@consiliency/agent-board-schema 1.63.0 → 1.64.0

package/tests/agent_board_role_guard.test.sql

@@ -0,0 +1,319 @@
+-- Consiliency/message-board#675: actual authenticated RPCs, table paths,
+-- catalog-derived writer classes, and paired allow cases. Mutations are recorded
+-- in plans/evidence/roleguard; every run must emit its full plan.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(76);
+grant usage on schema extensions to authenticated, service_role;
+-- On unexpected success, force the probe's subtransaction to roll back. The
+-- wrong SQLSTATE still fails throws_ok, while later fixtures and plan counts survive.
+create function pg_temp.refusal_probe(p_sql text) returns void language plpgsql as $$
+begin
+  execute p_sql;
+  raise exception 'refusal probe unexpectedly succeeded' using errcode='PZ001';
+end $$;
+create function pg_temp.a(n int) returns uuid language sql immutable as $$
+ select ('67410000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid $$;
+create function pg_temp.b(n int) returns uuid language sql immutable as $$
+ select ('67520000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid $$;
+create function pg_temp.actor(n int) returns void language sql as $$
+ select set_config('request.jwt.claims',jsonb_build_object('role','authenticated',
+ 'sub','67400000-0000-0000-0000-' || lpad(n::text,12,'0'))::text,true)::text::void $$;
+insert into auth.users(id,instance_id,aud,role,email)
+select ('67400000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid,
+ '00000000-0000-0000-0000-000000000000','authenticated','authenticated','roleguard-'||n||'@test.invalid'
+from generate_series(1,6) n;
+insert into agent_board.agents(id,agent_type,kind,handle,display_name,status,auth_user_id)
+select pg_temp.a(n),'agent','agent','roleguard-'||n,'Roleguard '||n,'active',
+ ('67400000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid from generate_series(1,6) n;
+insert into agent_board.boards(id,slug,name,created_by_agent_id,visibility)
+select pg_temp.b(n),'roleguard-'||n,'Roleguard '||n,pg_temp.a(1),'private' from generate_series(1,5) n;
+insert into agent_board.board_memberships(board_id,agent_id,role,membership_state,created_by_agent_id)
+select pg_temp.b(b),pg_temp.a(a),
+ case when a in (1,2) then 'owner' when a in (3,4) then 'admin' when a=5 then 'member' else 'observer' end,
+ case when b=4 and a=1 then 'subscribed' else 'joined' end,pg_temp.a(1)
+from generate_series(1,5) b cross join generate_series(1,6) a
+where (b in (1,5) or a<>2) and (b<>3 or a<>1);
+-- Pending and terminal owners do not count as active owners.
+insert into agent_board.board_memberships(board_id,agent_id,role,membership_state,created_by_agent_id)
+values (pg_temp.b(2),pg_temp.a(2),'owner','invited',pg_temp.a(1));
+
+
+select pg_temp.actor(1);
+set local role authenticated;
+
+select lives_ok($$select * from agent_board.grant_board_role(pg_temp.b(1),pg_temp.a(1),'admin')$$, 'LO-self-demote two owners allowed');
+
+reset role;
+select set_config('request.jwt.claims', '', true);
+
+select is((select role from agent_board.board_memberships where board_id=pg_temp.b(1) and agent_id=pg_temp.a(1) and membership_state in ('joined','subscribed')), 'admin', 'LO-self-demote state');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(1) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-self-demote keeps one owner');
+
+update agent_board.board_memberships set role='owner' where board_id=pg_temp.b(1) and agent_id=pg_temp.a(1);
+
+select pg_temp.actor(1);
+set local role authenticated;
+
+select throws_ok($$select pg_temp.refusal_probe($probe$select * from agent_board.grant_board_role(pg_temp.b(2),pg_temp.a(1),'member')$probe$)$$,'23514','last_active_board_owner: cannot remove the last active owner','LO-last self-demote refused');
+
+reset role;
+select set_config('request.jwt.claims', '', true);
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(2) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-last self-demote unchanged');
+
+select pg_temp.actor(1);
+set local role authenticated;
+
+select throws_ok($$select pg_temp.refusal_probe($probe$select * from agent_board.leave_board(pg_temp.b(2),pg_temp.a(1))$probe$)$$,'23514','last_active_board_owner: cannot remove the last active owner','LO-last leave refused');
