@consiliency/agent-board-schema 1.63.0 → 1.68.0

package/src/policy-comment.test.mjs

@@ -0,0 +1,17 @@
+import { expect, it } from 'vitest';
+import { readFileSync } from 'node:fs';
+
+const comment = (file) => {
+  const sql = readFileSync(new URL('../migrations/' + file, import.meta.url), 'utf8');
+  const statement = sql.match(/^comment on function agent_board\._current_agent_can_access_thread\(uuid\) is\s*((?:'(?:''|[^'])*'\s*)+);/im);
+  if (!statement) throw new Error('thread-access comment missing in ' + file);
+  return [...statement[1].matchAll(/'((?:''|[^'])*)'/g)].map((part) => part[1].replaceAll("''", "'")).join('');
+};
+
+it('RLS-comment-ruling: authenticated grants preserve the complete ratified thread-access comment', () => {
+  const ruling = comment('20260914000100_agent_board_claim_subject_gate.sql');
+  expect(ruling).toContain('message-board#291');
+  expect(ruling).toContain('REVERSING A RULING');
+  expect(comment('20261015000300_agent_board_rls_correlation.sql')).toBe(
+    ruling + ' Callable by authenticated for its RLS policies and by service_role.');
+});

package/src/tooling.test.mjs

@@ -24,6 +24,9 @@ const historyExact = () => ({ applied: ordered.map((m) => ({ id: m.id, sha256: m
 const union = () => ordered.filter((m) => m.origin !== 'message-board-forward');
 
 describe('manifest integrity', () => {
+  it('pins the exact owner-authorized A3/A10.3 test amendment for Consiliency/message-board#675', () => {
+    expect(sha256(readFileSync(new URL('../tests/agent_board_grant_target_role.test.sql', import.meta.url)))).toBe('5c0a857d8c138f368235fa345a18c76fafa773cfe8eb57185b232d466d222f93');
+  });
   it('aggregate digest matches recomputation over ordered per-file digests', () => {
     const agg = sha256(Buffer.from(ordered.map((e) => `${e.order} ${e.id} ${e.sha256}`).join('\n')));
     expect(agg).toBe(manifest.aggregateSha256);
@@ -38,9 +41,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST + one ONBOARD + one HOSTED + one HOSTED-FOLLOWUPS + one OWNPOST + one SIDSCHEMA + one SIDOWNER + one GRANTTARGETROLE (#674) forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 161)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST + one ONBOARD + one HOSTED + one HOSTED-FOLLOWUPS + one OWNPOST + one SIDSCHEMA + one SIDOWNER + one GRANTTARGETROLE (#674) + one LASTOWNER (Consiliency/message-board#675) + one SESSIONPROVENANCE (Consiliency/message-board#665) + one REQUESTREMOVED (Consiliency/message-board#680) + one RLSCORRELATION (Consiliency/message-board#589) + one RESOLUTIONAUTHORITY (Consiliency/message-board#668) forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 166)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(161);
+    expect(manifest.migrationCount).toBe(166);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -360,6 +363,11 @@ describe('manifest integrity', () => {
       '20261012000100_agent_board_sidowner.sql',
       // #674: grant_board_role checks the target's current role (C-A + C-B).
       '20261014000100_agent_board_grant_target_role.sql',
+      '20261014000200_agent_board_last_owner.sql',
+      '20261015000100_agent_board_session_provenance.sql',
+      '20261015000200_agent_board_request_preserve_removed.sql',
+      '20261015000300_agent_board_rls_correlation.sql',
+      '20261015000400_agent_board_resolution_authority.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_atomic_fleet_onboarding.test.sql

