@consiliency/agent-board-schema 1.60.0 → 1.64.0

package/tests/agent_board_sidowner_read_class.test.sql

@@ -0,0 +1,171 @@
+-- SIDOWNER read surface: catalog-derived projection and ACL claims.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(24);
+
+select has_function('agent_board', 'list_session_children', array['uuid'],
+  'EC-SIDOWNER-1: scoped children reader exists');
+select has_function('agent_board', 'get_session_identity_state', array['uuid'],
+  'EC-SIDOWNER-1: scoped state reader exists');
+select ok(has_function_privilege('authenticated', 'agent_board.list_session_children(uuid)', 'EXECUTE')
+  and has_function_privilege('service_role', 'agent_board.list_session_children(uuid)', 'EXECUTE')
+  and not has_function_privilege('public', 'agent_board.list_session_children(uuid)', 'EXECUTE')
+  and not has_function_privilege('anon', 'agent_board.list_session_children(uuid)', 'EXECUTE'),
+  'EC-SIDOWNER-1: children reader is authenticated/service-only');
+select ok(has_function_privilege('authenticated', 'agent_board.get_session_identity_state(uuid)', 'EXECUTE')
+  and has_function_privilege('service_role', 'agent_board.get_session_identity_state(uuid)', 'EXECUTE')
+  and not has_function_privilege('public', 'agent_board.get_session_identity_state(uuid)', 'EXECUTE')
+  and not has_function_privilege('anon', 'agent_board.get_session_identity_state(uuid)', 'EXECUTE'),
+  'EC-SIDOWNER-1: state reader is authenticated/service-only');
+select is(has_table_privilege('authenticated', 'agent_board.session_identities', 'SELECT'), false,
+  'EC-SIDOWNER-1: readers do not relax identity table ACL');
+select is(has_table_privilege('authenticated', 'agent_board.session_id_aliases', 'SELECT'), false,
+  'EC-SIDOWNER-1: readers do not expose aliases');
+select ok(agent_board_test.stripped_body('agent_board.list_session_children(uuid)'::regprocedure, true)
+  like '%parent_agent_id%' and agent_board_test.stripped_body('agent_board.list_session_children(uuid)'::regprocedure, true)
+  not like '%forked_from%',
+  'EC-SIDOWNER-1: children traversal uses only parent lineage');
+select ok(pg_get_function_result('agent_board.get_session_identity_state(uuid)'::regprocedure)
+  !~ 'holder_secret_hash|credential_epoch|session_id_aliases|agent_credentials',
+  'EC-SIDOWNER-1: state projection excludes secrets and credential material');
+select ok(agent_board_test.stripped_body('agent_board._session_identity_read_allowed(uuid)'::regprocedure, true)
+  like '%_session_identity_owner%' and agent_board_test.stripped_body('agent_board._session_identity_read_allowed(uuid)'::regprocedure, true)
+  like '%current_agent_id%',
+  'EC-SIDOWNER-1: reader authorizes verified owner or lineage actor');
+select is(
+  (select coalesce(string_agg(p.oid::regprocedure::text, ', ' order by p.oid::regprocedure::text), '')
+     from pg_proc p
+     where p.pronamespace = 'agent_board'::regnamespace
+       and p.proname in ('list_session_children', 'get_session_identity_state')
+       and (has_function_privilege('public', p.oid, 'EXECUTE') or has_function_privilege('anon', p.oid, 'EXECUTE'))),
+  '', 'EC-SIDOWNER-1: catalog reader class has no public or anon route');
+select ok((select count(*) = 2 from pg_proc p where p.pronamespace = 'agent_board'::regnamespace
+  and p.proname in ('list_session_children', 'get_session_identity_state')),
+  'EC-SIDOWNER-1: catalog reader population is exact');
+select ok((select count(*) = 2 from pg_proc p where p.pronamespace = 'agent_board'::regnamespace
+  and p.proname in ('list_session_children', 'get_session_identity_state') and obj_description(p.oid, 'pg_proc') is not null),
+  'EC-SIDOWNER-1: every public SIDOWNER reader has a catalog contract');
+
+-- Discover table users and literal callers by effect, including private helpers.
+-- current_agent_id exposes only the existing fenced principal UUID, not readings;
+-- its positive classification is asserted below, not exempted from discovery.
+create temp table _owner_fns as
+select p.*, agent_board_test.stripped_body(p.oid) as body,
+  agent_board_test.stripped_body(p.oid,true) as literals
+from pg_proc p where p.pronamespace='agent_board'::regnamespace and p.prokind='f';
+create temp table _owner_calls as select * from agent_board_test.fn_call_closure();
+create temp view _owner_direct as
+select f.* from _owner_fns f where f.body ~ agent_board_test.re(
+  agent_board_test.qname_frag('session_identities',agent_board_test.bare_ok(f.oid)) || '|'
+  || agent_board_test.qname_frag('session_id_aliases',agent_board_test.bare_ok(f.oid)));
+create temp table _owner_dml as
+select distinct f.oid from _owner_fns f join pg_class t on t.relnamespace='agent_board'::regnamespace
+  and t.relkind in ('r','p') where f.body ~ agent_board_test.re(
+    agent_board_test.qname_frag(t.relname,agent_board_test.bare_ok(f.oid)))
+  and f.body ~ agent_board_test.re(
+    agent_board_test.write_frag(t.relname,agent_board_test.bare_ok(f.oid)));
+create temp view _owner_mutators as
+select distinct c.root_oid as oid from _owner_calls c
+join _owner_dml w on w.oid=c.reached_oid join _owner_fns f on f.oid=c.root_oid
+where not has_function_privilege('authenticated',f.oid,'EXECUTE')
+  or pg_get_function_result(f.oid) not in ('json','jsonb','record');
+create temp view _owner_principal as
+select f.oid from _owner_direct f where f.proname='current_agent_id'
+  and pg_get_function_result(f.oid)='uuid'
+  and f.body ~ agent_board_test.call_re('auth.uid',false)
+  and f.literals like '%identity_kind is distinct from ''session'' or c.lease_epoch = si.credential_epoch::text%';
+create temp view _owner_internal as
+select f.oid from _owner_direct f
+where pg_get_function_result(f.oid) in ('boolean','void','trigger','timestamp with time zone')
+  and not has_function_privilege('authenticated',f.oid,'EXECUTE')
+  and not has_function_privilege('public',f.oid,'EXECUTE')
+  and not has_function_privilege('anon',f.oid,'EXECUTE');
+create temp view _owner_scoped as
+select f.oid from _owner_fns f where f.proname in ('get_session_identity_state','list_session_children')
+  and f.prosecdef and f.provolatile='s' and f.proconfig @> array['search_path=""']
+  and f.body ~ agent_board_test.call_re('_session_identity_read_allowed')