+
+reset role;
+select set_config('request.jwt.claims', '', true);
+
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)), 'joined', 'LO-last leave unchanged');
+
+select pg_temp.actor(1);
+set local role authenticated;
+
+select lives_ok($$select * from agent_board.leave_board(pg_temp.b(1),pg_temp.a(1))$$, 'LO-two owners leave allowed');
+
+reset role;
+select set_config('request.jwt.claims', '', true);
+
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.b(1) and agent_id=pg_temp.a(1)), 'left', 'LO-two owners leave state');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(1) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-two owners leave keeps one');
+
+set local role service_role;
+select set_config('request.jwt.claims','{"role":"service_role"}',true);
+
+select throws_ok($$select pg_temp.refusal_probe($probe$select * from agent_board.update_board_membership(pg_temp.b(2),pg_temp.a(1),'removed')$probe$)$$,'23514','last_active_board_owner: cannot remove the last active owner','LO-last removal service refused');
+
+reset role;
+select set_config('request.jwt.claims', '', true);
+
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)), 'joined', 'LO-last removal unchanged');
+
+update agent_board.board_memberships set role='owner',membership_state='joined',left_at=null where board_id=pg_temp.b(1) and agent_id=pg_temp.a(1);
+
+set local role service_role;
+select set_config('request.jwt.claims','{"role":"service_role"}',true);
+
+select lives_ok($$select * from agent_board.update_board_membership(pg_temp.b(1),pg_temp.a(1),'removed')$$, 'LO-two owners removal allowed');
+
+reset role;
+select set_config('request.jwt.claims', '', true);
+
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.b(1) and agent_id=pg_temp.a(1)), 'removed', 'LO-two owners removal state');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(1) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-two owners removal keeps one');
+
+select throws_ok($$select pg_temp.refusal_probe($probe$delete from agent_board.board_memberships where board_id=pg_temp.b(5) and agent_id=pg_temp.a(1)$probe$)$$,'55000','last_active_board_owner: acquire board authority lock before owner transition','LO-raw owner transition requires prior board lock');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(5) and role='owner' and membership_state in ('joined','subscribed')), 2, 'LO-unlocked raw transition unchanged');
+
+select agent_board._lock_board_authority_ceiling(pg_temp.b(5));
+
+select throws_ok($$select pg_temp.refusal_probe($probe$delete from agent_board.board_memberships where board_id=pg_temp.b(5) and role='owner'$probe$)$$,'23514','last_active_board_owner: cannot remove the last active owner','LO-bulk owners delete refused');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(5) and role='owner' and membership_state in ('joined','subscribed')), 2, 'LO-bulk owners delete atomic rollback');
+
+select lives_ok($$delete from agent_board.board_memberships where board_id=pg_temp.b(5) and agent_id=pg_temp.a(1)$$, 'LO-two owners raw delete allowed');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(5) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-two owners raw delete state');
+
+select agent_board._lock_board_authority_ceiling(pg_temp.b(2));
+
+select throws_ok($$select pg_temp.refusal_probe($probe$delete from agent_board.board_memberships where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)$probe$)$$,'23514','last_active_board_owner: cannot remove the last active owner','LO-raw-delete refused');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(2) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-raw-delete unchanged');
+
+select throws_ok($$select pg_temp.refusal_probe($probe$update agent_board.board_memberships set role='member' where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)$probe$)$$,'23514','last_active_board_owner: cannot remove the last active owner','LO-raw-role refused');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(2) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-raw-role unchanged');
+
