@consiliency/agent-board-schema 1.63.0 → 1.64.0

package/README.md

@@ -7,6 +7,12 @@ and materialize it — they do not author `agent_board` DDL.
 
 ## What's in the bundle
 
+Schema 1.64.0 adds `20261014000200_agent_board_last_owner.sql`: a refusal-only
+table-level last-active-owner invariant, preserving the 1.63.0 role-grant policy.
+Concurrent departures serialize per board; recovery remains service_role-only.
+SQL schema version remains 8. See `specs/rpc-contracts.md` for refusal/retry
+semantics. This is the working-tree contract, not a deployment receipt.
+
 - `migrations/` — the ordered, immutable SQL union (frozen baseline + lane
   migrations + the Message Board-owned endpoint compatibility migration).
 - `schema-manifest.json` — package version, `agent_board.schema_version`, ordered

package/fixtures/already-applied.json

@@ -644,6 +644,10 @@
   {
    "id": "20261014000100_agent_board_grant_target_role",
    "sha256": "4a6c00546a1d2837f88eece1de082cc76eec1f85cce8cf9ac7998e42bf32a5c5"
+  },
+  {
+   "id": "20261014000200_agent_board_last_owner",
+   "sha256": "2fed8fc5a2c7c0ba9acbb12872b329db3f0902d96597c52cc50e21e4682c2fff"
   }
  ]
 }