@@ -700,6 +700,7 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     -- than naming the table itself. Internal — it reads rows for an arbitrary agent id with no
     -- authorization of its own, so service_role only, like every other helper here.
     'agent_board._actor_fleet_revoked(uuid) [definer] => service_role',
+    'agent_board._board_memberships_last_owner_guard() [definer] => (none)',
     'agent_board._lock_board_authority_ceiling(uuid) [invoker] => service_role',
     'agent_board._redeem_fleet_invite_for_agent(text,uuid) [definer] => service_role',
     'agent_board._redeem_invite_for_agent(text,uuid) [definer] => service_role',
@@ -736,7 +737,8 @@ select is( -- pgtap-allow-raise-checked: catalog read only; the RPC names below
     'agent_board.signed_grant_board_role(jsonb,jsonb) [definer] => service_role',
     -- SIDSCHEMA integrity repair: the verified Portal withdrawal now takes board mutexes
     -- before the instance/family rows. Its service-only transport is unchanged.
-    'agent_board.tombstone_delegate_instance(text,text,text,text) [definer] => service_role'
+    'agent_board.tombstone_delegate_instance(text,text,text,text) [definer] => service_role',
+    'agent_board.update_board_membership(uuid,uuid,text,jsonb) [definer] => authenticated,service_role'
   ]::text[],
   'every function on this migration set''s surface is declared with its definer flag and exact EXECUTE grantees'
 );

package/tests/agent_board_atomic_fleet_onboarding_runtime.test.sql

@@ -837,6 +837,13 @@ select is(
   '0/0', 'generic-invite rejection leaves uses and redemption counts unchanged'
 );
 
+-- Preserve a second owner while exercising the invite creator's lost membership.
+insert into agent_board.agents(id, agent_type, handle, display_name, status)
+values ('16210000-0000-0000-0000-000000000002', 'agent', 'atomic-runtime-coowner', 'Atomic Runtime Coowner', 'active');
+insert into agent_board.board_memberships(board_id, agent_id, membership_state, role)
+select board_id, '16210000-0000-0000-0000-000000000002', 'joined', 'owner' from _atomic_cfg;
+select agent_board._lock_board_authority_ceiling(board_id) from _atomic_cfg;
+
 update agent_board.board_memberships
    set membership_state='removed', left_at=now(), updated_at=now()
  where board_id=(select board_id from _atomic_cfg)

package/tests/agent_board_consent_gating.test.sql

@@ -202,7 +202,7 @@ select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-40
   'joined', 'EC-2 join_board: re-entry after leaving still works');
 
 -- ===========================================================================
--- EC-3 OPERATOR -- the carve-out is preserved on every route
+-- EC-3 OPERATOR -- direct placement remains; resolution requires owner/admin identity
 -- ===========================================================================
 select pg_temp.service();
 select lives_ok($$
@@ -215,13 +215,13 @@ select is(
   (select provenance from agent_board.board_membership_events
     where agent_id = 'c1000000-0000-4000-8000-000000000006' order by seq desc limit 1),
   'operator-designated', 'EC-3: ...recorded as an operator placement, never as consent');
-select lives_ok($$
+select throws_ok($$
   select agent_board.resolve_board_request(
     'c2000000-0000-4000-8000-000000000001'::uuid,'c1000000-0000-4000-8000-000000000003'::uuid,
     'joined'::text, null::uuid, '{}'::jsonb) $$,
-  'EC-3: service_role may resolve a pending row the gate refuses to an owner [call succeeds]');
+  '42501', null, 'EC-3: unresolved service_role cannot resolve pending membership');
 select is(pg_temp.state('c2000000-0000-4000-8000-000000000001','c1000000-0000-4000-8000-000000000003'),
-  'joined', 'EC-3: service_role may resolve a pending row the gate refuses to an owner');
+  'requested', 'EC-3: refused service_role resolution preserves the pending row');
 
 -- ===========================================================================
 -- EC-6 / EC-7 -- consent is EXERCISABLE (#108), and the widening admits nobody else

package/tests/agent_board_fk_lock_edges.test.sql

@@ -297,7 +297,8 @@ select is(
     'grant_board_role: agents(share) then memberships(update) [advisory]',
     'invite_board_member: memberships(update) then agents(key share) [unserialised]',
     'join_board: memberships(update) then agents(key share) [unserialised]',
-    'leave_board: memberships(update) then agents(key share) [unserialised]',
+    -- ROLEGUARD: the departure RPC serializes on the board key before its sink.
+    'leave_board: memberships(update) then agents(key share) [advisory]',
     -- SIDSCHEMA role writers use the existing consent sink and board mutex.
     -- Their installed lock order is asserted, not exempted from the class.
     'link_session_alias: agents(update) then memberships(update) [advisory]',
@@ -319,7 +320,7 @@ select is(
     -- SIDSCHEMA integrity repair: board mutexes precede owner/instance and family row locks,
     -- matching add_delegate_to_board's board-before-instance order. No withdrawal exemption.
     'tombstone_delegate_instance: agents(update) then memberships(update) [advisory]',
-    'update_board_membership: memberships(update) then agents(key share) [unserialised]'
+    'update_board_membership: memberships(update) then agents(key share) [advisory]'
   ]::text[],
   'FKL-9: the agents+board_memberships lock class, FK edges included (section 9''s text scan sees 3 of these)');
 