+select throws_ok($$select pg_temp.refusal_probe($probe$update agent_board.board_memberships set board_id=pg_temp.b(3) where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)$probe$)$$,'23514','last_active_board_owner: cannot remove the last active owner','LO-raw-move refused');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(2) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-raw-move unchanged');
+
+select throws_ok($$select pg_temp.refusal_probe($probe$select * from agent_board.update_board_membership(pg_temp.b(4),pg_temp.a(1),'left')$probe$)$$,'23514','last_active_board_owner: cannot remove the last active owner','LO-subscribed-leave refused');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(4) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-subscribed-leave unchanged');
+
+select throws_ok($$select pg_temp.refusal_probe($probe$delete from agent_board.agents where id=pg_temp.a(2)$probe$)$$,'23514','last_active_board_owner: cannot remove the last active owner','LO-cascade-agent refused');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(1) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-cascade-agent unchanged');
+
+select lives_ok($$delete from agent_board.board_memberships where board_id=pg_temp.b(2) and agent_id=pg_temp.a(2)$$, 'LO-pending owner delete allowed');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(2) and agent_id=pg_temp.a(2)),0,'LO-pending owner delete state');
+
+select lives_ok($$update agent_board.board_memberships set metadata='{"unrelated":true}' where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)$$, 'LO-owner metadata allowed');
+
+select is((select metadata->>'unrelated' from agent_board.board_memberships where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)),'true','LO-owner metadata state');
+
+select lives_ok($$update agent_board.board_memberships set metadata='{"unrelated":true}' where board_id=pg_temp.b(3)$$, 'LO-ownerless unrelated update allowed');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(3) and metadata->>'unrelated'='true'),4,'LO-ownerless unrelated state');
+
+select pg_temp.actor(5);
+set local role authenticated;
+
+select lives_ok($$select * from agent_board.update_board_membership(pg_temp.b(3),pg_temp.a(5),'left')$$, 'LO-ownerless member leave allowed');
+
+reset role;
+select set_config('request.jwt.claims', '', true);
+
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.b(3) and agent_id=pg_temp.a(5)), 'left', 'LO-ownerless member leave state');
+
+select pg_temp.actor(3);
+set local role authenticated;
+
+select throws_ok($$select pg_temp.refusal_probe($probe$select * from agent_board.grant_board_role(pg_temp.b(3),pg_temp.a(3),'owner')$probe$)$$, '42501', 'grant exceeds grantor role or board authority ceiling', 'LO-auth recovery refused');
+
+select ok(not has_function_privilege('authenticated','agent_board.bootstrap_board_owner_memberships()','EXECUTE'),'LO-bootstrap recovery service-only');
+
+reset role;
+select set_config('request.jwt.claims', '', true);
+
+set local role service_role;
+select set_config('request.jwt.claims','{"role":"service_role"}',true);
+
+select lives_ok($$select * from agent_board.bootstrap_board_owner_memberships()$$, 'LO-service recovery allowed');
+
+reset role;
+select set_config('request.jwt.claims', '', true);
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(3) and role='owner' and membership_state in ('joined','subscribed')), 1, 'LO-service recovery state');
+
+select lives_ok($$delete from agent_board.boards where id=pg_temp.b(4)$$, 'LO-board deletion allowed');
+
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(4)),0,'LO-board deletion cascades');
+
+
+-- Refusal-only behaviour: the trigger must return the proposed row verbatim.
+select is((select jsonb_build_object('role',role,'state',membership_state,'agent',agent_id,'board',board_id,'metadata',metadata)
+ from agent_board.board_memberships where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)),
+ jsonb_build_object('role','owner','state','joined','agent',pg_temp.a(1),'board',pg_temp.b(2),'metadata','{"unrelated":true}'::jsonb),
+ 'LO-refusal-only preserves proposed owner row');
+
+insert into agent_board.agents(id,agent_type,handle,display_name,status)
+values (pg_temp.a(7),'agent','last-owner-replacement','Replacement','active');