package/migrations/20261014000200_agent_board_last_owner.sql

@@ -0,0 +1,239 @@
+-- Consiliency/message-board#675: row-level last-active-owner invariant, schema 1.64.0.
+-- Main's grant_board_role body, ACL and COMMENT remain unchanged (schema 1.63.0).
+-- The trigger is refusal-only: it never assigns NEW or clamps a role. The
+-- 20260802000100 / 20260803000100 prohibition concerns a role-changing clamp
+-- that would erase intentional owner/admin seeds; this UPDATE/DELETE guard
+-- leaves all allowed writes and INSERT seeders unchanged.
+
+CREATE OR REPLACE FUNCTION agent_board.update_board_membership(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, left_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_membership agent_board.board_memberships%rowtype;
+  v_board agent_board.boards%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+  v_is_service boolean := agent_board._is_service_role();
+  v_existing_state text;
+  v_target_role text;
+  v_actor_role text;
+  -- HOSTED (D7): the caller is the target hosted delegate's principal asking for `left`.
+  v_principal_withdraw boolean;
+begin
+  if v_actor is null and not v_is_service then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  -- Board authority lock first, before the target row and the sink's FK locks.
+  perform agent_board._lock_board_authority_ceiling(p_board_id);
+
+  v_principal_withdraw := not v_is_service
+    and v_actor <> p_agent_id
+    and p_membership_state = 'left'
+    and v_actor = agent_board._delegate_principal_agent_id(p_agent_id);
+
+  if not v_is_service and v_actor <> p_agent_id and not v_principal_withdraw then
+    select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+    if v_board.id is null then
+      raise exception 'board not found' using errcode = 'P0002';
+    end if;
+    select bm.role
+      into v_actor_role
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = v_actor
+       and bm.membership_state in ('joined', 'subscribed')
+     limit 1;
+    if v_actor_role is null or v_actor_role not in ('owner', 'admin') then
+      raise exception 'board membership change requires owner or admin role'
+        using errcode = '42501';
+    end if;
+  end if;
+
+  -- HOSTED: LOCKED, so every transition rule below is decided on the state the sink will
+  -- overwrite. Unlocked, an admin's uncommitted `removed` committed after this read, and the D7
+  -- withdrawal (and an ordinary self-leave, the same branch shape) then wrote `left` over it in
+  -- the sink, erasing the eviction R-LINK-7 reads (hosted_delegate_withdraw_evict_race). The
+  -- sink's own first lock is this same row in the same order, so the lock set is unchanged;
+  -- it is only taken earlier, before reads that lock nothing.
+  select bm.membership_state, bm.role
+    into v_existing_state, v_target_role
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   order by
+     case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+     bm.created_at desc,
+     bm.id desc
+   limit 1
+   for update;
+  if v_existing_state is null then
+    raise exception 'board membership not found' using errcode = 'P0002';
+  end if;
+
+  if v_principal_withdraw then
+    -- HOSTED (D7): the owner withdraws its own delegate whatever its board role, but ONLY from
+    -- the states a self-leave may leave. Never from `removed`: turning an eviction into `left`
+    -- would erase the standing R-LINK-7 reads and let the owner re-add the evicted delegate.
+    if v_existing_state not in ('joined', 'subscribed', 'invited', 'requested') then
+      raise exception 'a principal may withdraw its delegate only from an active or pending membership'
+        using errcode = '42501';
+    end if;
+  elsif not v_is_service then
+    if v_actor = p_agent_id then
+      if not (
+        (p_membership_state = 'left'
+         and v_existing_state in ('joined', 'subscribed', 'invited', 'requested'))
+        or (p_membership_state in ('joined', 'subscribed')
+            and v_existing_state in ('joined', 'subscribed'))
+        or (p_membership_state = v_existing_state
+            and p_membership_state in ('left', 'removed'))
+      ) then
+        raise exception 'self membership change not permitted; use the join/approval path'
+          using errcode = '42501';
+      end if;
+    else
+      if agent_board._role_rank(v_actor_role)
+         <= agent_board._role_rank(
+              case
+                when p_membership_state in ('joined', 'subscribed')
+                 and coalesce(v_existing_state, '') not in ('joined', 'subscribed')
+                then 'member'
+                else coalesce(v_target_role, '')
+              end) then
+        raise exception 'board membership change requires a higher board role than the target'
+          using errcode = '42501';
+      end if;
+
+      if p_membership_state in ('joined', 'subscribed')
+         and coalesce(v_existing_state, '') not in ('joined', 'subscribed')
+         and not agent_board._membership_consent_present(p_board_id, p_agent_id) then
+        raise exception 'admitting % requires an act by that agent', p_agent_id
+          using errcode = '42501';
+      end if;
+
+      -- INVITEPOLICY (#90): seating an inbound-disclosure membership ('invited'/'requested')
+      -- for a target that has blocked THIS actor is refused, mirroring invite_board_member.
+      -- Without this, an owner/admin re-seats the exact row the block refuses. Active-admission
+      -- states are already consent-gated above; service_role/self never reach this branch.
+      if p_membership_state in ('invited', 'requested')
+         and not agent_board._invite_permitted(p_board_id, p_agent_id, v_actor) then
+        raise exception 'target has blocked invitations from this inviter on this board'
+          using errcode = '42501';
+      end if;
+    end if;
+  end if;
+
+  if not v_is_service
+     and p_membership_state = v_existing_state
+     and p_membership_state in ('left', 'removed') then
+    return query
+    select bm.id, bm.board_id, bm.agent_id, bm.membership_state, bm.left_at, bm.updated_at
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+     order by
+       case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+       bm.created_at desc,
+       bm.id desc
+     limit 1;
+    return;
+  end if;
+
+  select * into v_membership
+    from agent_board._upsert_board_membership_state(
+      p_board_id,
+      p_agent_id,
+      p_membership_state,
+      null,
+      p_metadata
+    );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.left_at, v_membership.updated_at;
+end;
+$function$;
+
+-- Consiliency/message-board#675: enforce at the table so every RPC, raw writer,
+-- DELETE and FK cascade has the same invariant. Existing ownerless boards remain usable.
+create or replace function agent_board._board_memberships_last_owner_guard()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $function$
+declare
+  v_key bigint := pg_catalog.hashtextextended(
+    'agent_board.board_authority_ceilings:' || old.board_id::text, 0);
+begin
+  if old.role <> 'owner' or old.membership_state not in ('joined', 'subscribed') then
+    if tg_op = 'DELETE' then return old; else return new; end if;
+  end if;
+  if tg_op = 'UPDATE' then
+    if new.board_id = old.board_id and new.agent_id = old.agent_id and new.role = 'owner'
+       and new.membership_state in ('joined', 'subscribed') then
+      return new;
+    end if;
+  end if;
+  -- Deleting the board itself is not leaving an existing board ownerless.
+  if not exists (select 1 from agent_board.boards where id = old.board_id) then
+    if tg_op = 'DELETE' then return old; else return new; end if;
+  end if;
+  -- A transaction snapshot does not advance after an advisory-lock wait.
+  if current_setting('transaction_isolation') <> 'read committed' then
+    raise exception 'last_active_board_owner: owner transitions require read committed'
+      using errcode = '25001';
+  end if;
+  -- Require the board mutex to have been acquired BEFORE the row lock. This
+  -- covers raw DML and cascades without taking a waiting lock in reverse order.
+  if not exists (
+    select 1 from pg_catalog.pg_locks l
+     where l.locktype = 'advisory' and l.pid = pg_catalog.pg_backend_pid()
+       and l.database = (select oid from pg_catalog.pg_database where datname = current_database())
+       and l.classid = ((v_key >> 32) & 4294967295)::oid
+       and l.objid = (v_key & 4294967295)::oid and l.objsubid = 1
+       and l.mode = 'ExclusiveLock' and l.granted
+  ) then
+    raise exception 'last_active_board_owner: acquire board authority lock before owner transition'
+      using errcode = '55000';
+  end if;
+  -- Re-entrant: it CANNOT wait, since this backend already holds the exclusive
+  -- key. Promote a session-level lock to transaction lifetime so releasing the
+  -- session lock early cannot let a second departure miss our uncommitted exit.
+  perform pg_catalog.pg_advisory_xact_lock(v_key);
+  -- A separate volatile statement has a fresh read-committed snapshot.
+  if not exists (
+    select 1 from agent_board.board_memberships bm
+     where bm.board_id = old.board_id and bm.id <> old.id
+       and bm.role = 'owner' and bm.membership_state in ('joined', 'subscribed')
+  ) then
+    raise exception 'last_active_board_owner: cannot remove the last active owner'
+      using errcode = '23514';
+  end if;
+  if tg_op = 'DELETE' then return old; else return new; end if;
+end;
+$function$;
+
+revoke all on function agent_board._board_memberships_last_owner_guard()
+  from public, anon, authenticated, service_role, agent_board_delegate;
+comment on function agent_board._board_memberships_last_owner_guard() is
+  'Consiliency/message-board#675: table-level UPDATE/DELETE guard against removing the last joined/subscribed owner of an existing board, including raw DML and cascades. No service-role bypass. Owner transitions require read committed and serialize to commit on the board authority advisory key; a pre-held exclusive board advisory lock is required (55000 otherwise) and reacquired re-entrantly for transaction lifetime. All waiting locks precede row locks. Existing ownerless boards and unrelated writes are unaffected; recovery by restoring ownership remains service_role-only.';
+
+create trigger trg_board_memberships_last_owner_guard
+  before update or delete on agent_board.board_memberships
+  for each row execute function agent_board._board_memberships_last_owner_guard();
+comment on trigger trg_board_memberships_last_owner_guard on agent_board.board_memberships is
+  'Refuse only a transition that removes an existing active owner and leaves no other active owner; every membership writer is covered by construction. Refusal-only: NEW is never rewritten. A future hard agent delete must acquire every owned board advisory lock before agent or membership row locks.';
+
+revoke all on function agent_board.update_board_membership(uuid,uuid,text,jsonb)
+  from public, anon, agent_board_delegate;
+grant execute on function agent_board.update_board_membership(uuid,uuid,text,jsonb)
+  to authenticated, service_role;
+
+comment on function agent_board.update_board_membership(uuid,uuid,text,jsonb) is
+  'Authorized membership state transitions with existing self, principal-withdrawal, rank, consent and idempotency rules. Consiliency/message-board#675: board advisory lock before target membership/FK locks; the table refuses any transition removing the last active owner.';
+
+comment on function agent_board._lock_board_authority_ceiling(uuid) is
+  'Board-keyed transaction advisory lock serializing the ABSENCE of a board_authority_ceilings row, held to commit. WRITERS[serialized: set_board_authority_ceiling][UNSERIALIZED: (none)] READERS[serialized: add_delegate_to_board, grant_board_role, link_session_alias, mint_delegated_child, onboard_federated_fleet_agent, readmit_session_identity][UNSERIALIZED: _redeem_unbounded_invite_for_agent, create_invite_link] The SIDSCHEMA readers take the mutexes for every requested or existing descendant room before root, identity and membership locks. The two UNSERIALIZED readers still evaluate a missing ceiling as default-owner without serializing its absence; that known race (message-board#277) is not changed here. Both lists are machine-compared against the catalog; a new reader/writer or changed serialization state fails by name. Internal invoker helper, not an authorization gate; caller privileges determine table access. Consiliency/message-board#675: also the per-board departure mutex, acquired by update_board_membership before row locks and held through commit; all destructive owner transitions require this key, including direct writes and hard agent-deletion cascades.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.63.0",
+  "version": "1.64.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.63.0",
+  "packageVersion": "1.64.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 161,
-  "aggregateSha256": "884150d3dfbccdbe8a0be038688832baa83a185ae219ab0afcf9d585dc42a984",
+  "migrationCount": 162,
+  "aggregateSha256": "b6b24a1c50a1ac51cd935f6ad2091876a0b0ff98f001d776c89445a889416745",
   "migrations": [
     {
       "order": 0,
@@ -1497,6 +1497,15 @@
       "sourceRef": "message-board",
       "bytes": 14704,
       "sha256": "4a6c00546a1d2837f88eece1de082cc76eec1f85cce8cf9ac7998e42bf32a5c5"
+    },
+    {
+      "order": 161,
+      "id": "20261014000200_agent_board_last_owner",
+      "filename": "20261014000200_agent_board_last_owner.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 13141,
+      "sha256": "2fed8fc5a2c7c0ba9acbb12872b329db3f0902d96597c52cc50e21e4682c2fff"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -24,6 +24,9 @@ const historyExact = () => ({ applied: ordered.map((m) => ({ id: m.id, sha256: m
 const union = () => ordered.filter((m) => m.origin !== 'message-board-forward');
 