+  and f.literals like '%raise exception ''identity_read_forbidden'' using errcode = ''42501''%';
+create temp view _owner_unclassified_direct as
+select f.oid,f.proname from _owner_direct f
+where f.oid not in (select oid from _owner_mutators union select oid from _owner_principal
+  union select oid from _owner_internal union select oid from _owner_scoped);
+create temp view _owner_routes as
+select distinct f.oid,f.proname from _owner_fns f join _owner_calls c on c.root_oid=f.oid
+join _owner_direct d on d.oid=c.reached_oid
+where d.oid not in (select oid from _owner_principal);
+create temp view _owner_unclassified_routes as
+select f.* from _owner_routes f
+where f.oid not in (select oid from _owner_mutators union select oid from _owner_internal union select oid from _owner_scoped);
+select is((select count(*) from _owner_principal),1::bigint,
+  'SIDOWNER-principal-positive: existing resolver returns only the session-epoch-fenced actor UUID');
+select ok((select count(*)>=20 from _owner_direct),
+  'SIDOWNER-reader-population: catalog discovery includes existing table users, not just two names');
+select is((select coalesce(string_agg(proname,', ' order by proname),'') from _owner_unclassified_direct),'',
+  'SIDOWNER-reader-class: every direct table user is positively classified; a new reader names itself');
+select is((select coalesce(string_agg(proname,', ' order by proname),'') from _owner_unclassified_routes),'',
+  'SIDOWNER-reader-route-class: every sensitive literal caller is positively classified; a new wrapper names itself');
+select is((select coalesce(string_agg(proname,', ' order by proname),'') from _owner_routes
+  where has_function_privilege('public',oid,'EXECUTE') or has_function_privilege('anon',oid,'EXECUTE')),'',
+  'SIDOWNER-reader-route-acl: discovered sensitive routes have no public or anonymous execution');
+select is((select count(*) from _owner_scoped),2::bigint,
+  'SIDOWNER-scoped-positive: both scoped readers are stable definers with empty paths and named authorization');
+select is((select coalesce(string_agg(distinct c.root_name,', ' order by c.root_name),'')
+  from _owner_calls c join _owner_dml d on d.oid=c.reached_oid
+  where c.root_name in ('get_session_identity_state','list_session_children')),'',
+  'SIDOWNER-select-only: neither scoped reader nor any literal callee writes any board table');
+select ok((select count(*)>=5 from _owner_internal),
+  'SIDOWNER-internal-positive: internal table readers return nonprojecting scalar/trigger results and are not authenticated callable');
+create function agent_board.sidowner_unclassified_reader() returns jsonb
+language sql security definer set search_path='' as $probe$
+  SELECT to_jsonb(si) FROM agent_board.session_identities si LIMIT 1;
+$probe$;
+revoke all on function agent_board.sidowner_unclassified_reader() from public,anon;
+grant execute on function agent_board.sidowner_unclassified_reader() to authenticated,service_role;
+create function agent_board.sidowner_unclassified_wrapper() returns jsonb
+language sql security definer set search_path='' as $probe$
+  SELECT agent_board.sidowner_unclassified_reader(/* no direct table reference */);
+$probe$;
+revoke all on function agent_board.sidowner_unclassified_wrapper() from public,anon;
+grant execute on function agent_board.sidowner_unclassified_wrapper() to authenticated,service_role;
+create function agent_board.sidowner_unclassified_mutating_reader() returns jsonb
+language plpgsql security definer set search_path='' as $probe$
+begin
+  UPDATE agent_board.presence SET availability=availability WHERE false;
+  return (SELECT to_jsonb(si) FROM agent_board.session_identities si LIMIT 1);
+end;
+$probe$;
+revoke all on function agent_board.sidowner_unclassified_mutating_reader() from public,anon;
+grant execute on function agent_board.sidowner_unclassified_mutating_reader() to authenticated,service_role;
+-- Refresh from the actual catalog after adding the canaries, including their
+-- transitive call graph. Caching avoids repeatedly stripping every routine.
+insert into _owner_fns
+select p.*, agent_board_test.stripped_body(p.oid) as body,
+  agent_board_test.stripped_body(p.oid,true) as literals
+from pg_proc p where p.oid in ('agent_board.sidowner_unclassified_reader()'::regprocedure,
+  'agent_board.sidowner_unclassified_wrapper()'::regprocedure,
+  'agent_board.sidowner_unclassified_mutating_reader()'::regprocedure);
+truncate _owner_calls;
+insert into _owner_calls select * from agent_board_test.fn_call_closure();
+truncate _owner_dml;
+insert into _owner_dml
+select distinct f.oid from _owner_fns f join pg_class t on t.relnamespace='agent_board'::regnamespace
+  and t.relkind in ('r','p') where f.body ~ agent_board_test.re(
+    agent_board_test.qname_frag(t.relname,agent_board_test.bare_ok(f.oid)))
+  and f.body ~ agent_board_test.re(
+    agent_board_test.write_frag(t.relname,agent_board_test.bare_ok(f.oid)));
+select is((select string_agg(proname,', ' order by proname) from _owner_unclassified_direct
+  where proname='sidowner_unclassified_reader'),'sidowner_unclassified_reader',
+  'SIDOWNER-reader-canary: new authenticated uppercase reader names itself without a PUBLIC grant');
+select is((select string_agg(proname,', ' order by proname) from _owner_unclassified_routes
+  where proname in ('sidowner_unclassified_reader','sidowner_unclassified_wrapper')),
+  'sidowner_unclassified_reader, sidowner_unclassified_wrapper',
+  'SIDOWNER-wrapper-canary: indirect reader also names itself in literal-call closure');
+select is((select count(*) from _owner_mutators where oid in (
+  'agent_board.sidowner_unclassified_reader()'::regprocedure,'agent_board.sidowner_unclassified_wrapper()'::regprocedure)),0::bigint,
+  'SIDOWNER-positive-classification-canary: a SELECT-only secret reader is not mislabeled as a lifecycle writer');
+select is((select proname::text from _owner_unclassified_direct
+  where proname='sidowner_unclassified_mutating_reader'),'sidowner_unclassified_mutating_reader',
+  'SIDOWNER-unrelated-write-canary: unrelated no-op DML cannot classify an authenticated JSON reader as safe');
+select * from finish();
+rollback;

