@consiliency/agent-board-schema 1.60.0 → 1.64.0

package/tests/agent_board_session_identity_approval_revocation.test.sql

@@ -0,0 +1,334 @@
+-- Owner readmission uses real authenticated calls; pending-key proof and first
+-- claim use the existing trusted verification route, never a caller PoP flag.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+grant execute on function public.test_pubkey(text) to authenticated;
+select plan(61);
+create temp table _sid_readmit_root(root_id uuid, owner_auth uuid, root_auth uuid, board_id uuid, suffix text);
+create temp table _sid_readmit_children(label text primary key, agent_id uuid, key_id uuid, public_key text);
+create temp table _sid_readmit_result(child_agent_id uuid, grant_expires_at timestamptz, signing_key_id uuid);
+create temp table _sid_readmit_claim(epoch bigint, secret text);
+do $$
+declare v_root uuid := gen_random_uuid(); v_board uuid := gen_random_uuid(); v_owner uuid; v_auth uuid;
+begin
+  v_owner := public.ensure_github_user('sid-readmit-owner-' || v_root, 'sid-owner-' || v_root || '@example.test', 'sid-owner-' || v_root, 'SID owner');
+  v_auth := public.ensure_github_user('sid-readmit-root-' || v_root, 'sid-root-' || v_root || '@example.test', 'sid-root-' || v_root, 'SID root');
+  insert into agent_board.agents(agent_type, handle, display_name, status, auth_user_id)
+  values ('human', 'sid-owner-' || v_root, 'SID owner', 'active', v_owner);
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_root, 'agent', 'sid-root-' || v_root, 'SID root', 'active', v_auth, v_owner);
+  insert into agent_board.session_identities(agent_id, root_agent_id, depth, approved_risky_digest, current_risky_digest)
+  values (v_root, v_root, 0, 'approved', 'approved');
+  insert into agent_board.boards(id, slug, name, created_by_agent_id)
+  values (v_board, 'sid-readmit-' || v_root, 'Readmit room', v_root);
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role)
+  values (v_board, v_root, 'joined', 'owner');
+  insert into _sid_readmit_root values (v_root, v_owner, v_auth, v_board, substr(v_root::text, 1, 8));
+end;
+$$;
+grant select on _sid_readmit_root, _sid_readmit_children, _sid_readmit_result to authenticated, service_role;
+grant insert on _sid_readmit_children to service_role;
+grant insert on _sid_readmit_result to authenticated;
+grant insert on _sid_readmit_claim to service_role;
+grant select (epoch) on _sid_readmit_claim to authenticated;
+create function pg_temp.sid_readmit_mint(p_label text, p_fork text, p_role text)
+returns void language plpgsql as $$
+declare v_root uuid; v_board uuid; v_suffix text; v_fork uuid; v_public text;
+begin
+  select root_id, board_id, suffix into v_root, v_board, v_suffix from _sid_readmit_root;
+  v_fork := (select agent_id from _sid_readmit_children where label = p_fork);
+  v_public := public.test_pubkey(v_suffix || p_label);
+  insert into _sid_readmit_children
+  select p_label, m.child_agent_id, m.signing_key_id, v_public from agent_board.mint_delegated_child(
+    v_root, 'sid-readmit-' || p_label || '-' || v_suffix, '["read"]', v_public, interval '8 hours', false,
+    'claude', 'readmit-' || p_label, null,
+    jsonb_build_array(jsonb_build_object('board_id', v_board, 'role', p_role)),
+    '{"resolution":"resolved","risky_digest":"approved","recorded":{"version":"one"}}', v_fork) m;
+end;
+$$;
+create function pg_temp.sid_readmit(p_target text, p_label text, p_scopes jsonb default '["read"]', p_role text default 'observer', p_key text default null)
+returns void language plpgsql as $$
+begin
+  insert into _sid_readmit_result select * from agent_board.readmit_session_identity(
+    (select agent_id from _sid_readmit_children where label = p_target),
+    'sid-readmit-new-' || p_label || '-' || (select suffix from _sid_readmit_root),
+    coalesce(p_key, public.test_pubkey('readmit-new-' || p_label || (select suffix from _sid_readmit_root))), p_scopes,
+    jsonb_build_array(jsonb_build_object('board_id', (select board_id from _sid_readmit_root), 'role', p_role)), interval '14 days');
+end;
+$$;
+create function pg_temp.sid_readmit_refuse(p_call text)
+returns void language plpgsql as $$
+begin
+  execute p_call;
+  raise exception 'expected refusal but RPC succeeded' using errcode = 'P0001';
+end;
+$$;
+create function pg_temp.sid_readmit_proof(p_prove boolean, p_session_id text default 'readmit-fork')
+returns void language plpgsql as $$
+declare v_child record; v_challenge record;
+begin
+  select * into v_child from _sid_readmit_result;
+  select * into v_challenge from agent_board.issue_signing_key_challenge(v_child.child_agent_id, 'readmitted-ephemeral');
+  if p_prove then
+    perform * from agent_board.record_signing_key_proof_result(v_challenge.challenge_id, v_child.child_agent_id, 'readmitted-ephemeral', true);
+    select * into v_challenge from agent_board.issue_signing_key_challenge(v_child.child_agent_id, 'readmitted-ephemeral');
+  end if;
+  insert into _sid_readmit_claim
+  select m.identity_lease_epoch, m.holder_secret from agent_board.mint_fleet_agent_session(v_challenge.challenge_id,
+    split_part(v_challenge.challenge, ':', 3), v_child.signing_key_id, v_child.child_agent_id, 900, null, p_session_id) m;
+end;
+$$;
+create function pg_temp.sid_readmit_bind()
+returns void language plpgsql as $$
+declare v_child record; v_challenge record; v_epoch bigint;
+begin
+  select * into v_child from _sid_readmit_children where label = 'fork';
+  perform set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where id = v_child.agent_id), true);
+  select * into v_challenge from agent_board.issue_signing_key_challenge(v_child.agent_id, 'delegated-ephemeral');
+  select m.identity_lease_epoch into v_epoch from agent_board.mint_fleet_agent_session(v_challenge.challenge_id,
+    split_part(v_challenge.challenge, ':', 3), v_child.key_id, v_child.agent_id, 900, null, 'readmit-fork') m;
+  perform agent_board.link_session_alias(v_child.agent_id, v_epoch::text, 'readmit-fork-later');
+end;
+$$;