 describe('manifest integrity', () => {
+  it('pins the exact owner-authorized A3/A10.3 test amendment for Consiliency/message-board#675', () => {
+    expect(sha256(readFileSync(new URL('../tests/agent_board_grant_target_role.test.sql', import.meta.url)))).toBe('5c0a857d8c138f368235fa345a18c76fafa773cfe8eb57185b232d466d222f93');
+  });
   it('aggregate digest matches recomputation over ordered per-file digests', () => {
     const agg = sha256(Buffer.from(ordered.map((e) => `${e.order} ${e.id} ${e.sha256}`).join('\n')));
     expect(agg).toBe(manifest.aggregateSha256);
@@ -38,9 +41,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST + one ONBOARD + one HOSTED + one HOSTED-FOLLOWUPS + one OWNPOST + one SIDSCHEMA + one SIDOWNER + one GRANTTARGETROLE (#674) forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 161)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST + one ONBOARD + one HOSTED + one HOSTED-FOLLOWUPS + one OWNPOST + one SIDSCHEMA + one SIDOWNER + one GRANTTARGETROLE (#674) + one LASTOWNER (Consiliency/message-board#675) forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 162)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(161);
+    expect(manifest.migrationCount).toBe(162);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -360,6 +363,7 @@ describe('manifest integrity', () => {
       '20261012000100_agent_board_sidowner.sql',
       // #674: grant_board_role checks the target's current role (C-A + C-B).
       '20261014000100_agent_board_grant_target_role.sql',
+      '20261014000200_agent_board_last_owner.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_atomic_fleet_onboarding.test.sql