package/tests/agent_board_sidowner_reads.test.sql

@@ -0,0 +1,136 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(31);
+create temp table _owner_fixture(label text primary key, agent_id uuid, auth_id uuid);
+do $$
+declare v_owner uuid; v_root uuid; v_parent uuid; v_id uuid; v_auth uuid; v_label text;
+begin
+  foreach v_label in array array['owner','other-owner','root','parent','sibling','grandchild','other-root'] loop
+    v_id := gen_random_uuid();
+    v_auth := public.ensure_github_user('sidowner-' || v_id, v_id || '@example.test', v_id::text, v_label);
+    if v_label = 'owner' then v_owner := v_auth; end if;
+    if v_label = 'root' then v_root := v_id; end if;
+    if v_label = 'parent' then v_parent := v_id; end if;
+    insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id, parent_agent_id, root_agent_id)
+    values (v_id, case when v_label in ('owner','other-owner') then 'human' else 'agent' end,
+      'sidowner-' || v_id, v_label, 'active', v_auth,
+      case when v_label in ('root','parent','sibling','grandchild') then v_owner else v_auth end,
+      case when v_label in ('parent','sibling') then v_root when v_label = 'grandchild' then v_parent else null end,
+      case when v_label in ('parent','sibling','grandchild') then v_root else null end);
+    insert into _owner_fixture values (v_label, v_id, v_auth);
+  end loop;
+end;
+$$;
+set constraints all immediate;
+set constraints all deferred;
+grant select on _owner_fixture to authenticated, service_role;
+create function pg_temp.owner_actor(p_label text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', '{}', true);
+  perform set_config('request.jwt.claim.sub', coalesce((select auth_id::text from _owner_fixture where label=p_label), ''), true);
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.agent_credential_id', '', true);
+end;
+$$;
+select pg_temp.owner_actor('owner');
+set local role authenticated;
+create temp table _owner_children as select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root')) with no data;
+select lives_ok($$insert into _owner_children select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root'))$$,
+  'SIDOWNER-owner-control: human owner enters scoped children reader');
+select is((select count(*) from _owner_children), 3::bigint,
+  'SIDOWNER-subtree: all strict descendants at both depths returned');
+select is((select array_agg(depth order by ctid) from _owner_children), array[1,1,2]::smallint[],
+  'SIDOWNER-order: children ordered by depth and identity');
+select is((select array_agg(agent_id order by ctid) from _owner_children),
+  (select array_agg(agent_id order by depth,agent_id) from _owner_children),
+  'SIDOWNER-identity-order: emitted child rows retain depth then UUID ordering');
+select is((select count(*) from _owner_children where agent_id=(select agent_id from _owner_fixture where label='root')), 0::bigint,
+  'SIDOWNER-parent-excluded: selected parent is never included');
+select is((select count(*) from _owner_children where root_agent_id<>(select agent_id from _owner_fixture where label='root')), 0::bigint,
+  'SIDOWNER-root-filter: unrelated root is never returned');
+select is((select string_agg(attname, ',' order by attnum) from pg_attribute where attrelid='_owner_children'::regclass and attnum>0 and not attisdropped),
+  'agent_id,parent_agent_id,root_agent_id,handle,depth,harness,lease_state,resolution_state,fingerprint_resolution,current_risky_digest,approved_risky_digest,recorded_fingerprint,tombstoned_at,tombstone_reason',
+  'SIDOWNER-safe-columns: exact normalized projection excludes credential material');
+create temp table _owner_root as select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='root')) with no data;
+select lives_ok($$insert into _owner_root select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='root'))$$,
+  'SIDOWNER-owner-state-control: owner inspects root');
+select is((select string_agg(attname, ',' order by attnum) from pg_attribute where attrelid='_owner_root'::regclass and attnum>0 and not attisdropped),
+  'agent_id,parent_agent_id,root_agent_id,handle,depth,harness,lease_state,resolution_state,fingerprint_resolution,current_risky_digest,approved_risky_digest,recorded_fingerprint,tombstoned_at,tombstone_reason',
+  'SIDOWNER-state-safe-columns: single-state reader has the same exact safe projection');
+select is((select lease_state from _owner_root), 'not_applicable', 'SIDOWNER-legacy-lease: root is not a session lease');
+select is((select fingerprint_resolution from _owner_root), 'unresolved', 'SIDOWNER-missing-reading: backfill reading is unresolved');
+reset role;
+select pg_temp.owner_actor('root');
+set local role authenticated;
+select lives_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  'SIDOWNER-ancestor-control: strict ancestor reads parent subtree');
+select lives_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='grandchild'))$$,