+grant execute on function pg_temp.sid_readmit_mint(text, text, text), pg_temp.sid_readmit_proof(boolean, text), pg_temp.sid_readmit_bind() to service_role;
+grant execute on function pg_temp.sid_readmit(text, text, jsonb, text, text), pg_temp.sid_readmit_refuse(text) to authenticated, service_role;
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sid_readmit_root), 'root_minted', '["read","write"]', 200, interval '7 days', true)$q$,
+  'EC-SIDSCHEMA-5-readmit-policy: configure the root through the sole policy writer');
+reset role;
+select is((select count(*) from agent_board.delegation_policies where root_agent_id = (select root_id from _sid_readmit_root)), 1::bigint,
+  'EC-SIDSCHEMA-5-readmit-policy-state: one current policy exists');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_readmit_mint('source', null, 'admin'); select pg_temp.sid_readmit_mint('fork', 'source', 'admin'); select pg_temp.sid_readmit_mint('second', 'source', 'observer')$q$,
+  'EC-SIDSCHEMA-5-readmit-fixtures: real mint creates a source and two related sessions');
+reset role;
+select is((select count(*) from _sid_readmit_children), 3::bigint, 'EC-SIDSCHEMA-5-readmit-fixture-state: all three principals were returned');
+select is((select count(*) from agent_board.session_identities si join _sid_readmit_children c on c.agent_id = si.agent_id
+  join agent_board.session_id_aliases a on a.id = si.lease_alias_id where a.identity_agent_id = si.agent_id and a.session_id = 'readmit-' || c.label), 3::bigint,
+  'EC-SIDSCHEMA-1-mint-reservation-pointer: every real session mint stores its specific reserved alias');
+set local role service_role;
+select lives_ok('select pg_temp.sid_readmit_bind()', 'EC-SIDSCHEMA-5-readmit-bind-control: proved holder links a new alias');
+reset role;
+select is((select a.session_id from agent_board.session_identities si join agent_board.session_id_aliases a on a.id = si.lease_alias_id
+  where si.agent_id = (select agent_id from _sid_readmit_children where label = 'fork')), 'readmit-fork-later',
+  'EC-SIDSCHEMA-5-readmit-new-binding: a new linked alias becomes the current binding');
+set local role service_role;
+select lives_ok($q$select agent_board.link_session_alias((select agent_id from _sid_readmit_children where label = 'fork'), '0', 'readmit-fork')$q$,
+  'EC-SIDSCHEMA-5-readmit-rebind-control: holder rebinds the older existing alias');
+reset role;
+select is((select a.session_id from agent_board.session_identities si join agent_board.session_id_aliases a on a.id = si.lease_alias_id
+  where si.agent_id = (select agent_id from _sid_readmit_children where label = 'fork')), 'readmit-fork',
+  'EC-SIDSCHEMA-5-readmit-last-bound: binding an existing alias updates the current binding');
+-- Creation order deliberately differs from binding order, even within one transaction.
+update agent_board.session_id_aliases set created_at = now() + interval '1 second'
+  where identity_agent_id = (select agent_id from _sid_readmit_children where label = 'fork') and session_id = 'readmit-fork-later';
+select is((select session_id from agent_board.session_id_aliases where identity_agent_id = (select agent_id from _sid_readmit_children where label = 'fork')
+  order by created_at desc, id desc limit 1), 'readmit-fork-later', 'EC-SIDSCHEMA-5-readmit-created-control: newest-created alias is not the latest binding');
+-- A removed higher-role row must not restore authority that the current row lost.
+insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_at, left_at)
+select board_id, (select agent_id from _sid_readmit_children where label = 'second'), 'removed', 'owner', now() + interval '1 second', now()
+from _sid_readmit_root;
+select is((select count(*) from agent_board.board_memberships bm where bm.agent_id = (select agent_id from _sid_readmit_children where label = 'second')
+  and ((bm.membership_state = 'removed' and bm.role = 'owner') or (bm.membership_state = 'joined' and bm.role = 'observer'))), 2::bigint,
+  'EC-SIDSCHEMA-5-readmit-history-control: a removed higher role coexists with current observer standing');
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select owner_auth::text from _sid_readmit_root), true);
+set local role authenticated;
+select lives_ok($q$select agent_board.revoke_session_identity((select agent_id from _sid_readmit_children where label = 'fork')); select agent_board.revoke_session_identity((select agent_id from _sid_readmit_children where label = 'second'))$q$,
+  'EC-SIDSCHEMA-5-readmit-revoke: human owner explicitly revokes selected forks');
+reset role;
+select is((select count(*) from agent_board.session_identities where agent_id in (select agent_id from _sid_readmit_children where label <> 'source') and tombstone_reason = 'revoked'), 2::bigint,
+  'EC-SIDSCHEMA-5-readmit-revoke-state: selected forks are tombstoned');
+insert into agent_board.fleet_revocation_events(subject_kind, subject_id, agent_id, revoked_by_agent_id, revocation_reason)
+select 'agent', a.id, a.id, a.id, 'sid-readmit-owner-ledger-control'
+from agent_board.agents a where a.auth_user_id = (select owner_auth from _sid_readmit_root);
+select is((select status from agent_board.agents where auth_user_id = (select owner_auth from _sid_readmit_root)), 'active',
+  'EC-SIDSCHEMA-5-readmit-owner-ledger-control: ledger-only revocation leaves the owner human active');
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit('fork', 'ledger-owner', '["read"]', 'admin')$q$),
+  '42501', 'fleet_revoked: readmit_session_identity is not permitted for a fleet-revoked agent',
+  'EC-SIDSCHEMA-5-readmit-owner-ledger: permanently revoked human owner cannot mint new board authority');
+reset role;
+select is((select count(*) from _sid_readmit_result), 0::bigint,
+  'EC-SIDSCHEMA-5-readmit-owner-ledger-state: late refusal rolled back the successor mint');
+delete from agent_board.fleet_revocation_events where revocation_reason = 'sid-readmit-owner-ledger-control'
+  and subject_id = (select id from agent_board.agents where auth_user_id = (select owner_auth from _sid_readmit_root));
+set local role authenticated;