+select throws_ok($$select pg_temp.refusal_probe($probe$update agent_board.board_memberships set agent_id=pg_temp.a(2) where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)$probe$)$$,
+ '23514','last_active_board_owner: cannot remove the last active owner','LO-last owner reassignment refused');
+select is((select agent_id from agent_board.board_memberships where board_id=pg_temp.b(2) and role='owner' and membership_state='joined'),pg_temp.a(1),'LO-last owner reassignment unchanged');
+insert into agent_board.board_memberships(board_id,agent_id,role,membership_state,created_by_agent_id)
+values (pg_temp.b(2),pg_temp.a(7),'owner','joined',pg_temp.a(1));
+select lives_ok($$update agent_board.board_memberships set agent_id=pg_temp.a(2) where board_id=pg_temp.b(2) and agent_id=pg_temp.a(1)$$,'LO-two owners reassignment allowed');
+select is((select count(*)::int from agent_board.board_memberships where board_id=pg_temp.b(2) and agent_id in (pg_temp.a(2),pg_temp.a(7)) and role='owner' and membership_state='joined'),2,'LO-two owners reassignment state');
+
+-- Real SID holder: the parent is narrowed, and alias linking would demote the
+-- child's sole owner membership. Refusal must roll back alias and authority.
+create temp table _lo_sid(root_id uuid,owner_id uuid,board_id uuid,child_id uuid,key_id uuid,child_auth uuid,epoch bigint);
+create function pg_temp.lo_sid_setup() returns void language plpgsql as $fixture$
+declare v_root uuid:=gen_random_uuid(); v_board uuid:=gen_random_uuid();
+ v_owner_auth uuid; v_root_auth uuid; v_owner uuid; v_child record; v_challenge record; v_epoch bigint;
+begin
+ v_owner_auth:=public.ensure_github_user('lo-owner-'||v_root,'lo-owner-'||v_root||'@test.invalid','lo-owner-'||v_root,'Last owner human');
+ v_root_auth:=public.ensure_github_user('lo-root-'||v_root,'lo-root-'||v_root||'@test.invalid','lo-root-'||v_root,'Last owner root');
+ insert into agent_board.agents(agent_type,handle,display_name,status,auth_user_id)
+ values ('human','lo-human-'||v_root,'Last owner human','active',v_owner_auth) returning id into v_owner;
+ insert into agent_board.agents(id,agent_type,handle,display_name,status,auth_user_id,owner_user_id)
+ values (v_root,'agent','lo-root-'||v_root,'Last owner root','active',v_root_auth,v_owner_auth);
+ insert into agent_board.session_identities(agent_id,root_agent_id,depth,approved_risky_digest,current_risky_digest)
+ values (v_root,v_root,0,'approved','approved');
+ insert into agent_board.boards(id,slug,name,created_by_agent_id) values (v_board,'lo-link-'||v_board,'Last owner link',v_root);
+ insert into agent_board.board_memberships(board_id,agent_id,role,membership_state) values (v_board,v_root,'owner','joined'),(v_board,v_owner,'owner','joined');
+ perform agent_board.upsert_delegation_policy(v_root,'root_minted','["read","write"]',200,interval '7 days',true);
+ select * into v_child from agent_board.mint_delegated_child(v_root,'lo-child-'||v_root,'["read","write"]',public.test_pubkey('lo-child-'||v_root),interval '8 hours',false,'claude','lo-child',null,
+ jsonb_build_array(jsonb_build_object('board_id',v_board,'role','owner')),'{"resolution":"resolved","risky_digest":"approved"}');
+ select * into v_challenge from agent_board.issue_signing_key_challenge(v_child.child_agent_id,'delegated-ephemeral');
+ select identity_lease_epoch into v_epoch from agent_board.mint_fleet_agent_session(v_challenge.challenge_id,split_part(v_challenge.challenge,':',3),v_child.signing_key_id,v_child.child_agent_id,900,null,'lo-child');
+ perform agent_board._lock_board_authority_ceiling(v_board);
+ update agent_board.board_memberships set role='admin' where board_id=v_board and agent_id in (v_root,v_owner);
+ insert into _lo_sid select v_root,v_owner,v_board,v_child.child_agent_id,v_child.signing_key_id,a.auth_user_id,v_epoch from agent_board.agents a where a.id=v_child.child_agent_id;
+end $fixture$;
+select set_config('request.jwt.claims','{"role":"service_role"}',true);
+select set_config('request.jwt.claim.role','service_role',true);
+select lives_ok($$select pg_temp.lo_sid_setup()$$,'LO-link fixture allowed');