package/tests/agent_board_gatenull_membstate.test.sql

@@ -23,7 +23,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(27);
+select plan(28);
 
 -- ---------------------------------------------------------------------------
 -- Phase 0: exactly one pg_proc row per name (a changed arg list would OVERLOAD, not replace)
@@ -340,13 +340,16 @@ select set_config('request.jwt.claim.role', 'authenticated', true);
 select throws_ok(
   $$ select agent_board.resolve_board_request((select board from _f), (select nopend from _f3), 'joined', (select owner_agent from _f)) $$,
   'P0002', null, 'NULLFIX: cannot resolve an agent with no pending request straight to joined');
--- 27 — resolving a GENUINE request still works (service path).
+-- Consiliency/message-board#668: resolution requires a resolved owner/admin identity.
 reset role;
 select set_config('request.jwt.claim.sub', '', true);
 select set_config('request.jwt.claim.role', '', true);
-select lives_ok(
+select throws_ok(
   $$ select agent_board.resolve_board_request((select board from _f), (select victim from _f), 'joined', (select owner_agent from _f)) $$,
-  'NO-REGRESSION: a genuine invited/requested membership still resolves');
+  '42501', null, 'unresolved service_role cannot resolve a pending membership');
+select is((select membership_state from agent_board.board_memberships
+            where board_id=(select board from _f) and agent_id=(select victim from _f)),
+          'invited', 'service-role refusal preserves the pending membership');
 
 select * from finish();
 rollback;

package/tests/agent_board_grant_target_role.test.sql

@@ -611,9 +611,9 @@ select results_eq(format('select label, membership_state, role from pg_temp.g674
   $$values ('G', 'joined', 'owner')$$,
   'A3.pre');
 select pg_temp.g674_as('A3', 'G');
-select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A3'), pg_temp.g674_a('A3', 'G'), 'admin'), 'A3.call');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A3'), pg_temp.g674_a('A3', 'G'), 'admin'), '23514', 'last_active_board_owner: cannot remove the last active owner', 'A3.call');
 select pg_temp.g674_service();
-select is(pg_temp.g674_post('A3', 'G'), 'G[joined/admin/written] owners=0', 'A3.post');
+select is(pg_temp.g674_post('A3', 'G'), 'G[joined/owner/pinned] owners=1', 'A3.post');
 
 -- A4: admin -> member, admin: ceiling 3<=3, then 3>2
 insert into _g674_case values ('A4', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "member", "_creator": "O"}'::jsonb));
@@ -711,9 +711,9 @@ select results_eq(format('select label, membership_state, role from pg_temp.g674
   $$values ('G', 'joined', 'owner')$$,
   'A10.3.pre');
 select pg_temp.g674_as('A10.3', 'G');
-select lives_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A10.3'), pg_temp.g674_a('A10.3', 'G'), 'admin'), 'A10.3.call');
+select throws_ok(format('select * from agent_board.grant_board_role(%L::uuid, %L::uuid, %L, null)', pg_temp.g674_b('A10.3'), pg_temp.g674_a('A10.3', 'G'), 'admin'), '23514', 'last_active_board_owner: cannot remove the last active owner', 'A10.3.call');
 select pg_temp.g674_service();
-select is(pg_temp.g674_post('A10.3', 'G'), 'G[joined/admin/written] owners=0', 'A10.3.post');
+select is(pg_temp.g674_post('A10.3', 'G'), 'G[joined/owner/pinned] owners=1', 'A10.3.post');
 