+select lives_ok($q$select pg_temp.sid_readmit('fork', 'allowed', '["read"]', 'admin')$q$,
+  'EC-SIDSCHEMA-5-readmit-owner: authenticated human owner mints the selected successor');
+reset role;
+select is((select count(*) from _sid_readmit_result), 1::bigint, 'EC-SIDSCHEMA-5-readmit-result: exactly one successor is returned');
+select is((select provenance || '/' || actor_agent_id::text from agent_board.board_membership_events
+  where board_id = (select board_id from _sid_readmit_root) and agent_id = (select child_agent_id from _sid_readmit_result)
+  order by seq desc limit 1), 'board-authored/' || (select id::text from agent_board.agents where auth_user_id = (select owner_auth from _sid_readmit_root)),
+  'EC-SIDSCHEMA-5-readmit-consent: placement records the actual human owner, never the new subject consent');
+select is((select count(*) from agent_board.board_membership_events
+  where board_id = (select board_id from _sid_readmit_root) and agent_id = (select child_agent_id from _sid_readmit_result)), 1::bigint,
+  'EC-SIDSCHEMA-5-readmit-consent-once: fresh membership transition emits exactly once despite the role assignment');
+select isnt((select child_agent_id from _sid_readmit_result), (select agent_id from _sid_readmit_children where label = 'fork'),
+  'EC-SIDSCHEMA-5-readmit-fresh: readmission never revives the old principal in place');
+select is((select status from agent_board.agents where id = (select agent_id from _sid_readmit_children where label = 'fork')), 'revoked',
+  'EC-SIDSCHEMA-5-readmit-old-principal: old principal stays revoked');
+select is((select status || '/' || proof_state from agent_board.agent_signing_keys where id = (select key_id from _sid_readmit_children where label = 'fork')), 'revoked/revoked',
+  'EC-SIDSCHEMA-5-readmit-old-key: old key is never re-enabled');
+select is((select status || '/' || proof_state from agent_board.agent_signing_keys where id = (select signing_key_id from _sid_readmit_result)), 'pending_proof/unproven',
+  'EC-SIDSCHEMA-5-readmit-pending-key: new key requires the existing proof flow');
+select is((select readmitted_from from agent_board.session_identities where agent_id = (select child_agent_id from _sid_readmit_result)), (select agent_id from _sid_readmit_children where label = 'fork'),
+  'EC-SIDSCHEMA-5-readmit-linkage: successor records its predecessor');
+select is((select forked_from from agent_board.session_identities where agent_id = (select child_agent_id from _sid_readmit_result)), (select agent_id from _sid_readmit_children where label = 'source'),
+  'EC-SIDSCHEMA-5-readmit-fork: successor preserves fork ancestry');
+select ok((select holder_secret_hash is null and credential_epoch = 0 from agent_board.session_identities where agent_id = (select child_agent_id from _sid_readmit_result)),
+  'EC-SIDSCHEMA-5-readmit-unclaimed: successor is reserved but has no holder lease');
+select is((select identity_agent_id from agent_board.session_id_aliases where root_agent_id = (select root_id from _sid_readmit_root) and session_id = 'readmit-fork'), (select child_agent_id from _sid_readmit_result),
+  'EC-SIDSCHEMA-5-readmit-alias: predecessor alias resolves to its successor');
+select is((select a.session_id from agent_board.session_identities si join agent_board.session_id_aliases a on a.id = si.lease_alias_id
+  where si.agent_id = (select child_agent_id from _sid_readmit_result)), 'readmit-fork',
+  'EC-SIDSCHEMA-5-readmit-reserved: successor reserves the most recently bound alias, not the newest-created row');
+select is((select count(*) from agent_board.session_id_aliases where identity_agent_id = (select child_agent_id from _sid_readmit_result)), 2::bigint,
+  'EC-SIDSCHEMA-5-readmit-all-aliases: all predecessor aliases resolve to the new principal');
+select is((select grant_expires_at from _sid_readmit_result), now() + interval '24 hours',
+  'EC-SIDSCHEMA-5-readmit-ttl: unapproved fresh context is never awarded seven days');
+select ok((select count(*) > 0 from agent_board.fleet_revocation_events where subject_id = (select agent_id from _sid_readmit_children where label = 'fork')),
+  'EC-SIDSCHEMA-5-readmit-ledger: permanent old revocation ledger remains');
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select agent_board.approve_identity_state((select child_agent_id from _sid_readmit_result), 'approved', '{"resolution":"resolved"}')$q$,
+  'EC-SIDSCHEMA-5-readmit-approve: trusted fresh reading preserves the verified human owner approval actor');
+reset role;
+select is((select resolution_state from agent_board.session_identities where agent_id = (select child_agent_id from _sid_readmit_result)), 'active',
+  'EC-SIDSCHEMA-5-readmit-approval-state: fresh approval is stored');
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit_proof(false)$q$),
+  '42501', 'key_unproven: session key requires proof', 'EC-SIDSCHEMA-5-readmit-unproved: pending key cannot claim a lease');
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit_proof(true, 'readmit-fork-later')$q$),
+  '42501', 'identity_continuity_refused', 'EC-SIDSCHEMA-1-readmit-first-reserved: another repointed historical alias cannot win first claim');
+reset role;
+select ok((select holder_secret_hash is null and credential_epoch = 0 from agent_board.session_identities where agent_id = (select child_agent_id from _sid_readmit_result)),
+  'EC-SIDSCHEMA-1-readmit-first-refusal-state: refused historical-alias claim leaves the reservation unclaimed');
+set local role service_role;
+select lives_ok('select pg_temp.sid_readmit_proof(true)', 'EC-SIDSCHEMA-5-readmit-proof: existing challenge/proof route permits first claim');
+reset role;
+select is((select count(*) from _sid_readmit_claim where epoch = 0 and length(secret) = 64), 1::bigint,
+  'EC-SIDSCHEMA-5-readmit-claim-state: proved key claims its reserved alias once');
+-- Exercise the returned principal directly as well as through its new credential.
+-- Reviving the predecessor in place reaches the unchanged permanent ledger here
+-- and refuses fleet_revoked, rather than merely failing old-credential resolution.