+select is((select count(*)::int from agent_board.board_memberships where board_id=(select board_id from _lo_sid) and role='owner' and membership_state in ('joined','subscribed')),1,'LO-link fixture has sole child owner');
+grant select on _lo_sid to service_role;
+select set_config('request.jwt.claim.sub',(select child_auth::text from _lo_sid),true);
+select set_config('request.jwt.claim.identity_lease_epoch',(select epoch::text from _lo_sid),true);
+set local role service_role;
+select throws_ok($$select pg_temp.refusal_probe($probe$select agent_board.link_session_alias((select child_id from _lo_sid),(select epoch::text from _lo_sid),'lo-last-owner-refused')$probe$)$$,
+ '23514','last_active_board_owner: cannot remove the last active owner','LO-link sole-owner narrowing refused');
+reset role;
+select is((select role from agent_board.board_memberships where board_id=(select board_id from _lo_sid) and agent_id=(select child_id from _lo_sid)),'owner','LO-link refused membership unchanged');
+select is((select count(*)::int from agent_board.session_id_aliases where root_agent_id=(select root_id from _lo_sid) and session_id='lo-last-owner-refused'),0,'LO-link refusal rolls back alias');
+update agent_board.board_memberships set role='owner' where board_id=(select board_id from _lo_sid) and agent_id=(select owner_id from _lo_sid);
+set local role service_role;
+select lives_ok($$select agent_board.link_session_alias((select child_id from _lo_sid),(select epoch::text from _lo_sid),'lo-two-owners-allowed')$$,'LO-link narrowing with coowner allowed');
+reset role;
+select is((select role from agent_board.board_memberships where board_id=(select board_id from _lo_sid) and agent_id=(select child_id from _lo_sid)),'admin','LO-link allowed narrows child role');
+select is((select count(*)::int from agent_board.board_memberships where board_id=(select board_id from _lo_sid) and role='owner' and membership_state in ('joined','subscribed')),1,'LO-link allowed retains coowner');
+select set_config('request.jwt.claims','',true);
+select set_config('request.jwt.claim.role','',true);
+select set_config('request.jwt.claim.sub','',true);
+select set_config('request.jwt.claim.identity_lease_epoch','',true);
+
+select alike(obj_description('agent_board._lock_board_authority_ceiling(uuid)'::regprocedure,'pg_proc'),'%per-board departure mutex%','CLASS-board lock COMMENT documents departure mutex');
+
+create temp view _roleguard_writers as
+select p.oid,case when n.nspname='agent_board' then p.proname::text
+                 else n.nspname||'.'||p.proname end as name,
+ agent_board_test.stripped_body(p.oid,true) as b,
+ agent_board_test.stripped_body(p.oid,true) ~ agent_board_test.col_write_re('board_memberships','role') as role_writer,
+ agent_board_test.stripped_body(p.oid,true) ~ agent_board_test.col_write_re('board_memberships','membership_state') as state_writer
+from pg_proc p join pg_namespace n on n.oid=p.pronamespace
+where n.nspname not in ('pg_catalog','information_schema','agent_board_test')
+  and n.nspname !~ '^pg_' and p.prokind in ('f','p')
+  and p.prolang <> (select oid from pg_language where lanname='internal')
+  and agent_board_test.stripped_body(p.oid,true) ~ agent_board_test.write_re('board_memberships');
+
+select is((select string_agg(name,',' order by name) from _roleguard_writers where role_writer),'_fedsession_autojoin_default_board,_redeem_unbounded_invite_for_agent,_upsert_board_membership_state,bootstrap_board_owner_memberships,create_board,grant_board_role,link_session_alias,mint_delegated_child,readmit_session_identity','CLASS-role writers: a new role writer fails and names itself');
+
+select is((select string_agg(name,',' order by name) from _roleguard_writers where state_writer),'_fedsession_autojoin_default_board,_redeem_unbounded_invite_for_agent,_upsert_board_membership_state,bootstrap_board_owner_memberships,create_board','CLASS-state writers: a new state writer fails and names itself');
+
+select is((select string_agg(name,',' order by name) from _roleguard_writers),'_fedsession_autojoin_default_board,_redeem_unbounded_invite_for_agent,_upsert_board_membership_state,bootstrap_board_owner_memberships,create_board,grant_board_role,link_session_alias,mint_delegated_child,readmit_session_identity,set_board_member_label','CLASS-all table writers: new deletes and other writers name themselves');