 -- A10.4: A4 with the role gate on
 insert into _g674_case values ('A10.4', pg_temp.g674_board('{"O": "owner", "G": "admin", "T": "member", "_creator": "O", "_gate": true}'::jsonb));

package/tests/agent_board_hosted_delegates.test.sql

@@ -165,16 +165,17 @@ begin
   end loop;
 end $$;
 
--- Keyed agents: K (board owner/admin everywhere), K2 (member), Z1 (only on BZ).
+-- Keyed agents: K (board owner/admin everywhere), K2 (member), Z1 (only on BZ),
+-- and a coowner of BW so its principal-departure cascade leaves an active owner.
 insert into auth.users(id, instance_id, aud, role, email)
 select ('5e000000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
        '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'hosted-k' || n || '@t.test'
-  from generate_series(1, 3) n;
+  from generate_series(1, 4) n;
 insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
 select ('5e100000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid, 'agent', 'agent',
        'hosted-keyed-' || n, 'Hosted Keyed ' || n, 'active',
        ('5e000000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid
-  from generate_series(1, 3) n;
+  from generate_series(1, 4) n;
 select pg_temp.put('K', '5e100000-0000-4000-8000-000000000001'),
        pg_temp.put('K.auth', '5e000000-0000-4000-8000-000000000001'),
        pg_temp.put('K2', '5e100000-0000-4000-8000-000000000002'),
@@ -200,6 +201,7 @@ values (pg_temp.u('BX'), pg_temp.u('K'),  'owner',  'joined', pg_temp.u('K')),
        (pg_temp.u('BZ'), pg_temp.u('K'),  'owner',  'joined', pg_temp.u('K')),
        (pg_temp.u('BZ'), pg_temp.u('Z1'), 'member', 'joined', pg_temp.u('K')),
        (pg_temp.u('BW'), pg_temp.u('OA'), 'owner',  'joined', pg_temp.u('OA')),
+       (pg_temp.u('BW'), '5e100000-0000-4000-8000-000000000004', 'owner', 'joined', pg_temp.u('OA')),
        (pg_temp.u('BW'), pg_temp.u('K'),  'member', 'joined', pg_temp.u('OA'));
 
 -- ===========================================================================

package/tests/agent_board_invite_no_downgrade.test.sql

@@ -513,14 +513,16 @@ select is(
 -- A new view over this table is then a loud event that forces its author to decide whether it
 -- is writable, which is the decision that would otherwise be made silently.
 select is(
-  (select coalesce(array_agg(t.tgname::text order by t.tgname::text), array[]::text[])
+  (select coalesce(array_agg(t.tgname::text || ':' || t.tgtype::text || ':' || p.proname::text
+                           order by t.tgname::text), array[]::text[])
      from pg_trigger t
      join pg_class c on c.oid = t.tgrelid
      join pg_namespace n on n.oid = c.relnamespace
+     join pg_proc p on p.oid = t.tgfoid
     where n.nspname = 'agent_board' and c.relname = 'board_memberships'
       and not t.tgisinternal),
-  array[]::text[],
-  '#317: no user trigger on board_memberships — a trigger assigning NEW.membership_state would bypass every source predicate above');
+  array['trg_board_memberships_last_owner_guard:27:_board_memberships_last_owner_guard']::text[],
+  '#317: only the exact UPDATE/DELETE last-owner guard is installed; new state-rewriting triggers name themselves (preserved-state controls are in agent_board_role_guard)');
 
 select is(
   (select coalesce(array_agg(r.rulename::text order by r.rulename::text), array[]::text[])

package/tests/agent_board_ledger_authority.test.sql

@@ -652,6 +652,13 @@ select is(
 
 select pg_temp.service();
 