+set local role service_role;
+select lives_ok($q$select agent_board.grant_board_role((select board_id from _sid_readmit_root), (select child_agent_id from _sid_readmit_result), 'admin', (select child_agent_id from _sid_readmit_result))$q$,
+  'EC-SIDSCHEMA-5-readmit-new-principal-authority: the returned fresh principal passes the unchanged permanent-ledger authority gate');
+reset role;
+select is((select role from agent_board.board_memberships where agent_id = (select child_agent_id from _sid_readmit_result) and board_id = (select board_id from _sid_readmit_root)), 'admin',
+  'EC-SIDSCHEMA-5-readmit-new-principal-state: explicit fresh-principal authority preserves the bounded admin role');
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where id = (select child_agent_id from _sid_readmit_result)), true);
+select set_config('request.jwt.claim.identity_lease_epoch', (select epoch::text from _sid_readmit_claim), true);
+set local role authenticated;
+select lives_ok($q$select agent_board.grant_board_role((select board_id from _sid_readmit_root), (select child_agent_id from _sid_readmit_result), 'observer', null)$q$,
+  'EC-SIDSCHEMA-5-readmit-authority: readmitted principal can exercise board authority');
+reset role;
+select is((select role from agent_board.board_memberships where agent_id = (select child_agent_id from _sid_readmit_result) and board_id = (select board_id from _sid_readmit_root)), 'observer',
+  'EC-SIDSCHEMA-5-readmit-authority-state: board authority uses the fresh principal');
+select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where id = (select agent_id from _sid_readmit_children where label = 'fork')), true);
+set local role authenticated;
+select is(agent_board.current_agent_id(), null::uuid, 'EC-SIDSCHEMA-5-readmit-old-resolver: revoked old credential cannot resolve');
+reset role;
+-- The revoked principal cannot resolve as authenticated. Enter the permanent
+-- ledger gate through the existing service forwarder's explicit grantor path.
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select agent_board.grant_board_role((select board_id from _sid_readmit_root), (select agent_id from _sid_readmit_children where label = 'fork'), 'observer', (select agent_id from _sid_readmit_children where label = 'fork'))$q$),
+  '42501', 'fleet_revoked: grant_board_role is not permitted for a fleet-revoked agent', 'EC-SIDSCHEMA-5-readmit-old-fleet: old principal still reports permanent fleet_revoked');
+reset role;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select owner_auth::text from _sid_readmit_root), true);
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit('fork', 'again')$q$),
+  '42501', 'identity_already_readmitted', 'EC-SIDSCHEMA-5-readmit-once: a predecessor cannot have a second successor');
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit('second', 'widen-scopes', '["read","write"]')$q$),
+  '42501', 'scope_exceeded: readmission cannot widen original or parent scopes', 'EC-SIDSCHEMA-5-readmit-scope-bound: widened parent cannot re-grant lost scopes');
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit('second', 'widen-role', '["read"]', 'admin')$q$),
+  '42501', 'room_authority_exceeded', 'EC-SIDSCHEMA-5-readmit-role-bound: widened parent cannot re-grant lost roles');
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit('second', 'old-key', '["read"]', 'observer', (select public_key from _sid_readmit_children where label = 'second'))$q$),
+  '42501', 'readmission cannot reuse the revoked key', 'EC-SIDSCHEMA-5-readmit-key-fresh: old signing key cannot be reused');
+reset role;
+update agent_board.session_identities set resolution_state = 'frozen' where agent_id = (select root_id from _sid_readmit_root);
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit('second', 'frozen-ancestor')$q$),
+  '42501', 'identity_fingerprint_unapproved', 'EC-SIDSCHEMA-5-readmit-ancestor: readmission inherits the ancestor freeze gate');
+reset role;
+update agent_board.session_identities set resolution_state = 'active' where agent_id = (select root_id from _sid_readmit_root);
+update agent_board.agents set status = 'suspended' where id = (select root_id from _sid_readmit_root);
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit('second', 'inactive-parent')$q$),
+  '42501', 'identity_parent_inactive', 'EC-SIDSCHEMA-5-readmit-parent: original parent must still be active');
+reset role;
+update agent_board.agents set status = 'active' where id = (select root_id from _sid_readmit_root);
+update agent_board.session_identities set tombstone_reason = 'superseded_unclaimed' where agent_id = (select agent_id from _sid_readmit_children where label = 'second');
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit('second', 'superseded')$q$),
+  '42501', 'identity readmission requires a revoked fork', 'EC-SIDSCHEMA-5-readmit-superseded: superseded unclaimed identity cannot be readmitted');
+reset role;
+select is((select count(*) from agent_board.session_identities where readmitted_from in (select agent_id from _sid_readmit_children)), 1::bigint,
+  'EC-SIDSCHEMA-5-readmit-refusal-state: refused readmissions leave no extra successors');
+select is((select count(*) from agent_board.delegation_grants where root_agent_id = (select root_id from _sid_readmit_root)), 4::bigint,
+  'EC-SIDSCHEMA-5-readmit-count: readmission adds a real mint to hourly accounting');
+-- Historical legacy grants put the mixed active total exactly at 200. Their
+-- timestamps are outside the rolling hour; source/fork reservations stay hourly-only.