@@ -700,6 +700,7 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     -- than naming the table itself. Internal — it reads rows for an arbitrary agent id with no
     -- authorization of its own, so service_role only, like every other helper here.
     'agent_board._actor_fleet_revoked(uuid) [definer] => service_role',
+    'agent_board._board_memberships_last_owner_guard() [definer] => (none)',
     'agent_board._lock_board_authority_ceiling(uuid) [invoker] => service_role',
     'agent_board._redeem_fleet_invite_for_agent(text,uuid) [definer] => service_role',
     'agent_board._redeem_invite_for_agent(text,uuid) [definer] => service_role',
@@ -736,7 +737,8 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     'agent_board.signed_grant_board_role(jsonb,jsonb) [definer] => service_role',
     -- SIDSCHEMA integrity repair: the verified Portal withdrawal now takes board mutexes
     -- before the instance/family rows. Its service-only transport is unchanged.
-    'agent_board.tombstone_delegate_instance(text,text,text,text) [definer] => service_role'
+    'agent_board.tombstone_delegate_instance(text,text,text,text) [definer] => service_role',
+    'agent_board.update_board_membership(uuid,uuid,text,jsonb) [definer] => authenticated,service_role'
   ]::text[],
   'every function on this migration set''s surface is declared with its definer flag and exact EXECUTE grantees'
 );

package/tests/agent_board_atomic_fleet_onboarding_runtime.test.sql

@@ -837,6 +837,13 @@ select is(
   '0/0', 'generic-invite rejection leaves uses and redemption counts unchanged'
 );
 
