@consiliency/agent-board-schema 1.60.0 → 1.64.0

package/tests/agent_board_fk_lock_edges.test.sql

@@ -40,7 +40,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(18);
+select plan(21);
 
 -- ---------------------------------------------------------------------------
 -- The derivation, materialized once. `first_path` is the position PATH of the
@@ -49,7 +49,46 @@ select plan(18);
 -- function takes on that relation anywhere, which over-reports conflicts rather
 -- than under-reporting them.
 -- ---------------------------------------------------------------------------
-create temp table _le on commit drop as select * from agent_board_test.lock_edges();
+create temp table _le_raw on commit drop as select * from agent_board_test.lock_edges();
+-- The fixture conservatively assigns every target-table FK to every INSERT.
+-- Bound these two exemptions by the executable column lists AND the catalog:
+-- every INSERT must use an explicit list, omit all nullable/default-free FK
+-- columns, and have no BEFORE INSERT trigger that could populate them. UPDATE
+-- edges and any new writer/constructor remain in the graph.
+create temp table _null_fk_insert on commit drop as
+with candidates as (
+  select distinct e.origin_oid, e.origin_name, e.rel_oid, e.path[1] as pos,
+    c.oid as constraint_oid, c.conname, c.conrelid, c.conkey,
+    cl.relname, agent_board_test.stripped_body(e.origin_oid) as body
+  from _le_raw e join pg_constraint c on e.via='fk-insert:' || c.conname and c.confrelid=e.rel_oid
+  join pg_class cl on cl.oid=c.conrelid
+  where e.own and e.origin_name in ('_session_identity_agent_lineage','_revoke_agent_principal')
+), proven as (
+  select c.*, (select count(*) from regexp_matches(c.body,
+    agent_board_test.re(agent_board_test.stmt_frag('insert into', c.relname, true)
+      || '\s*(\([^)]*\))?'), 'g')) as insert_count
+  from candidates c
+  where not exists (select 1 from unnest(c.conkey) k join pg_attribute a
+    on a.attrelid=c.conrelid and a.attnum=k where a.attnotnull or a.atthasdef)
+    and not exists (select 1 from pg_trigger t where t.tgrelid=c.conrelid
+      and not t.tgisinternal and (t.tgtype & 2)=2 and (t.tgtype & 4)=4)
+    and not exists (select 1 from regexp_matches(c.body,
+      agent_board_test.re(agent_board_test.stmt_frag('insert into', c.relname, true)
+        || '\s*(\([^)]*\))?'), 'g') m
+      where m[1] is null or exists (select 1 from unnest(c.conkey) k join pg_attribute a
+        on a.attrelid=c.conrelid and a.attnum=k
+        where a.attname = any(string_to_array(trim(both '()' from
+          translate(lower(m[1]), ' "' || chr(9) || chr(10) || chr(13), '')), ','))))
+)
+select * from proven where insert_count>0;
+create temp table _le on commit drop as
+select e.* from _le_raw e where not exists (
+  select 1 from _null_fk_insert n where n.origin_oid=e.origin_oid and n.rel_oid=e.rel_oid
+    and n.pos=e.path[cardinality(e.path)]
+    and not exists (select 1 from _le_raw kept where kept.own and kept.origin_oid=e.origin_oid
+      and kept.rel_oid=e.rel_oid and kept.path[1]=n.pos
+      and not exists (select 1 from _null_fk_insert omitted where omitted.origin_oid=kept.origin_oid
+        and omitted.rel_oid=kept.rel_oid and omitted.pos=kept.path[1] and kept.via='fk-insert:' || omitted.conname)));
 create temp table _cl on commit drop as select * from agent_board_test.fn_call_closure();
 
 create temp table _acq on commit drop as
@@ -187,8 +226,28 @@ select is(
                          join pg_class cl on cl.oid = t.tgrelid
                          join pg_namespace n on n.oid = cl.relnamespace
                         where not t.tgisinternal and n.nspname = 'agent_board')),
-  '',
-  'FKL-8: no trigger function on an agent_board table takes a lock edge -- trigger locks are NOT folded in');
+  '_session_identity_agent_lineage',
+  'FKL-8: the catalog-derived locking trigger class is exactly the positively bounded fresh legacy-identity constructor; new trigger locks name themselves');
+
+-- This trigger may INSERT only the identity for NEW.id on an agents INSERT,
+-- never another ancestor and never on UPDATE. Its own-agent FK is already
+-- owned by the insert; parent/root KEY SHARE locks are the same FK targets the
+-- agents INSERT already acquired. The constructor is exercised positively by
+-- agent_board_session_identity_lineage.test.sql, including session-kind retention.
+select is((select string_agg(distinct e.rel_name || ' ' || e.lock_mode || ' via ' || e.via, ' | '
+  order by e.rel_name || ' ' || e.lock_mode || ' via ' || e.via)
+  from _le e where e.fn_name='_session_identity_agent_lineage' and e.own),
+  'agent_board.agents key share via fk-insert:session_identities_agent_id_fkey | agent_board.agents key share via fk-insert:session_identities_parent_agent_id_fkey | agent_board.agents key share via fk-insert:session_identities_root_agent_id_fkey',
+  'FKL-8-constructor-positive: every actual constructor FK lock is on its already inserted agent or the same parent/root agents targets; it has no independent identity update lock');
+
+select is((select string_agg(conname || ':' || insert_count, ', ' order by conname)
+  from _null_fk_insert where origin_name='_session_identity_agent_lineage'),
+  'session_identities_forked_from_fkey:1, session_identities_lease_alias_fkey:1, session_identities_readmitted_from_fkey:1',
+  'FKL-8-constructor-null-positive: all three nullable/default-free continuity columns are omitted from every constructor INSERT and no BEFORE INSERT trigger can populate them');
+select is((select string_agg(conname || ':' || insert_count, ', ' order by conname)
+  from _null_fk_insert where origin_name='_revoke_agent_principal'),
+  'fleet_revocation_events_harness_registration_id_fkey:2, fleet_revocation_events_machine_id_fkey:2, fleet_revocation_events_repo_scope_id_fkey:2, fleet_revocation_events_trust_domain_id_fkey:2',
+  'FKL-8-revoke-null-positive: every principal ledger INSERT omits all four nullable/default-free fleet links with no BEFORE INSERT trigger; real FK edges are retained');
 