+create temp table _sid_readmit_limit_ids(agent_id uuid);
+insert into _sid_readmit_limit_ids select gen_random_uuid() from generate_series(1, 199);
+insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id, parent_agent_id, root_agent_id)
+select q.agent_id, 'agent', 'sid-readmit-limit-' || q.agent_id, 'Limit fixture', 'active', r.owner_auth, r.root_id, r.root_id
+from _sid_readmit_limit_ids q cross join _sid_readmit_root r;
+insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth)
+select q.agent_id, r.root_id, r.root_id, 1 from _sid_readmit_limit_ids q cross join _sid_readmit_root r;
+insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id, granted_scopes, grant_expires_at, created_at)
+select q.agent_id, r.root_id, r.root_id, dp.id, '[]'::jsonb, now() + interval '1 hour', now() - interval '2 hours'
+from _sid_readmit_limit_ids q cross join _sid_readmit_root r join agent_board.delegation_policies dp on dp.root_agent_id = r.root_id;
+update agent_board.session_identities set tombstone_reason = 'revoked' where agent_id = (select agent_id from _sid_readmit_children where label = 'second');
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', $q$select pg_temp.sid_readmit('second', 'active-cap')$q$),
+  '42501', 'identity_limit_active_exceeded', 'EC-SIDSCHEMA-5-readmit-active-limit: readmission recounts mixed legacy/session active authority');
+reset role;
+update agent_board.agents set status = 'suspended' where id in (select agent_id from _sid_readmit_limit_ids);
+create temp table _sid_readmit_cycle(agent_id uuid);
+insert into _sid_readmit_cycle select agent_id from _sid_readmit_children where label = 'second';
+grant select, update on _sid_readmit_cycle to authenticated;
+create function pg_temp.sid_readmit_cycles(p_count int)
+returns void language plpgsql as $$
+declare v_old uuid; v_new record; v_slug text; i int;
+begin
+  for i in 1..p_count loop
+    select agent_id into v_old from _sid_readmit_cycle;
+    v_slug := 'sid-cycle-' || gen_random_uuid();
+    select * into v_new from agent_board.readmit_session_identity(v_old, v_slug, public.test_pubkey(v_slug));
+    perform agent_board.revoke_session_identity(v_new.child_agent_id);
+    update _sid_readmit_cycle set agent_id = v_new.child_agent_id;
+  end loop;
+end;
+$$;
+grant execute on function pg_temp.sid_readmit_cycles(int) to authenticated;
+set local role authenticated;
+select lives_ok('select pg_temp.sid_readmit_cycles(56)', 'EC-SIDSCHEMA-5-readmit-cycles: revoke/readmit cycles enter the real owner mint path up to the hourly boundary');
+reset role;
+select is((select count(*) from agent_board.session_identities where root_agent_id = (select root_id from _sid_readmit_root) and readmitted_from is not null), 57::bigint,
+  'EC-SIDSCHEMA-5-readmit-cycles-state: every allowed cycle creates a distinct successor');
+set local role authenticated;
+select throws_ok(format('select pg_temp.sid_readmit_refuse(%L)', 'select pg_temp.sid_readmit_cycles(1)'),
+  '42501', 'identity_limit_hourly_exceeded', 'EC-SIDSCHEMA-5-readmit-hourly-limit: repeated real revoke/readmit cycles hit the named rolling-hour limit');
+reset role;
+select is((select count(*) from agent_board.delegation_grants where root_agent_id = (select root_id from _sid_readmit_root) and created_at > now() - interval '3600 seconds'), 60::bigint,
+  'EC-SIDSCHEMA-5-readmit-hourly-state: tombstoned readmission mints remain in the hourly census');
+update agent_board.delegation_grants set created_at = now() - interval '2 hours' where root_agent_id = (select root_id from _sid_readmit_root);
+update agent_board.delegation_policies set operator_child_ttl_ceiling = interval '30 minutes' where root_agent_id = (select root_id from _sid_readmit_root);
+set local role authenticated;
+select lives_ok('select pg_temp.sid_readmit_cycles(1)',
+  'EC-SIDSCHEMA-4-readmit-operator-control: real owner readmission enters the newly tightened operator policy');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_readmit_cycle)), now() + interval '30 minutes',
+  'EC-SIDSCHEMA-4-readmit-operator: readmission never bypasses the durable operator TTL');
+select finish();
+rollback;

package/tests/agent_board_session_identity_backfill.test.sql

@@ -0,0 +1,82 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+select plan(15);
+
+select is(
+  (select identity_kind from agent_board.session_identities
+    where agent_id = '61100000-0000-0000-0000-000000000001'),
+  'legacy',
+  'EC-SIDSCHEMA-1: pre-migration root is represented as a legacy identity'
+);
+select is(
+  (select depth from agent_board.session_identities
+    where agent_id = '61100000-0000-0000-0000-000000000001'),
+  0::smallint,
+  'EC-SIDSCHEMA-1: pre-migration unparented root remains depth zero'
+);
+select is(
+  (select root_agent_id from agent_board.session_identities
+    where agent_id = '61100000-0000-0000-0000-000000000001'),
+  '61100000-0000-0000-0000-000000000001'::uuid,
+  'EC-SIDSCHEMA-1: null legacy root is normalized to itself'
+);
+select is(
+  (select parent_agent_id from agent_board.session_identities
+    where agent_id = '61100000-0000-0000-0000-000000000002'),
+  '61100000-0000-0000-0000-000000000001'::uuid,
+  'EC-SIDSCHEMA-1: legacy child parent is preserved exactly'
+);
+select is(
+  (select root_agent_id from agent_board.session_identities
+    where agent_id = '61100000-0000-0000-0000-000000000002'),
+  '61100000-0000-0000-0000-000000000001'::uuid,
+  'EC-SIDSCHEMA-1: legacy child root is preserved exactly'
+);
+select is(
+  (select depth from agent_board.session_identities
+    where agent_id = '61100000-0000-0000-0000-000000000002'),
+  1::smallint,
+  'EC-SIDSCHEMA-1: pre-migration parented child is depth one'
+);
+select is(
+  (select count(*)::int from agent_board.session_identities
+    where agent_id in (
+      '61100000-0000-0000-0000-000000000001'::uuid,
+      '61100000-0000-0000-0000-000000000002'::uuid
+    )),
+  2,
+  'EC-SIDSCHEMA-1: every seeded pre-migration principal is backfilled exactly once'
+);
+
+select is(
+  (select depth from agent_board.session_identities where agent_id = '61100000-0000-0000-0000-000000000003'),
+  2::smallint, 'EC-SIDSCHEMA-1-backfill-grandchild: recursive backfill preserves depth two');
+select is(
+  (select root_agent_id from agent_board.session_identities where agent_id = '61100000-0000-0000-0000-000000000003'),
+  '61100000-0000-0000-0000-000000000001'::uuid,
+  'EC-SIDSCHEMA-1-backfill-root: recursive backfill uses the true lineage root');
+select is((select owner_user_id from agent_board.agents where id='61100000-0000-0000-0000-000000000001'),
+  '61100000-0000-0000-0000-000000000010'::uuid,
+  'EC-SIDSCHEMA-1-backfill-owner: migration preserves the existing human owner exactly');
+select ok((select created_at='2026-01-01 00:00:00+00'::timestamptz and metadata='{"sid_backfill":"historical"}'::jsonb
+  from agent_board.agents where id='61100000-0000-0000-0000-000000000001'),
+  'EC-SIDSCHEMA-1-backfill-agent-history: original principal creation time and metadata remain unchanged');
+select ok((select public_key=public.test_pubkey('sid-historical-backfill')
+  and fingerprint=agent_board._raw_key_fingerprint(public.test_pubkey('sid-historical-backfill'))
+  and status='pending_proof' and proof_state='unproven' and created_at='2026-01-01 00:00:00+00'::timestamptz
+  and metadata='{"sid_backfill":"historical-key"}'::jsonb from agent_board.agent_signing_keys
+  where id='61100000-0000-0000-0000-000000000011'),
+  'EC-SIDSCHEMA-1-backfill-key: original signing key, proof state and history are preserved byte-for-byte');
+select ok((select result_state='joined' and provenance='operator-designated' and actor_agent_id is null
+  and created_at='2026-01-01 00:00:00+00'::timestamptz from agent_board.board_membership_events
+  where id='61100000-0000-0000-0000-000000000013'),
+  'EC-SIDSCHEMA-1-backfill-consent-history: the original append-only placement event and provenance remain unchanged');
+select is((select count(*) from agent_board.board_membership_events where board_id='61100000-0000-0000-0000-000000000012'),
+  1::bigint,'EC-SIDSCHEMA-1-backfill-history-count: backfill does not synthesize consent or duplicate historical events');
+select is((select count(*) from agent_board.session_identities where root_agent_id='61100000-0000-0000-0000-000000000001'
+  and identity_kind='legacy' and approved_risky_digest is null and holder_secret_hash is null and lease_alias_id is null),
+  3::bigint,'EC-SIDSCHEMA-1-backfill-no-implicit-approval: all legacy lineage rows remain unapproved and lease-free');
+select * from finish();
+rollback;

package/tests/agent_board_session_identity_backfill_refusal.test.sql

@@ -0,0 +1,14 @@
+-- Re-run the SHIPPED backfill block against a mismatch on every CI pgTAP run.