+-- Preserve a coowner while testing the returning owner's role clamp.
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+values ('27610000-0000-4000-8000-000000000007','agent','agent','k276-coowner','K276 Coowner','active');
+insert into agent_board.board_memberships(board_id,agent_id,role,membership_state,created_by_agent_id)
+values ('27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000007','owner','joined','27610000-0000-4000-8000-000000000003');
+select agent_board._lock_board_authority_ceiling('27620000-0000-4000-8000-000000000002');
+
 select lives_ok(
   $$create temp table _cl as select agent_board._upsert_board_membership_state(
       '27620000-0000-4000-8000-000000000002','27610000-0000-4000-8000-000000000003',

package/tests/agent_board_policy_correlation.test.sql

@@ -0,0 +1,189 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(41);
+create function pg_temp.a(n integer) returns uuid language sql immutable as $$
+ select ('58900000-0000-4000-8000-'||lpad(n::text,12,'0'))::uuid
+$$;
+create function pg_temp.claim(n integer) returns void language plpgsql as $$
+begin perform set_config('request.jwt.claims',json_build_object('role','authenticated','sub',pg_temp.a(n))::text,true); end $$;
+insert into auth.users(id,instance_id,aud,role,email)
+select pg_temp.a(n),'00000000-0000-0000-0000-000000000000','authenticated','authenticated','rls589-'||n||'@test.invalid' from generate_series(1,9)n;
+insert into agent_board.agents(id,agent_type,handle,display_name,status,auth_user_id)
+select pg_temp.a(n),'agent','rls589-'||n,'RLS '||n,'active',pg_temp.a(n) from generate_series(1,9)n;
+insert into agent_board.boards(id,slug,name,created_by_agent_id,visibility) values(pg_temp.a(200),'rls589','RLS',pg_temp.a(1),'private');
+insert into agent_board.board_memberships(id,board_id,agent_id,membership_state,role,created_by_agent_id)
+values(pg_temp.a(201),pg_temp.a(200),pg_temp.a(1),'joined','owner',pg_temp.a(1)),
+      (pg_temp.a(202),pg_temp.a(200),pg_temp.a(3),'joined','member',pg_temp.a(3));
+insert into agent_board.threads(id,created_by_agent_id,subject)
+select pg_temp.a(n),pg_temp.a(1),'RLS '||n from generate_series(100,106)n;
+insert into agent_board.messages(id,thread_id,author_agent_id,message_sequence,body)
+values(pg_temp.a(300),pg_temp.a(100),pg_temp.a(2),1,'Board-visible message'),
+      (pg_temp.a(301),pg_temp.a(103),pg_temp.a(1),1,'Unrelated message');
+insert into agent_board.tasks(id,thread_id,created_by_agent_id,assigned_agent_id,title,parent_task_id,root_task_id)
+values(pg_temp.a(400),pg_temp.a(101),pg_temp.a(1),pg_temp.a(5),'Assigned task',null,null),
+      (pg_temp.a(401),pg_temp.a(102),pg_temp.a(6),pg_temp.a(6),'Parent',null,null),
+      (pg_temp.a(402),pg_temp.a(102),pg_temp.a(7),pg_temp.a(7),'Child',pg_temp.a(401),pg_temp.a(401)),
+      (pg_temp.a(403),pg_temp.a(103),pg_temp.a(1),pg_temp.a(1),'Unrelated parent',null,null),
+      (pg_temp.a(404),pg_temp.a(103),pg_temp.a(1),pg_temp.a(1),'Unrelated child',pg_temp.a(403),pg_temp.a(403)),
+      (pg_temp.a(405),pg_temp.a(105),pg_temp.a(1),pg_temp.a(1),'Board-delivered task',null,null);
+insert into agent_board.delegations(id,parent_task_id,child_task_id,delegated_by_agent_id,delegated_to_agent_id)
+values(pg_temp.a(500),pg_temp.a(401),pg_temp.a(402),pg_temp.a(8),pg_temp.a(9)),
+      (pg_temp.a(501),pg_temp.a(403),pg_temp.a(404),pg_temp.a(1),pg_temp.a(1));
+insert into agent_board.delivery_recipients(delivery_mode,recipient_agent_id,source_kind,source_message_id,source_task_id,board_id,board_membership_id)
+values('board',pg_temp.a(1),'message',pg_temp.a(300),null,pg_temp.a(200),pg_temp.a(201)),
+      ('direct',pg_temp.a(9),'message',pg_temp.a(300),null,null,null),
+      ('tasking',pg_temp.a(1),'task',null,pg_temp.a(405),pg_temp.a(200),pg_temp.a(201));
+insert into agent_board.board_authority_ceilings(board_id) values(pg_temp.a(200));
+insert into agent_board.thread_memberships(id,thread_id,agent_id,granted_by_agent_id)
+values(pg_temp.a(600),pg_temp.a(100),pg_temp.a(2),pg_temp.a(1));
+insert into agent_board.read_receipts(thread_id,agent_id) values(pg_temp.a(104),pg_temp.a(3));
+create temp table captured(label text,id uuid);