 -- ===========================================================================
 -- FKL-9: THE CLASS section 9 could not compute. Every function whose lock graph
@@ -238,9 +297,15 @@ select is(
     'grant_board_role: agents(share) then memberships(update) [advisory]',
     'invite_board_member: memberships(update) then agents(key share) [unserialised]',
     'join_board: memberships(update) then agents(key share) [unserialised]',
-    'leave_board: memberships(update) then agents(key share) [unserialised]',
+    -- ROLEGUARD: the departure RPC serializes on the board key before its sink.
+    'leave_board: memberships(update) then agents(key share) [advisory]',
+    -- SIDSCHEMA role writers use the existing consent sink and board mutex.
+    -- Their installed lock order is asserted, not exempted from the class.
+    'link_session_alias: agents(update) then memberships(update) [advisory]',
+    'mint_delegated_child: agents(update) then memberships(update) [advisory]',
     'onboard_federated_fleet_agent: agents(update) then memberships(update) [advisory]',
     'post_board_message: agents(key share) then memberships(key share) [unserialised]',
+    'readmit_session_identity: agents(update) then memberships(update) [advisory]',
     'redeem_invite_link: memberships(key share) then agents(key share) [unserialised]',
     'request_join_board: memberships(update) then agents(key share) [unserialised]',
     'resolve_board_request: memberships(update) then agents(key share) [unserialised]',
@@ -252,13 +317,10 @@ select is(
     'signed_send_direct_message: agents(key share) then memberships(key share) [unserialised]',
     'signed_send_multicast_message: agents(key share) then memberships(key share) [unserialised]',
     'subscribe_callback_endpoint: memberships(key share) then agents(key share) [unserialised]',
-    -- HOSTED (20261008000100). Unserialised, and deliberately NOT given the advisory lock:
-    -- add_delegate_to_board takes the instance row and THEN the advisory lock, so a tombstone
-    -- (instance row FOR UPDATE first) taking the advisory lock after it would be the ABBA this
-    -- file exists to catch. Every row it locks belongs to the tombstoned delegate -- its agents
-    -- row, its credentials, its memberships -- which onboarding never locks.
-    'tombstone_delegate_instance: agents(update) then memberships(update) [unserialised]',
-    'update_board_membership: memberships(update) then agents(key share) [unserialised]'
+    -- SIDSCHEMA integrity repair: board mutexes precede owner/instance and family row locks,
+    -- matching add_delegate_to_board's board-before-instance order. No withdrawal exemption.
+    'tombstone_delegate_instance: agents(update) then memberships(update) [advisory]',
+    'update_board_membership: memberships(update) then agents(key share) [advisory]'
   ]::text[],
   'FKL-9: the agents+board_memberships lock class, FK edges included (section 9''s text scan sees 3 of these)');
 
@@ -267,6 +329,9 @@ select is(
 -- orders with CONFLICTING modes and no shared advisory lock. Pinned at the
 -- relation-pair level rather than the function-pair level (146 of those today)
 -- because a pair of tables entering this set is the reviewable event.
+-- SIDSCHEMA's positively proved NULL-insert filtering above removes four
+-- previously inferred fleet-machine/trust-domain pairs: PostgreSQL cannot take
+-- an FK row lock for a NULL reference. No new relation pair is exempted.
 --
 -- KNOWN-BAD and deliberately not fixed -- see the file header. ONE pair has been
 -- removed since: #281 R1 fixed `agent_board.tasks <-> agent_board.threads` by
@@ -340,14 +405,12 @@ select is(
     'agent_board.agent_signing_keys <-> agent_board.agents',
     'agent_board.agent_signing_keys <-> agent_board.board_memberships',
     'agent_board.agent_signing_keys <-> agent_board.fleet_machine_agents',
-    'agent_board.agent_signing_keys <-> agent_board.fleet_machines',
     'agent_board.agent_signing_keys <-> agent_board.fleet_trust_domains',
     'agent_board.agents <-> agent_board.board_invite_tokens',
     'agent_board.agents <-> agent_board.board_memberships',
     'agent_board.agents <-> agent_board.boards',
     'agent_board.agents <-> agent_board.enroll_token_uses',
     'agent_board.agents <-> agent_board.fleet_machine_agents',
-    'agent_board.agents <-> agent_board.fleet_machines',
     'agent_board.agents <-> agent_board.fleet_trust_domains',
     'agent_board.agents <-> agent_board.identity_providers',
     'agent_board.agents <-> auth.users',
@@ -361,8 +424,6 @@ select is(
     'agent_board.fleet_harness_registrations <-> agent_board.fleet_machine_agents',
     'agent_board.fleet_machine_agents <-> agent_board.fleet_repo_scopes',
     'agent_board.fleet_machine_agents <-> agent_board.fleet_trust_domains',
-    'agent_board.fleet_machines <-> auth.users',
-    'agent_board.fleet_trust_domains <-> auth.users',
     'agent_board.identity_providers <-> auth.users'
   ]::text[],
   'FKL-10: the relation pairs held in opposite orders with conflicting modes and no shared advisory lock');