+-- Preserve a second owner while exercising the invite creator's lost membership.
+insert into agent_board.agents(id, agent_type, handle, display_name, status)
+values ('16210000-0000-0000-0000-000000000002', 'agent', 'atomic-runtime-coowner', 'Atomic Runtime Coowner', 'active');
+insert into agent_board.board_memberships(board_id, agent_id, membership_state, role)
+select board_id, '16210000-0000-0000-0000-000000000002', 'joined', 'owner' from _atomic_cfg;
+select agent_board._lock_board_authority_ceiling(board_id) from _atomic_cfg;
+
 update agent_board.board_memberships
    set membership_state='removed', left_at=now(), updated_at=now()
  where board_id=(select board_id from _atomic_cfg)

package/tests/agent_board_fk_lock_edges.test.sql

@@ -297,7 +297,8 @@ select is(
     'grant_board_role: agents(share) then memberships(update) [advisory]',
     'invite_board_member: memberships(update) then agents(key share) [unserialised]',
     'join_board: memberships(update) then agents(key share) [unserialised]',
-    'leave_board: memberships(update) then agents(key share) [unserialised]',
+    -- ROLEGUARD: the departure RPC serializes on the board key before its sink.
+    'leave_board: memberships(update) then agents(key share) [advisory]',
     -- SIDSCHEMA role writers use the existing consent sink and board mutex.
     -- Their installed lock order is asserted, not exempted from the class.
     'link_session_alias: agents(update) then memberships(update) [advisory]',
@@ -319,7 +320,7 @@ select is(
     -- SIDSCHEMA integrity repair: board mutexes precede owner/instance and family row locks,
     -- matching add_delegate_to_board's board-before-instance order. No withdrawal exemption.
     'tombstone_delegate_instance: agents(update) then memberships(update) [advisory]',
-    'update_board_membership: memberships(update) then agents(key share) [unserialised]'
+    'update_board_membership: memberships(update) then agents(key share) [advisory]'
   ]::text[],
   'FKL-9: the agents+board_memberships lock class, FK edges included (section 9''s text scan sees 3 of these)');
 

package/tests/agent_board_grant_target_role.test.sql

@@ -611,9 +611,9 @@ select results_eq(format('select label, membership_state, role from pg_temp.g674
   $$values ('G', 'joined', 'owner')$$,
   'A3.pre');
 select pg_temp.g674_as('A3', 'G');
-select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A3'), pg_temp.g674_a('A3', 'G'), 'admin'), 'A3.call');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A3'), pg_temp.g674_a('A3', 'G'), 'admin'), '23514', 'last_active_board_owner: cannot remove the last active owner', 'A3.call');
 select pg_temp.g674_service();
-select is(pg_temp.g674_post('A3', 'G'), 'G[joined/admin/written] owners=0', 'A3.post');
+select is(pg_temp.g674_post('A3', 'G'), 'G[joined/owner/pinned] owners=1', 'A3.post');
 
 -- A4: admin -> member, admin: ceiling 3<=3, then 3>2
 insert into _g674_case values ('A4', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "member", "_creator": "O"}'::jsonb));
@@ -711,9 +711,9 @@ select results_eq(format('select label, membership_state, role from pg_temp.g674
   $$values ('G', 'joined', 'owner')$$,
   'A10.3.pre');
 select pg_temp.g674_as('A10.3', 'G');
-select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A10.3'), pg_temp.g674_a('A10.3', 'G'), 'admin'), 'A10.3.call');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A10.3'), pg_temp.g674_a('A10.3', 'G'), 'admin'), '23514', 'last_active_board_owner: cannot remove the last active owner', 'A10.3.call');
 select pg_temp.g674_service();
-select is(pg_temp.g674_post('A10.3', 'G'), 'G[joined/admin/written] owners=0', 'A10.3.post');
+select is(pg_temp.g674_post('A10.3', 'G'), 'G[joined/owner/pinned] owners=1', 'A10.3.post');
 
