where label='gotrue-owned')),
+  (select before_state from _sidowner_n1 where label='gotrue-owned'),'SIDOWNER-N1-gotrue-unchanged: no reading or freeze is stored');
+set local role service_role;
+select pg_temp.sidowner_n1_subject('inactive-human');
+select throws_ok($q$select agent_board.record_session_identity_state((select agent_id from _sidowner_n1 where label='inactive-human'),
+  '{"resolution":"resolved","risky_digest":"n1-probe","recorded":{}}')$q$,'42501','identity_human_owner_required',
+  'SIDOWNER-N1-inactive-refusal: inactive human cannot enable recording');
+reset role;
+select is((select to_jsonb(si) from agent_board.session_identities si where agent_id=(select agent_id from _sidowner_n1 where label='inactive-human')),
+  (select before_state from _sidowner_n1 where label='inactive-human'),'SIDOWNER-N1-inactive-unchanged: no reading or freeze is stored');
+select * from finish();
+rollback;