+-- psql reads local migration bytes; no server file access or copied SQL body.
+\set sid_backfill_source `node -e 'process.stdout.write(require("fs").readFileSync("packages/agent-board-schema/migrations/20261011000100_agent_board_session_identities.sql").toString("base64"))'`
+set search_path=extensions,public,agent_board;
+begin;
+select plan(1);
+update agent_board.agents set root_agent_id='61100000-0000-0000-0000-000000000002'
+where id='61100000-0000-0000-0000-000000000003';
+select throws_ok(coalesce(nullif(current_setting('agent_board_test.pending_migration',true),''),
+  'do $$'||split_part(split_part(convert_from(decode(:'sid_backfill_source','base64'),'UTF8'),'do $$',2),'$$;',1)||'$$;'),
+  '23514','session identity backfill lineage mismatch: agent 61100000-0000-0000-0000-000000000003, stored root 61100000-0000-0000-0000-000000000002, computed root 61100000-0000-0000-0000-000000000001',
+  'R2-N2-5-backfill-ci: shipped backfill refuses the mismatch and names the agent, stored root and computed root');
+select finish();
+rollback;

package/tests/agent_board_session_identity_behavior_classes.test.sql

@@ -0,0 +1,176 @@
+-- Literal-SQL class closure, including private writers and their callers.
+-- Dynamic SQL, variable callees and Edge signers are outside this SQL scanner;
+-- the Edge wiring is asserted separately against its actual source files.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(23);
+create temp view _sid_behavior_fns as
+select p.oid,p.proname,agent_board_test.stripped_body(p.oid) as body,
+  agent_board_test.stripped_body(p.oid,true) as literals
+from pg_proc p where p.pronamespace='agent_board'::regnamespace and p.prokind='f';
+create temp view _sid_behavior_writers as
+select * from _sid_behavior_fns f where f.body ~ agent_board_test.re(
+  agent_board_test.write_frag('session_identities',agent_board_test.bare_ok(f.oid)) || '|'
+  || agent_board_test.write_frag('session_id_aliases',agent_board_test.bare_ok(f.oid)));
+select is((select string_agg(proname,', ' order by proname) from _sid_behavior_writers),
+  '_revoke_agent_principal, _session_identity_agent_lineage, approve_identity_state, heartbeat_session_identity, link_session_alias, mint_delegated_child, mint_fleet_agent_session, readmit_session_identity, record_session_identity_state, renew_session_identity',
+  'EC-SIDSCHEMA-5-protected-population: every catalog-derived identity/alias writer has a gate or a positively proved lifecycle exemption');
+create temp view _sid_behavior_unguarded as
+select w.* from _sid_behavior_writers w
+where w.proname not in ('_revoke_agent_principal','_session_identity_agent_lineage','approve_identity_state',
+  'readmit_session_identity','record_session_identity_state')
+and not exists (select 1 from agent_board_test.fn_call_closure() c join _sid_behavior_fns g on g.oid=c.reached_oid
+  where c.root_oid=w.oid and g.literals ~ agent_board_test.re(
+    agent_board_test.ident_re('resolution_state') || '\s*=\s*''frozen''')
+    and g.literals ~ agent_board_test.re(agent_board_test.ci_re('raise exception') || '\s+''identity_fingerprint_unapproved'));
+create temp view _sid_behavior_unsafe as
+select distinct c.root_name from agent_board_test.fn_call_closure() c
+join _sid_behavior_unguarded u on u.oid=c.reached_oid;
+select is((select coalesce(string_agg(root_name,', ' order by root_name),'') from _sid_behavior_unsafe),'',
+  'EC-SIDSCHEMA-5-protected-class: every discovered protected writer/caller reaches an executable frozen-state refusal');
+-- Each exempt lifecycle writer positively names the actual state it writes.