+  'SIDOWNER-ancestor-state: ancestor reads depth two');
+reset role;
+select pg_temp.owner_actor('parent');
+set local role authenticated;
+select lives_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  'SIDOWNER-self-control: parent reads own children');
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='sibling'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-sibling: same-root sibling cannot read subtree');
+select throws_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-descendant: descendant cannot read ancestor');
+reset role;
+update agent_board.session_identities set resolution_state='frozen' where agent_id=(select agent_id from _owner_fixture where label='parent');
+set local role authenticated;
+select lives_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  'SIDOWNER-frozen-reader: freeze does not deny diagnosis');
+reset role;
+update agent_board.session_identities set tombstoned_at=now(), tombstone_reason='revoked'
+  where agent_id=(select agent_id from _owner_fixture where label='grandchild');
+set local role authenticated;
+create temp table _owner_tombstone as select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent')) with no data;
+select lives_ok($$insert into _owner_tombstone select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  'SIDOWNER-tombstone-control: parent reads tombstone');
+select is((select tombstone_reason from _owner_tombstone), 'revoked', 'SIDOWNER-tombstone: tombstoned descendants remain visible');
+reset role;
+select pg_temp.owner_actor('other-owner');
+set local role authenticated;
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-owner-filter: unrelated human cannot inspect root');
+select throws_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='grandchild'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-other-owner-state: unrelated human cannot inspect state');
+reset role;
+select pg_temp.owner_actor('other-root');
+set local role authenticated;
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-other-root: unrelated agent cannot inspect subtree');
+create temp table _owner_empty as select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='other-root')) with no data;
+select lives_ok($$insert into _owner_empty select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='other-root'))$$,
+  'SIDOWNER-empty-control: leaf is an authorized parent');
+select is((select count(*) from _owner_empty), 0::bigint,'SIDOWNER-empty: authorized leaf returns an empty array');
+select throws_ok($$select * from agent_board.list_session_children('00000000-0000-0000-0000-000000000000')$$,
+  '42501','identity_read_forbidden','SIDOWNER-missing: missing parent uses same refusal');
+select throws_ok($$select * from agent_board.get_session_identity_state('00000000-0000-0000-0000-000000000000')$$,
+  '42501','identity_read_forbidden','SIDOWNER-missing-state: missing state uses same refusal');
+reset role;
+select pg_temp.owner_actor('owner');
+select set_config('request.jwt.claim.agent_credential_id', gen_random_uuid()::text, true);
+set local role authenticated;
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-invalid-owner-credential: owner predicate cannot bypass invalid credential');
+reset role;
+select pg_temp.owner_actor('parent');
+update agent_board.agents set status='revoked' where id=(select agent_id from _owner_fixture where label='parent');
+set local role authenticated;
+select throws_ok($$select * from agent_board.list_session_children((select agent_id from _owner_fixture where label='parent'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-revoked-reader: revoked parent cannot inspect children');
+reset role;
+select pg_temp.owner_actor('none');
+set local role authenticated;
+select throws_ok($$select * from agent_board.get_session_identity_state((select agent_id from _owner_fixture where label='root'))$$,
+  '42501','identity_read_forbidden','SIDOWNER-null-actor: missing actor cannot read state');
+reset role;
+select is((select count(*) from agent_board.session_identities where root_agent_id=(select agent_id from _owner_fixture where label='root')), 4::bigint,
+  'SIDOWNER-read-only: reads preserve identity population');
+select is((select resolution_state from agent_board.session_identities where agent_id=(select agent_id from _owner_fixture where label='parent')), 'frozen',
+  'SIDOWNER-read-state: diagnosis preserves freeze');
+select * from finish();
+rollback;

package/tests/agent_board_signer_lifecycle.test.sql

@@ -38,7 +38,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(48);
+select plan(50);
 
 create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
 begin
@@ -693,7 +693,25 @@ select ok(
 --    would silently drop a site, which is the direction that hides a defect.
 -- ===========================================================================
 