+
+-- TRUNCATE has no row trigger; application roles must never acquire that door.
+select is((select coalesce(string_agg(r,',' order by r),'')
+           from unnest(array['anon','authenticated','service_role','agent_board_delegate']) r
+           where has_table_privilege(r,'agent_board.board_memberships','TRUNCATE')),
+          '', 'CLASS-no application TRUNCATE bypass of row invariant');
+
+select ok((select count(*)=1 and bool_and(tgtype=27 and tgenabled='O' and tgqual is null and tgfoid=to_regprocedure('agent_board._board_memberships_last_owner_guard()')) from pg_trigger where tgrelid='agent_board.board_memberships'::regclass and tgname='trg_board_memberships_last_owner_guard'),'CLASS-table invariant: unconditional enabled BEFORE ROW UPDATE/DELETE trigger covers every writer');
+
+select is((select count(*)::int from pg_proc p,aclexplode(coalesce(p.proacl,acldefault('f',p.proowner))) a where p.oid=to_regprocedure('agent_board._board_memberships_last_owner_guard()') and a.privilege_type='EXECUTE' and a.grantee<>p.proowner),0,'CLASS-trigger ACL: no API role or PUBLIC can execute internal trigger');
+
+select isnt(obj_description(to_regprocedure('agent_board._board_memberships_last_owner_guard()'),'pg_proc'),null,'CLASS-trigger COMMENT exists');
+
+select is((select md5(prosrc) from pg_proc where oid=to_regprocedure('agent_board.grant_board_role(uuid,uuid,text,uuid)')),'de7d1079623e95dcc376e1881492a44b','CLASS-main grant body unchanged'); -- pgtap-allow-raise-checked: non-raising catalog identity lookup; no RPC is executed.
+
+select ok(strpos(agent_board_test.stripped_body('agent_board.update_board_membership(uuid,uuid,text,jsonb)'::regprocedure),'agent_board._lock_board_authority_ceiling(')>0 and strpos(agent_board_test.stripped_body('agent_board.update_board_membership(uuid,uuid,text,jsonb)'::regprocedure),'agent_board._lock_board_authority_ceiling(')<strpos(agent_board_test.stripped_body('agent_board.update_board_membership(uuid,uuid,text,jsonb)'::regprocedure),'for update'),'CLASS-departure advisory before membership row lock');
+
+select ok((select b like '%select p_provider.default_board_id, p_agent_id, ''member'', ''joined''%' from _roleguard_writers where name='_fedsession_autojoin_default_board'),'CLASS-positive _fedsession_autojoin_default_board writer behavior');
+
+select ok((select b like '%values (v_row.board_id, v_row.owner_agent_id, ''joined'', ''owner'', v_row.owner_agent_id)%' from _roleguard_writers where name='bootstrap_board_owner_memberships'),'CLASS-positive bootstrap_board_owner_memberships writer behavior');
+
+select ok((select b like '%values (v_board.id, v_board.created_by_agent_id, ''joined'', ''owner'', v_board.created_by_agent_id)%' from _roleguard_writers where name='create_board'),'CLASS-positive create_board writer behavior');
+
+select ok((select b like '%when agent_board._role_rank(excluded.role) > agent_board._role_rank(agent_board.board_memberships.role)%' from _roleguard_writers where name='_redeem_unbounded_invite_for_agent'),'CLASS-positive _redeem_unbounded_invite_for_agent writer behavior');
+
+select ok((select b like '%v_membership.membership_state not in (''joined'', ''subscribed'')
+                       or v_currently_removed
+                     )
+                    then ''member''
+                    else bm.role%' from _roleguard_writers where name='_upsert_board_membership_state'),'CLASS-positive _upsert_board_membership_state writer behavior');
+
+select ok((select b like '%update agent_board.board_memberships set role = v_role where id = v_membership.id%' from _roleguard_writers where name='mint_delegated_child'),'CLASS-positive mint_delegated_child writer behavior');
+
+select ok((select b like '%update agent_board.board_memberships set role = v_role where id = v_membership.id%' from _roleguard_writers where name='readmit_session_identity'),'CLASS-positive readmit_session_identity writer behavior');
+
+select ok((select b like '%update agent_board.board_memberships set role = v_role where id = v_membership.id%' from _roleguard_writers where name='link_session_alias'),'CLASS-positive link_session_alias writer behavior');
+
+select finish();
+rollback;