+select ok(agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure)
+  ~ agent_board_test.col_write_re('session_identities','tombstoned_at')
+  and agent_board_test.stripped_body('agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure)
+  ~ agent_board_test.col_write_re('session_identities','credential_epoch'),
+  'EC-SIDSCHEMA-5-exempt-revoke: authorized revocation writes tombstones and epoch fences even while frozen; seven real entrypoints check its resulting closure');
+select ok(agent_board_test.stripped_body('agent_board._session_identity_agent_lineage()'::regprocedure)
+  ~ agent_board_test.col_write_re('session_identities','agent_id')
+  and agent_board_test.stripped_body('agent_board._session_identity_agent_lineage()'::regprocedure,true)
+  like '%tg_op = ''INSERT'' and v_node.id = new.id%',
+  'EC-SIDSCHEMA-1-exempt-constructor: the lineage trigger writes only a fresh legacy identity on an agents INSERT; real registration proves null lease and approval');
+select ok(agent_board_test.stripped_body('agent_board.approve_identity_state(uuid,text,jsonb)'::regprocedure)
+  ~ agent_board_test.col_write_re('session_identities','approved_risky_digest')
+  and agent_board_test.stripped_body('agent_board.approve_identity_state(uuid,text,jsonb)'::regprocedure)
+  ~ agent_board_test.call_re('_session_identity_owner'),
+  'EC-SIDSCHEMA-5-exempt-approval: explicit approval writes the approved digest through the human-owner/strict-ancestor gate, not an implicit renewal');
+select ok(agent_board_test.stripped_body('agent_board.record_session_identity_state(uuid,jsonb)'::regprocedure)
+  ~ agent_board_test.col_write_re('session_identities','resolution_state')
+  and agent_board_test.stripped_body('agent_board.record_session_identity_state(uuid,jsonb)'::regprocedure,true)
+  like '%v_identity.resolution_state = ''frozen'' then ''frozen''%',
+  'EC-SIDSCHEMA-5-exempt-recording: measured recording writes persistent freeze and preserves an existing freeze; risky and recorded-only calls have separate state checks');
+select ok(agent_board_test.stripped_body('agent_board.readmit_session_identity(uuid,text,text,jsonb,jsonb,interval)'::regprocedure)
+  ~ agent_board_test.col_write_re('session_identities','readmitted_from')
+  and agent_board_test.stripped_body('agent_board.readmit_session_identity(uuid,text,text,jsonb,jsonb,interval)'::regprocedure,true)
+  like '%p_identity_agent_id, v_old.current_risky_digest, v_old.recorded_fingerprint, ''frozen''%',
+  'EC-SIDSCHEMA-5-exempt-readmission: owner readmission writes a fresh frozen successor with provenance; the old principal and ledger remain revoked');
+
+create temp view _sid_behavior_issuers as
+select * from _sid_behavior_fns f where f.body ~ agent_board_test.re(
+  agent_board_test.stmt_frag('insert into','nonfleet_sessions',agent_board_test.bare_ok(f.oid)) || '|'
+  || agent_board_test.stmt_frag('insert into','agent_credentials',agent_board_test.bare_ok(f.oid)));
+select is((select string_agg(proname,', ' order by proname) from _sid_behavior_issuers),
+  '_issue_agent_credential, _mint_fleet_agent_session_legacy, exchange_delegate_credential',
+  'EC-SIDSCHEMA-4-issuer-population: every catalog-discovered credential issuer has a bounded session path or a positively proved enrollment exemption');
+select is((select coalesce(string_agg(c.root_name,', ' order by c.root_name),'')
+  from agent_board_test.fn_call_closure() c
+  where c.reached_oid='agent_board._mint_fleet_agent_session_legacy(uuid,text,uuid,uuid,integer)'::regprocedure
+    and c.root_oid<>c.reached_oid and c.root_name<>'mint_fleet_agent_session'),'',
+  'EC-SIDSCHEMA-4-issuer-wrapper-class: only the gated fleet session mint reaches the private legacy token issuer; a new bypass wrapper names itself');
+select ok(not has_function_privilege('service_role',
+  'agent_board._mint_fleet_agent_session_legacy(uuid,text,uuid,uuid,integer)','EXECUTE')
+  and has_function_privilege('service_role','agent_board.mint_fleet_agent_session(uuid,text,uuid,uuid,integer,text,text)','EXECUTE'),
+  'EC-SIDSCHEMA-4-issuer-private-positive: service must enter the gated mint, never the renamed private implementation');
+select ok(agent_board_test.stripped_body('agent_board._issue_agent_credential(uuid,text,uuid,jsonb)'::regprocedure,true)
+  like '%jsonb_build_object(''credential_role'', ''enrollment'')%',
+  'EC-SIDSCHEMA-4-enrollment-positive: the legacy issuer writes enrollment-only metadata, not a session-exchange credential');
+select throws_ok($$select agent_board.rotate_agent_token('61100000-0000-0000-0000-000000000001')$$,
+  '0A000',null,'EC-SIDSCHEMA-4-enrollment-retired: the real legacy session-exchange path refuses enrollment refresh records');
+select ok(agent_board_test.stripped_body('agent_board.exchange_delegate_credential(jsonb)'::regprocedure,true)
+  like '%v_expires := now() + interval ''900 seconds''%'
+  and pg_get_function_result('agent_board.exchange_delegate_credential(jsonb)'::regprocedure)=
+    'TABLE(agent_id uuid, auth_user_id uuid, credential_id uuid, expires_at timestamp with time zone)',
+  'EC-SIDSCHEMA-4-hosted-positive: hosted exchange writes a 900-second credential and returns its principal/id/expiry, never a holder secret or session identity');
+
+-- A principal resolver returns a UUID and directly maps auth.uid through agents.
+-- Named callers join through the same literal-SQL call graph; no resolver is
+-- exempt from fencing. Row-returning RPCs and dynamically chosen callees are
+-- not principal resolvers in this bounded scanner.