-select is(
+create temp view _sid_instance_withdrawal as
+select p.oid,agent_board_test.stripped_body(p.oid,true) as b
+from pg_proc p where p.oid='agent_board.tombstone_delegate_instance(text,text,text,text)'::regprocedure;
+select ok((select b like '%perform agent_board.update_board_membership(v_board, v_row.agent_id, ''left'');%'
+  and b like '%if v_row.owner_user_id is distinct from v_owner then%'
+  and b like '%where di.instance_id = p_instance_id%'
+  and (select count(*) from regexp_matches(b,agent_board_test.call_re('update_board_membership'),'g'))=1
+  from _sid_instance_withdrawal),
+  'EC-SIDSCHEMA-5-instance-withdrawal-positive: the verified-instance revoker writes only left memberships for its bound principal, never a grant or admission; real closure tests check state and append-only provenance');
+select ok((select strpos(b, 'perform agent_board._lock_board_authority_ceiling(v_board);') > 0
+  and strpos(b, 'perform agent_board._lock_board_authority_ceiling(v_board);')
+    < strpos(b, 'v_owner := agent_board._ensure_agent_auth_user(v_owner_slug);')
+  and strpos(b, 'perform agent_board._lock_board_authority_ceiling(v_board);')
+    < strpos(b, 'insert into agent_board.delegate_instances')
+  and b like '%select b.id from agent_board.boards b order by b.id%'
+  from _sid_instance_withdrawal
+  where oid='agent_board.tombstone_delegate_instance(text,text,text,text)'::regprocedure),
+  'SID-INTEGRITY-lock-order: tombstone_delegate_instance locks the board universe in UUID order before owner/instance and identity-family locks');
+select is( -- pgtap-allow-raise-checked: catalog text comparison only; no RPC executes in this value expression.
   (with recursive fns as (
      select p.oid, p.proname, agent_board_test.stripped_body(p.oid) as b
        from pg_proc p join pg_namespace n on n.oid = p.pronamespace
@@ -736,10 +754,14 @@ select is(
     -- assertion deliberately requires mutual exclusion, which survives a lock being added
     -- downstream, and NOT a re-derived order, which does not.
     'grant_board_role => serialised by the board advisory lock',
+    'link_session_alias => serialised by the board advisory lock',
+    'mint_delegated_child => serialised by the board advisory lock',
     'onboard_federated_fleet_agent => serialised by the board advisory lock',
-    'signed_grant_board_role => serialised by the board advisory lock'
+    'readmit_session_identity => serialised by the board advisory lock',
+    'signed_grant_board_role => serialised by the board advisory lock',
+    'tombstone_delegate_instance => serialised by the board advisory lock'
   ]::text[],
-  'every function that EXPLICITLY row-locks both agents and board_memberships takes the board advisory lock (transitive; a new one names itself). FK-implied locks are invisible here and are covered by agent_board_fk_lock_edges.test.sql');
+  'every discovered agent+membership locker takes the board advisory lock (transitive; a new one names itself). FK-implied locks are covered by agent_board_fk_lock_edges.test.sql');
 
 select finish();
 

package/tests/agent_board_signing_challenge_pending_cap.test.sql

@@ -56,7 +56,7 @@ select has_function(
   'agent_board', 'issue_signing_key_challenge', array['uuid', 'text', 'interval'],
   'issue_signing_key_challenge exists');
 select has_function(
-  'agent_board', 'mint_fleet_agent_session', array['uuid', 'text', 'uuid', 'uuid', 'integer'],
+  'agent_board', 'mint_fleet_agent_session', array['uuid', 'text', 'uuid', 'uuid', 'integer', 'text', 'text'],
   'mint_fleet_agent_session exists');
 
 -- Seed one agent + key, then fill the key's sixteen pending slots.

package/tests/agent_board_write_enforcement_class.test.sql

@@ -332,7 +332,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(25);
+select plan(30);
 
 -- ===========================================================================================
 -- THE CLASS, derived from pg_catalog. Nothing below is a list of names.
@@ -430,10 +430,12 @@ select distinct p.oid,
 -- 60 -> 62 with HOSTED's delegate_instances and delegate_allowed_operations (20261008000100).
 -- Both are written only by service_role-only definers or the migration itself, so neither joins
 -- the `authenticated` writer population below.
+-- SIDSCHEMA adds identities and aliases. Human-owner readmission writes them and
+-- delegation_grants; these remain in the derived class, not an exemption list.
 select is(
   (select count(*)::text from _wec_target where relkind = 'r'),
-  '62',
-  '#325 canary: agent_board has 62 base tables — the universe the write scan runs over, pinned so an empty violating set below cannot mean an empty universe');
+  '64',
+  '#325 canary: agent_board has 64 base tables — the universe the write scan runs over, pinned so an empty violating set below cannot mean an empty universe');
 
 -- WEC-2. The relations the class writes, as an EXACT SET. A new one names itself.
 select is(
@@ -459,6 +461,7 @@ select is(
         'callback_subscriptions',
         'claims',
         'conflicts',
+        'delegation_grants',
         'delegation_policies',
         'delegations',
         'delivery_recipients',
@@ -476,11 +479,13 @@ select is(
         'presence',
         'read_receipts',
         'send_authz_telemetry',
+        'session_id_aliases',
+        'session_identities',
         'task_events',
         'tasks',
         'threads'
         ]::text[],
-  '#325: these 37 agent_board relations are written by an authenticated-executable function, directly or through a callee — five of them (board_invite_redemptions, board_membership_events, callback_outbox_events, delivery_recipients, send_authz_telemetry) were invisible while membership was own-body');
+  '#325: these 40 agent_board relations are written by an authenticated-executable function, directly or through a callee — SIDSCHEMA readmission adds grants, identities and aliases without excluding their writers');
 