package/tests/agent_board_rolereset.test.sql

@@ -76,6 +76,10 @@ begin
   select board_id into v_open
     from agent_board.create_board(v_owner, 'rr-open-' || v_suffix, 'RR Open', 'rolereset open', '{}'::jsonb, 'open');
 
+  -- A second owner preserves the role-reset test without violating last-owner integrity.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
+  values (v_open, v_admin, 'joined', 'owner', v_owner);
+
   -- Board PRIVATE: hosts the per-origin clamp matrix, driven service_role so the
   -- transition itself is never the thing under test.
   select board_id into v_priv
@@ -284,17 +288,16 @@ select ok(
     limit 1),
   'grant_board_role carries the active-state predicate exactly THREE times (#674: step-6 target, step-6 grantor join, UPDATE -- the TOCTOU half)');
 
--- 16. STRUCTURAL: the clamp lives in the mutator, not in a trigger. A BEFORE UPDATE
--- trigger on board_memberships would also fire for the four raw-insert seeders and
--- erase create_board's owner seed and ROOMLINK's admin preset.
+-- 16. The only user trigger is the UPDATE/DELETE refusal guard. It cannot fire
+-- on INSERT seeders, where a role-reset trigger would erase owner/admin presets.
 select is(
-  (select count(*)::int from pg_trigger t
+  (select string_agg(t.tgname || ':' || t.tgtype::text, ',' order by t.tgname) from pg_trigger t
      join pg_class c on c.oid = t.tgrelid
      join pg_namespace n on n.oid = c.relnamespace
     where n.nspname = 'agent_board' and c.relname = 'board_memberships'
       and not t.tgisinternal),
-  0,
-  'no user trigger on board_memberships (the clamp is mutator-sited, never a trigger)');
+  'trg_board_memberships_last_owner_guard:27',
+  'only the last-owner UPDATE/DELETE trigger exists; the role clamp remains mutator-sited');
 
 -- 17. STRUCTURAL: the mutator's superseding comment no longer claims it never writes role.
 select ok(
@@ -331,35 +334,22 @@ select is(
   'member',
   'owner self-leave -> self-rejoin on an OPEN board returns at ''member'', not ''owner'' (#79 repro B closed)');
 
--- 21. SOLE-OWNER LOCKOUT: grant_board_role cannot recover it. _grant_within_ceiling is
--- checked UNCONDITIONALLY -- no service_role bypass -- so an operator must nominate a
--- grantor that already holds rank, and in a sole-owner lockout none exists.
--- NOTE (CR correction): this does NOT mean "no RPC recovery" exists, as an earlier draft
--- of this suite and the CHANGELOG both claimed. bootstrap_board_owner_memberships IS a
--- service_role RPC and raw-inserts joined/owner for a creator with no ACTIVE membership,
--- so leave-again + bootstrap is a genuine RPC recovery path. Assertion 22 proves it.
+-- 21. A sole owner cannot now create the former lockout state.
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);
-select agent_board.leave_board(lockout_board, lockout_owner) from _rr_fixture;
-select agent_board.join_board(lockout_board, lockout_owner, 'joined') from _rr_fixture;
 select throws_ok(
-  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'owner', %L::uuid)$q$, lockout_board, lockout_owner, lockout_owner) from _rr_fixture),
-  '42501',
-  'grant exceeds grantor role or board authority ceiling',
-  'sole-owner lockout has NO grant_board_role recovery even as service_role (ceiling has no service bypass)');
-
--- 22. The REAL recovery path, exercised as an RPC rather than asserted by hand. An earlier
--- draft did `update ... set role='owner'` and then read it back, which is tautological -- it
--- proved SQL works, not that a recovery path exists. Leave again so the creator has no ACTIVE
--- membership, then call bootstrap_board_owner_memberships(); it raw-inserts joined/owner.
-select agent_board.leave_board(lockout_board, lockout_owner) from _rr_fixture;
-select agent_board.bootstrap_board_owner_memberships();
+  (select format($q$select agent_board.leave_board(%L::uuid, %L::uuid)$q$, lockout_board, lockout_owner) from _rr_fixture),
+  '23514',
+  'last_active_board_owner: cannot remove the last active owner',
+  'ROLEGUARD sole-owner departure is refused even to service_role');
+
+-- 22. The refused departure preserves the owner; legacy recovery is tested in role_guard.
 select is(
   (select role from agent_board.board_memberships bm
      join _rr_fixture f on bm.board_id = f.lockout_board and bm.agent_id = f.lockout_owner
     where bm.membership_state in ('joined','subscribed')),
   'owner',
-  'RPC recovery EXISTS: leave-again + bootstrap_board_owner_memberships restores an active owner');
+  'ROLEGUARD refused departure preserves the active owner');
 