 -- A10.4: A4 with the role gate on
 insert into _g674_case values ('A10.4', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "member", "_creator": "O", "_gate": true}'::jsonb));

package/tests/agent_board_hosted_delegates.test.sql

@@ -165,16 +165,17 @@ begin
   end loop;
 end $$;
 
--- Keyed agents: K (board owner/admin everywhere), K2 (member), Z1 (only on BZ).
+-- Keyed agents: K (board owner/admin everywhere), K2 (member), Z1 (only on BZ),
+-- and a coowner of BW so its principal-departure cascade leaves an active owner.
 insert into auth.users(id, instance_id, aud, role, email)
 select ('5e000000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
        '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'hosted-k' || n || '@t.test'
-  from generate_series(1, 3) n;
+  from generate_series(1, 4) n;
 insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
 select ('5e100000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid, 'agent', 'agent',
        'hosted-keyed-' || n, 'Hosted Keyed ' || n, 'active',
        ('5e000000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid
-  from generate_series(1, 3) n;
+  from generate_series(1, 4) n;
 select pg_temp.put('K', '5e100000-0000-4000-8000-000000000001'),
        pg_temp.put('K.auth', '5e000000-0000-4000-8000-000000000001'),
        pg_temp.put('K2', '5e100000-0000-4000-8000-000000000002'),
@@ -200,6 +201,7 @@ values (pg_temp.u('BX'), pg_temp.u('K'),  'owner',  'joined', pg_temp.u('K')),
        (pg_temp.u('BZ'), pg_temp.u('K'),  'owner',  'joined', pg_temp.u('K')),
        (pg_temp.u('BZ'), pg_temp.u('Z1'), 'member', 'joined', pg_temp.u('K')),
        (pg_temp.u('BW'), pg_temp.u('OA'), 'owner',  'joined', pg_temp.u('OA')),
+       (pg_temp.u('BW'), '5e100000-0000-4000-8000-000000000004', 'owner', 'joined', pg_temp.u('OA')),
        (pg_temp.u('BW'), pg_temp.u('K'),  'member', 'joined', pg_temp.u('OA'));
 
 -- ===========================================================================

package/tests/agent_board_invite_no_downgrade.test.sql

@@ -513,14 +513,16 @@ select is(
 -- A new view over this table is then a loud event that forces its author to decide whether it
 -- is writable, which is the decision that would otherwise be made silently.
 select is(
-  (select coalesce(array_agg(t.tgname::text order by t.tgname::text), array[]::text[])
+  (select coalesce(array_agg(t.tgname::text || ':' || t.tgtype::text || ':' || p.proname::text
+                           order by t.tgname::text), array[]::text[])
      from pg_trigger t
      join pg_class c on c.oid = t.tgrelid
      join pg_namespace n on n.oid = c.relnamespace
+     join pg_proc p on p.oid = t.tgfoid
     where n.nspname = 'agent_board' and c.relname = 'board_memberships'
       and not t.tgisinternal),
-  array[]::text[],
-  '#317: no user trigger on board_memberships — a trigger assigning NEW.membership_state would bypass every source predicate above');
+  array['trg_board_memberships_last_owner_guard:27:_board_memberships_last_owner_guard']::text[],
+  '#317: only the exact UPDATE/DELETE last-owner guard is installed; new state-rewriting triggers name themselves (preserved-state controls are in agent_board_role_guard)');
 
 select is(
   (select coalesce(array_agg(r.rulename::text order by r.rulename::text), array[]::text[])

package/tests/agent_board_ledger_authority.test.sql

@@ -652,6 +652,13 @@ select is(
 
 select pg_temp.service();
 
+-- Preserve a coowner while testing the returning owner's role clamp.
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+values ('27610000-0000-4000-8000-000000000007','agent','agent','k276-coowner','K276 Coowner','active');
+insert into agent_board.board_memberships(board_id,agent_id,role,membership_state,created_by_agent_id)
+values ('27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000007','owner','joined','27610000-0000-4000-8000-000000000003');
+select agent_board._lock_board_authority_ceiling('27620000-0000-4000-8000-000000000002');
+
 select lives_ok(
   $$create temp table _cl as select agent_board._upsert_board_membership_state(
       '27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000003',