+grant select,insert on captured to authenticated;
+
+-- Compare all policies, deriving FK/key column pairs from the constraint catalog.
+create temp table policy_sites as
+select p.oid,p.polname,c.relname,p.polroles,
+       agent_board_test.strip_sql(coalesce(pg_get_expr(p.polqual,p.polrelid),'')||' '||coalesce(pg_get_expr(p.polwithcheck,p.polrelid),'')) as expr
+from pg_policy p join pg_class c on c.oid=p.polrelid join pg_namespace n on n.oid=c.relnamespace where n.nspname='agent_board';
+with pairs as (
+ select distinct a.attname::text as fk,b.attname::text as key
+ from pg_constraint c join pg_class r on r.oid=c.conrelid join pg_namespace n on n.oid=r.relnamespace
+ cross join lateral unnest(c.conkey,c.confkey) k(src,dst)
+ join pg_attribute a on a.attrelid=c.conrelid and a.attnum=k.src
+ join pg_attribute b on b.attrelid=c.confrelid and b.attnum=k.dst
+ where c.contype='f' and n.nspname='agent_board'
+), refs as (
+ select s.relname||'.'||s.polname||': '||m[1]||'.'||m[2]||' = '||m[1]||'.'||m[3] as site,trim(both '"' from m[2]) as lhs,trim(both '"' from m[3]) as rhs
+ from policy_sites s cross join lateral regexp_matches(s.expr,agent_board_test.re('('||agent_board_test.ident_any_frag()||')\s*\.\s*('||agent_board_test.ident_any_frag()||')\s*=\s*\1\s*\.\s*('||agent_board_test.ident_any_frag()||')'),'g')m
+)
+select is((select coalesce(string_agg(distinct site,', ' order by site),'') from refs where lhs=rhs or exists(select 1 from pairs where (lhs=fk and rhs=key) or (rhs=fk and lhs=key))),'','RLS-1 no policy self-comparison or same-alias foreign-key/key comparison; offenders named');
+create temp table policy_functions as
+select distinct s.relname,s.polname,f.oid,f.oid::regprocedure::text as signature,f.prosecdef
+from policy_sites s join pg_depend d on d.classid='pg_policy'::regclass and d.objid=s.oid and d.refclassid='pg_proc'::regclass
+join pg_proc f on f.oid=d.refobjid join pg_namespace n on n.oid=f.pronamespace
+where n.nspname='agent_board' and exists(select 1 from unnest(s.polroles) r(role_id)
+ where case when role_id=0 then true else pg_has_role('authenticated',role_id,'USAGE') end);
+select is((select coalesce(string_agg(relname||'.'||polname||': '||signature,', ' order by relname,polname,signature),'') from policy_functions where not has_function_privilege('authenticated',oid,'EXECUTE')),'','RLS-2 every authenticated policy function is executable; offenders named');
+select cmp_ok((select count(*) from policy_sites),'>',0::bigint,'RLS-3 catalog policy class is nonempty');
+select is((select coalesce(string_agg(distinct signature,', ' order by signature),'') from policy_functions where prosecdef and has_function_privilege('anon',oid,'EXECUTE')),'','RLS-4 authenticated policy definers are not anonymous-callable');
+
+select pg_temp.claim(2);
+set local role authenticated;
+select lives_ok($$insert into captured select 'message-author',id from agent_board.threads where id in (pg_temp.a(100),pg_temp.a(103))$$,'RLS-5 message-author SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='message-author'),array[pg_temp.a(100)]::uuid[],'RLS-6 message-author visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'board-member',id from agent_board.threads where id in (pg_temp.a(100),pg_temp.a(103))$$,'RLS-7 board-member SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='board-member'),array[pg_temp.a(100)]::uuid[],'RLS-8 board-member visible rows are scoped');
+
+select pg_temp.claim(5);
+set local role authenticated;
+select lives_ok($$insert into captured select 'task-assignee',id from agent_board.threads where id in (pg_temp.a(101),pg_temp.a(103))$$,'RLS-9 task-assignee SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='task-assignee'),array[pg_temp.a(101)]::uuid[],'RLS-10 task-assignee visible rows are scoped');
+
+select pg_temp.claim(6);
+set local role authenticated;
+select lives_ok($$insert into captured select 'parent-task-owner',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-11 parent-task-owner SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='parent-task-owner'),array[pg_temp.a(500)]::uuid[],'RLS-12 parent-task-owner visible rows are scoped');
+