 -- WEC-3. The class itself, as an EXACT SET of SIGNATURES, and it is signatures rather than
 -- `count(*) = 59` for two reasons. The routine response to a red count is to bump the count,
@@ -495,6 +500,8 @@ select is( -- pgtap-allow-raise-checked
     -- HOSTED (20261008000100): the owner places its hosted delegate through the sink.
     'agent_board.add_delegate_to_board(uuid,uuid)',
     'agent_board.append_task_event(uuid,uuid,text,jsonb,text,uuid,timestamp with time zone)',
+    -- Approval's measured fingerprint is service-only until SIDSERVER binds it.
+    -- Its ACL and real human/ancestor actors are pinned in the fingerprint suite.
     'agent_board.block_board_inviter(uuid,uuid,uuid,jsonb)',
     'agent_board.create_board(uuid,text,text,text,jsonb,text)',
     'agent_board.create_fleet_onboarding_invite(uuid,uuid,text,text,text,text,text,text,text,integer,timestamp with time zone,uuid,jsonb)',
@@ -509,6 +516,7 @@ select is( -- pgtap-allow-raise-checked
     'agent_board.disable_callback_endpoint(uuid,uuid,text,jsonb)',
     'agent_board.grant_board_role(uuid,uuid,text,uuid)',
     'agent_board.heartbeat(uuid,uuid,text,text,interval,jsonb)',
+    'agent_board.heartbeat_session_identity(uuid)',
     'agent_board.invite_board_member(uuid,uuid,uuid,jsonb)',
     'agent_board.issue_signing_key_challenge(uuid,text,interval)',
     'agent_board.join_board(uuid,uuid,text,uuid,jsonb)',
@@ -520,13 +528,17 @@ select is( -- pgtap-allow-raise-checked
     'agent_board.provision_agent(text,text,jsonb,uuid)',
     'agent_board.raise_conflict(uuid,uuid,text,text,text,uuid,jsonb)',
     'agent_board.raise_escalation(uuid,uuid,text,text,text,uuid,uuid,jsonb)',
+    'agent_board.readmit_session_identity(uuid,text,text,jsonb,jsonb,interval)',
     'agent_board.record_signing_key_proof_result(uuid,uuid,text,boolean,text,jsonb)',
     'agent_board.redeem_invite_link(text,jsonb)',
     'agent_board.register_agent(text,text,text,text,jsonb)',
     'agent_board.register_callback_endpoint(uuid,text,jsonb)',
     'agent_board.register_fleet_machine(uuid,uuid,text,text,text,jsonb)',
     'agent_board.release_claim(uuid)',
+    'agent_board.rename_agent(uuid,text)',
     'agent_board.renew_claim(uuid,timestamp with time zone)',
+    -- Fresh renewal attestation is service-role-only; lifetime's trust assertion
+    -- positively pins the ACL, rather than excluding a reachable writer here.
     'agent_board.request_join_board(uuid,uuid,jsonb)',
     'agent_board.resolve_board_request(uuid,uuid,text,uuid,jsonb)',
     'agent_board.resolve_conflict(uuid,uuid,jsonb)',
@@ -535,6 +547,7 @@ select is( -- pgtap-allow-raise-checked
     'agent_board.revoke_fleet_machine_agent_binding(uuid,uuid,text,jsonb)',
     'agent_board.revoke_fleet_subject(text,uuid,uuid,text,jsonb)',
     'agent_board.revoke_invite_link(text,jsonb)',
+    'agent_board.revoke_session_identity(uuid)',
     'agent_board.rotate_callback_signing_key(uuid,uuid,jsonb)',
     'agent_board.self_enroll_human(text)',
     'agent_board.send_direct_message(uuid,uuid,jsonb,text,text,text,text,text,text,jsonb)',
@@ -543,6 +556,7 @@ select is( -- pgtap-allow-raise-checked
     'agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)',
     'agent_board.set_board_authority_ceiling(uuid,text,uuid)',
     'agent_board.set_board_claim_policy(uuid,text)',
+    'agent_board.set_board_member_label(uuid,uuid,text)',
     'agent_board.set_board_role_gate(uuid,boolean)',
     'agent_board.set_fleet_receive_policy(uuid,text,text,boolean,uuid,uuid,jsonb)',
     'agent_board.subscribe_callback_endpoint(uuid,uuid,text,text,uuid,jsonb)',
@@ -553,7 +567,7 @@ select is( -- pgtap-allow-raise-checked
     'agent_board.upsert_delegation_policy(uuid,text,jsonb,integer,interval,boolean)',
     'agent_board.verify_callback_endpoint(uuid,uuid,jsonb)'
     ]::text[],
-  '#325: the effect-derived class is exactly these 61 authenticated-executable writer OVERLOADS — per-OID, and TRANSITIVE, so a delegating wrapper whose own body holds no DML is a member rather than a blind spot');
+  '#325: the effect-derived class is exactly these 66 authenticated-executable writer OVERLOADS — per-OID, and TRANSITIVE, so a delegating wrapper whose own body holds no DML is a member rather than a blind spot');
 