 select set_config('request.jwt.claim.role', '', true);
 select set_config('request.jwt.claim.sub', '', true);

package/tests/agent_board_roomdeleg.test.sql

@@ -36,6 +36,7 @@ declare
   v_requester uuid := gen_random_uuid();
   v_nomember uuid := gen_random_uuid();
   v_suspended uuid := gen_random_uuid();
+  v_coowner uuid := gen_random_uuid();
   v_board uuid;
   v_slug text := 'roomdeleg-board-' || v_suffix;
 begin
@@ -54,6 +55,9 @@ begin
     (v_requester, 'agent', 'rd-requester-' || v_suffix, 'RD Requester', 'active', null, null),
     (v_nomember, 'agent', 'rd-nomember-' || v_suffix, 'RD NoMember', 'active', null, null);
 
+  insert into agent_board.agents(id, agent_type, handle, display_name, status)
+  values (v_coowner, 'agent', 'rd-coowner-' || v_suffix, 'RD Coowner', 'active');
+
   -- Alice creates board (service_role null-actor here -> supplied arg honored):
   -- create_board seeds Alice's joined owner membership (ROOMOWN).
   select board_id into v_board
@@ -66,6 +70,9 @@ begin
     (v_board, v_bob, 'joined', v_alice, 'member'),
     (v_board, v_requester, 'requested', v_alice, 'member');
 
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values (v_board, v_coowner, 'joined', v_alice, 'owner');
+
   insert into _roomdeleg_fixture values
     (v_board, v_alice, v_bob, v_target, v_requester, v_nomember, v_suspended,
      v_alice_user, v_bob_user, v_suspended_user);
@@ -127,6 +134,7 @@ select lives_ok(
 
 -- Demote the creator to member (bare statement, not an assertion). created_by is
 -- immutable, so this models a creator who has lost owner authority.
+select agent_board._lock_board_authority_ceiling(board) from _roomdeleg_fixture;
 update agent_board.board_memberships bm
    set role = 'member'
   from _roomdeleg_fixture f

package/tests/agent_board_roomown.test.sql

@@ -73,7 +73,9 @@ begin
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
   values
     (v_board, v_member, 'joined', v_alice, 'member'),
-    (v_board, v_grantee, 'joined', v_alice, 'observer');
+    (v_board, v_grantee, 'joined', v_alice, 'observer'),
+    -- Keep another owner for the creator self-demotion / slug-collision control.
+    (v_board, v_b2owner, 'joined', v_alice, 'owner');
 
   -- Board B2: an owner-LESS board (direct insert, no membership) for the bootstrap sweep.
   insert into agent_board.boards(id, slug, name, description, created_by_agent_id, visibility)

package/tests/agent_board_rowid.test.sql

@@ -323,6 +323,9 @@ begin
       v_left_creator, 'rowid-bootstrap-left-' || s, 'ROWID Bootstrap Left',
       'leave-again recovery', '{}'::jsonb, 'open'
     );
+  -- ROLEGUARD: this creator may depart while another active owner remains.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role)
+  values (v_left_board, v_writer_owner, 'joined', 'owner');
 
   -- Writer 1: a genuine create_board insert.
   select board_id into v_writer_board
@@ -660,7 +663,7 @@ select is(
        on bm.board_id = f.left_board and bm.agent_id = f.left_creator
     where bm.membership_state in ('joined', 'subscribed')),
   'member',
-  'left recovery: ROLERESET rejoin clamps the sole creator to member');
+  'left recovery: ROLERESET rejoin clamps the departing creator to member');
 select lives_ok(
   (select format(
     $q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'left')$q$,

package/tests/catalog/function_execute_privileges.json

@@ -109,6 +109,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "_board_memberships_last_owner_guard",
+      "signature": "_board_memberships_last_owner_guard()",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
     {
       "name": "_build_fetch_descriptor",
       "signature": "_build_fetch_descriptor(p_surface text, p_target_id uuid, p_view text, p_reason text, p_filters jsonb)",

package/tests/catalog/p_metadata_parameters.json

@@ -49,6 +49,10 @@
       "signature": "_board_membership_events_provenance_guard()",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_board_memberships_last_owner_guard()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_build_fetch_descriptor(p_surface text, p_target_id uuid, p_view text, p_reason text, p_filters jsonb)",
       "declares_p_metadata": false