+create temp view _sid_behavior_resolvers as
+select * from _sid_behavior_fns f where pg_get_function_result(f.oid)='uuid'
+  and f.body ~ agent_board_test.call_re('auth.uid',false)
+  and f.body ~ agent_board_test.re(agent_board_test.qname_frag('agents',agent_board_test.bare_ok(f.oid)));
+create temp view _sid_behavior_unsafe_resolvers as
+select distinct c.root_name from agent_board_test.fn_call_closure() c
+join _sid_behavior_resolvers r on r.oid=c.reached_oid
+where not (r.body ~ agent_board_test.re(agent_board_test.qname_frag('session_identities',agent_board_test.bare_ok(r.oid)))
+  and r.literals like '%request.jwt.claim.identity_lease_epoch%'
+  and r.literals like '%request.jwt.claims%'
+  and r.literals like '%identity_kind is distinct from ''session'' or c.lease_epoch = si.credential_epoch::text%');
+select is((select string_agg(proname,', ' order by proname) from _sid_behavior_resolvers),
+  'current_agent_id','EC-SIDSCHEMA-1-resolver-population: every catalog-discovered direct principal resolver is positively pinned');
+select is((select coalesce(string_agg(root_name,', ' order by root_name),'') from _sid_behavior_unsafe_resolvers),'',
+  'EC-SIDSCHEMA-1-resolver-class: every direct principal resolver and named caller reaches the current session epoch fence from both JWT claim forms');
+
+create temp view _sid_behavior_revokers as
+select * from _sid_behavior_fns f where
+  (f.body ~ agent_board_test.re(agent_board_test.col_assign_frag('agents','status',agent_board_test.bare_ok(f.oid)))
+    and f.literals like '%''revoked''%')
+  or f.body ~ agent_board_test.stmt_re('insert into','fleet_revocation_events',agent_board_test.bare_ok(f.oid));
+create temp view _sid_behavior_unsafe_revokers as
+select * from _sid_behavior_revokers r where not exists (
+  select 1 from agent_board_test.fn_call_closure() c where c.root_oid=r.oid
+    and c.reached_oid='agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure);
+select is((select string_agg(proname,', ' order by proname) from _sid_behavior_revokers),
+  '_revoke_agent_principal, revoke_agent, revoke_fleet_subject, tombstone_delegate_instance',
+  'EC-SIDSCHEMA-5-revoke-population: every catalog-derived principal status/ledger revoker is in the positively exercised revocation class');
+select is((select coalesce(string_agg(proname,', ' order by proname),'') from _sid_behavior_unsafe_revokers),'',
+  'EC-SIDSCHEMA-5-revoke-class: every principal revocation entrypoint reaches the shared identity fork/descendant tombstone and credential closure');
+select is((select string_agg(distinct root_name,', ' order by root_name) from agent_board_test.fn_call_closure()
+  where reached_oid='agent_board._revoke_agent_principal(uuid,uuid,text)'::regprocedure
+    and root_name in ('_revoke_agent_principal','revoke_agent_subtree','revoke_human_subtree',
+      'revoke_fleet_subject','revoke_agent','revoke_session_identity','tombstone_delegate_instance')),
+  '_revoke_agent_principal, revoke_agent, revoke_agent_subtree, revoke_fleet_subject, revoke_human_subtree, revoke_session_identity, tombstone_delegate_instance',
+  'EC-SIDSCHEMA-5-revoke-routes-positive: all seven independently exercised real routes reach the shared write-through; none is merely absent from a violation list');
+
+-- New unsafe sites and delegating wrappers must join the classes by effect,
+-- even with uppercase SQL, comments containing decoy gates and no public ACL.
+create function agent_board.sid_behavior_unsafe_writer(p_identity uuid)
+returns void language sql security definer set search_path='' as $probe$
+  /* resolution_state = 'frozen'; raise exception 'identity_fingerprint_unapproved'; */
+  UPDATE agent_board.session_identities SET last_heartbeat=now() WHERE agent_id=p_identity;
+$probe$;
+create function agent_board.sid_behavior_unsafe_wrapper(p_identity uuid)
+returns void language sql security definer set search_path='' as $probe$
+  SELECT agent_board.sid_behavior_unsafe_writer(/* no direct write */ p_identity);
+$probe$;
+select is((select string_agg(root_name,', ' order by root_name) from _sid_behavior_unsafe
+  where root_name in ('sid_behavior_unsafe_wrapper','sid_behavior_unsafe_writer')),
+  'sid_behavior_unsafe_wrapper, sid_behavior_unsafe_writer',
+  'EC-SIDSCHEMA-5-protected-canary: an unsafe uppercase writer and commented wrapper both name themselves; comment gates do not count');
+create function agent_board.sid_behavior_unsafe_issuer(p_agent uuid)
+returns void language sql security definer set search_path='' as $probe$
+  INSERT INTO agent_board.nonfleet_sessions(id,session_id,identity_class,agent_id,max_ttl_seconds,issued_at,expires_at)
+  VALUES ('unsafe','unsafe','fleet_agent_session',p_agent,900,now(),now()+interval '100 days');
+$probe$;
+select is((select proname from _sid_behavior_issuers where proname='sid_behavior_unsafe_issuer'),
+  'sid_behavior_unsafe_issuer','EC-SIDSCHEMA-4-issuer-canary: a new unsafe credential INSERT names itself in the catalog-derived issuer population');
+create function agent_board.sid_behavior_private_bypass(p_challenge uuid,p_key uuid,p_agent uuid)
+returns void language sql security definer set search_path='' as $probe$
+  SELECT agent_board._mint_fleet_agent_session_legacy(p_challenge,'nonce',p_key,p_agent,900);
+$probe$;
+select is((select root_name from agent_board_test.fn_call_closure() where root_name='sid_behavior_private_bypass'
+  and reached_oid='agent_board._mint_fleet_agent_session_legacy(uuid,text,uuid,uuid,integer)'::regprocedure),
+  'sid_behavior_private_bypass','EC-SIDSCHEMA-4-issuer-bypass-canary: a new private-issuer wrapper is detected rather than exempted by its own absence of DML');
+create function agent_board.sid_behavior_unsafe_revoker(p_agent uuid)
+returns void language sql security definer set search_path='' as $probe$
+  UPDATE agent_board.agents SET status='revoked' WHERE id=p_agent;
+$probe$;
+select is((select proname from _sid_behavior_unsafe_revokers where proname='sid_behavior_unsafe_revoker'),
+  'sid_behavior_unsafe_revoker','EC-SIDSCHEMA-5-revoke-canary: a new principal revoker without identity write-through names itself in the catalog-derived class');
+create function agent_board.sid_behavior_unsafe_resolver()
+returns uuid language sql security definer set search_path='' as $probe$
+  /* session_identities; identity_lease_epoch; credential_epoch are not a gate. */
+  SELECT a.id FROM agent_board.agents a WHERE a.auth_user_id=auth.uid() LIMIT 1;
+$probe$;
+create function agent_board.sid_behavior_resolver_wrapper()
+returns uuid language sql security definer set search_path='' as $probe$
+  SELECT agent_board.sid_behavior_unsafe_resolver();
+$probe$;
+select is((select string_agg(root_name,', ' order by root_name) from _sid_behavior_unsafe_resolvers
+  where root_name in ('sid_behavior_resolver_wrapper','sid_behavior_unsafe_resolver')),
+  'sid_behavior_resolver_wrapper, sid_behavior_unsafe_resolver',
+  'EC-SIDSCHEMA-1-resolver-canary: an uppercase auth resolver and its named wrapper both join the unsafe class; comment decoys do not fence credentials');
+select finish();
+rollback;