 -- WEC-4. THE DELEGATION-CHAIN LIVENESS PIN, and the mitigation for the fail-open inversion the
 -- header describes. Everything above depends on `fn_call_closure()` actually resolving edges; a
@@ -614,8 +628,8 @@ select is(
   (select coalesce(array_agg(p.sig order by p.sig), array[]::text[])
      from _wec_pop p
     where agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.call_re('auth.uid', false)),
-  array['agent_board.self_enroll_human(text)']::text[],
-  '#325: exactly ONE writer derives from raw auth.uid() — self_enroll_human CREATES the identity a session would resolve to, so it cannot use the resolver; scored on the own body because the closure form matches all 59 and would make Half A vacuous');
+  array['agent_board.rename_agent(uuid,text)', 'agent_board.self_enroll_human(text)']::text[],
+  '#325: exactly these writers derive from raw auth.uid() — self enrollment creates the human identity; rename requires its active human owner, positively exercised by WEC-26..29');
 
 -- ===========================================================================================
 -- HALF B — every writer REFUSES SOMEBODY. Labelled honestly: it pins that a refusal exists on the
@@ -673,7 +687,6 @@ select is( -- pgtap-allow-raise-checked
     'agent_board.issue_signing_key_challenge(uuid,text,interval) -> _resolved_actor_agent_id',
     'agent_board.provision_agent(text,text,jsonb,uuid) -> _require_platform_admin_user_id',
     'agent_board.register_callback_endpoint(uuid,text,jsonb) -> _resolved_actor_agent_id',
-    'agent_board.revoke_agent(uuid,text) -> _require_platform_admin_user_id',
     'agent_board.rotate_callback_signing_key(uuid,uuid,jsonb) -> _resolved_actor_agent_id',
     'agent_board.subscribe_callback_endpoint(uuid,uuid,text,text,uuid,jsonb) -> _resolved_actor_agent_id',
     'agent_board.unblock_board_inviter(uuid,uuid,uuid) -> _resolved_actor_agent_id',
@@ -682,7 +695,7 @@ select is( -- pgtap-allow-raise-checked
     'agent_board.upsert_delegation_policy(uuid,text,jsonb,integer,interval,boolean) -> _resolved_actor_agent_id',
     'agent_board.verify_callback_endpoint(uuid,uuid,jsonb) -> _resolved_actor_agent_id'
     ]::text[],
-  '#325 HALF B, part 1: exactly these 16 writers reach NO shared authz predicate and raise no 42501 of their own, and each NAMES the raising resolver it relies on — 14 the session resolver, 2 the platform-admin one; a new ungated writer joins this set, and a member that loses or switches its resolver reds here');
+  '#325 HALF B, part 1: exactly these 15 writers reach NO shared authz predicate and raise no 42501 of their own, and each NAMES the raising resolver it relies on — 14 the session resolver, 1 the platform-admin one; revoke_agent now refuses an unresolved actor in its own body; a new ungated writer joins this set, and a member that loses or switches its resolver reds here');
 
 -- WEC-9. The union, and the only assertion here that is a claim about the WHOLE class rather than
 -- about a category. Not spelled over the CLOSURE for 42501: that form is satisfied by 59 of 59
@@ -875,7 +888,7 @@ select is(
      cross join unnest(array['INSERT', 'UPDATE', 'DELETE', 'TRUNCATE']) as pv
     where has_table_privilege(r, t.reloid, pv)),
   array[]::text[],
-  '#325: NEITHER authenticated NOR anon holds a direct write privilege on ANY of the 37 class relations — so for those two roles every write goes through some agent_board function; WEC-3 is what says which');
+  '#325: NEITHER authenticated NOR anon holds a direct write privilege on ANY of the 40 class relations — so for those two roles every write goes through some agent_board function; WEC-3 is what says which');
 
 -- WEC-18. The arm that DOES NOT hold, pinned as an exact set rather than omitted. service_role
 -- writes thirteen of these relations directly, with no function and no body — the structural
@@ -900,6 +913,7 @@ select is(
         'INSERT:board_invite_redemptions',
         'INSERT:board_invite_tokens',
         'INSERT:board_membership_events',
+        'INSERT:delegation_grants',
         'INSERT:fleet_harness_registrations',
         'INSERT:fleet_machine_agents',
         'INSERT:fleet_machines',
@@ -911,6 +925,7 @@ select is(
         'UPDATE:board_authority_ceilings',
         'UPDATE:board_invite_redemptions',
         'UPDATE:board_invite_tokens',
+        'UPDATE:delegation_grants',
         'UPDATE:fleet_harness_registrations',
         'UPDATE:fleet_machine_agents',
         'UPDATE:fleet_machines',
@@ -919,7 +934,7 @@ select is(
         'UPDATE:fleet_revocation_events',
         'UPDATE:fleet_trust_domains'
         ]::text[],
-  '#325: service_role holds direct DML on THIRTEEN of the 37 class relations — the plan asserts this bound holds and it DOES NOT; pinned as an exact set so the hole is bounded and a widening names itself');
+  '#325: service_role holds direct DML on FOURTEEN of the 40 class relations — grants newly enter this class through readmission, not through a new grant; the exact privilege set bounds the hole');
 
 -- WEC-19. The rule-1-correct arm. WEC-17 and WEC-18 are hand lists of three role names between
 -- them, so an INSERT granted to a brand-new role self-names in NEITHER. This reads the ACL itself.
@@ -952,7 +967,7 @@ select ok(
      where c.relowner <> 'postgres'::regrole) = 0
     and has_table_privilege('postgres', 'agent_board.threads', 'INSERT')
     and has_table_privilege('postgres', 'agent_board.threads', 'DELETE'),
-  '#325: postgres OWNS every one of the 37 class relations (pg_class.relowner, not inferred from a privilege) and holds writes on them — so the WEC-19 exclusion is a fact about ownership, not a carve-out');
+  '#325: postgres OWNS every one of the 40 class relations (pg_class.relowner, not inferred from a privilege) and holds writes on them — so the WEC-19 exclusion is a fact about ownership, not a carve-out');
 
 -- WEC-21. The over-revoke guard. A file that only ever asserts absence would call a schema with
 -- every privilege revoked a success.
@@ -1006,12 +1021,13 @@ select is(
         'agent_board.fleet_trust_domains',
         'agent_board.inbox_items',
         'agent_board.messages',
+        'agent_board.session_identities',
         'agent_board.task_events',
         'agent_board.tasks',
         'agent_board.threads',
         'auth.users'
         ]::text[],
-  '#325: deleting a row in one of these 19 parents CASCADES or SET NULLs into a class relation — a write path with no privilege check and no function body, so no assertion in this file gates it; one parent is auth.users, i.e. outside agent_board entirely');
+  '#325: deleting a row in one of these 20 parents CASCADES or SET NULLs into a class relation — a write path with no privilege check and no function body; one parent is auth.users, i.e. outside agent_board entirely');
 
 -- WEC-23. The edge count. This IS a bare count and the hazard is stated rather than left for a
 -- reviewer: the routine response to a red count is to bump it, which absorbs a new cascade edge
@@ -1023,8 +1039,8 @@ select is(
      from _wec_class_tables t
      join pg_constraint con on con.conrelid = t.reloid
     where con.contype = 'f' and con.confdeltype in ('c', 'n', 'd')),
-  '88',
-  '#325: 88 writing referential actions (74 CASCADE + 14 SET NULL) reach the 37 class relations — bump this number only after confirming the new edge is intended; see WEC-22, which names parents independently');
+  '92',
+  '#325: 92 writing referential actions (78 CASCADE + 14 SET NULL) reach the 40 class relations — the four SIDSCHEMA class additions are positively pinned in WEC-30');
 
 -- ===========================================================================================
 -- WEC-24/25 — THE CROSS-CHECK (Consiliency/message-board#416 / #417 / #424, plan change 9).
@@ -1138,6 +1154,49 @@ select is(
   'mark_retention_metadata',
   'WEC-25 (change 9): the plpgsql bodies WEC-24 skips for dynamic SQL are exactly these — mark_retention_metadata writes board_memberships through format(), which neither write_re nor the parser can see; a second dynamic writer fails here by name');
 
+-- WEC-26..29: raw auth.uid() for rename is a human-ownership check, not agent
+-- self-authentication or a service-role assertion. Exercise the real API role.
+create temp table _wec_owner(user_id uuid, original_handle text) on commit drop;
+do $$ declare u uuid; begin
+  u := public.ensure_github_user('wec-owner-' || gen_random_uuid(), 'wec-owner@example.test',
+    'wec-owner-' || gen_random_uuid(), 'WEC owner');
+  insert into agent_board.agents(agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+    values ('human', 'wec-human-' || gen_random_uuid(), 'WEC owner', 'active', u, u);
+  update agent_board.agents set owner_user_id = u
+    where id = (select agent_id from _wec_agent where label = 'a');
+  insert into _wec_owner select u, handle from agent_board.agents
+    where id = (select agent_id from _wec_agent where label = 'a');
+end $$;
+grant select on _wec_owner, _wec_agent to authenticated;
+grant usage on schema extensions to authenticated;
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select user_id from _wec_owner)::text, true);
+select lives_ok($$select agent_board.rename_agent((select agent_id from _wec_agent where label = 'a'), 'WEC renamed')$$,
+  'WEC-26: active authenticated human owner can rename its agent');
+reset role;
+select is((select display_name || '/' || (handle = original_handle)::text
+  from agent_board.agents cross join _wec_owner where id = (select agent_id from _wec_agent where label = 'a')),
+  'WEC renamed/true', 'WEC-27: raw-human rename writes only the intended display name and preserves handle');
+-- The nearest invalid owner: ownership matches the agent's auth user, but that
+-- principal is not a human. A stranger would hide loss of the human predicate.
+update agent_board.agents set owner_user_id = (select user_id from _wec_agent where label = 'a')
+  where id = (select agent_id from _wec_agent where label = 'a');
+set local role authenticated;
+select set_config('request.jwt.claim.sub', (select user_id from _wec_agent where label = 'a')::text, true);
+select throws_ok($$select agent_board.rename_agent((select agent_id from _wec_agent where label = 'a'), 'WEC agent renamed')$$,
+  '42501', 'agent rename requires the human owner', 'WEC-28: the agent credential is not its human owner');
+reset role;
+select is((select display_name from agent_board.agents where id = (select agent_id from _wec_agent where label = 'a')),
+  'WEC renamed', 'WEC-29: refused agent rename leaves the human-owned state unchanged');
+select is((select array_agg(c.conname::text || ':' || c.confdeltype::text order by c.conname::text)
+  from _wec_class_tables t join pg_constraint c on c.conrelid = t.reloid
+  where t.relname in ('delegation_grants', 'session_identities', 'session_id_aliases')
+    and c.contype = 'f' and c.confdeltype in ('c', 'n', 'd')),
+  array['delegation_grants_child_agent_id_fkey:c', 'delegation_grants_root_agent_id_fkey:c',
+    'session_id_aliases_identity_agent_id_fkey:c', 'session_identities_agent_id_fkey:c']::text[],
+  'WEC-30: all four newly class-visible referential writes are the intended principal/grant/identity/alias cascades');
+
 select * from finish();
 
 rollback;