+select pg_temp.claim(7);
+set local role authenticated;
+select lives_ok($$insert into captured select 'child-task-owner',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-13 child-task-owner SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='child-task-owner'),array[pg_temp.a(500)]::uuid[],'RLS-14 child-task-owner visible rows are scoped');
+
+select pg_temp.claim(8);
+set local role authenticated;
+select lives_ok($$insert into captured select 'delegator',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-15 delegator SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='delegator'),array[pg_temp.a(500)]::uuid[],'RLS-16 delegator visible rows are scoped');
+
+select pg_temp.claim(9);
+set local role authenticated;
+select lives_ok($$insert into captured select 'delegate-recipient',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-17 delegate-recipient SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='delegate-recipient'),array[pg_temp.a(500)]::uuid[],'RLS-18 delegate-recipient visible rows are scoped');
+
+select pg_temp.claim(1);
+set local role authenticated;
+select lives_ok($$insert into captured select 'thread-creator',id from agent_board.threads where id=pg_temp.a(106)$$,'RLS-19 thread-creator SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='thread-creator'),array[pg_temp.a(106)]::uuid[],'RLS-20 thread-creator visible rows are scoped');
+
+select pg_temp.claim(4);
+set local role authenticated;
+select lives_ok($$insert into captured select 'outsider-threads',id from agent_board.threads where id between pg_temp.a(100) and pg_temp.a(105)$$,'RLS-21 outsider-threads SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='outsider-threads'),array[]::uuid[],'RLS-22 outsider-threads visible rows are scoped');
+
+select pg_temp.claim(4);
+set local role authenticated;
+select lives_ok($$insert into captured select 'outsider-delegations',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-23 outsider-delegations SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='outsider-delegations'),array[]::uuid[],'RLS-24 outsider-delegations visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'member-ceiling',board_id from agent_board.board_authority_ceilings where board_id=pg_temp.a(200)$$,'RLS-25 member-ceiling SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='member-ceiling'),array[pg_temp.a(200)]::uuid[],'RLS-26 member-ceiling visible rows are scoped');
+
+select pg_temp.claim(4);
+set local role authenticated;
+select lives_ok($$insert into captured select 'outsider-ceiling',board_id from agent_board.board_authority_ceilings where board_id=pg_temp.a(200)$$,'RLS-27 outsider-ceiling SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='outsider-ceiling'),array[]::uuid[],'RLS-28 outsider-ceiling visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'member-thread-acl',id from agent_board.thread_memberships where id=pg_temp.a(600)$$,'RLS-29 member-thread-acl SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='member-thread-acl'),array[pg_temp.a(600)]::uuid[],'RLS-30 member-thread-acl visible rows are scoped');
+
+select pg_temp.claim(4);
+set local role authenticated;
+select lives_ok($$insert into captured select 'outsider-thread-acl',id from agent_board.thread_memberships where id=pg_temp.a(600)$$,'RLS-31 outsider-thread-acl SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='outsider-thread-acl'),array[]::uuid[],'RLS-32 outsider-thread-acl visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'receipt-reader',id from agent_board.threads where id=pg_temp.a(104)$$,'RLS-33 receipt-reader SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='receipt-reader'),array[pg_temp.a(104)]::uuid[],'RLS-34 receipt-reader visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'member-unrelated-delegation',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-35 member-unrelated-delegation SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='member-unrelated-delegation'),array[]::uuid[],'RLS-36 member-unrelated-delegation visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'board-task-delivery',id from agent_board.threads where id in (pg_temp.a(105),pg_temp.a(103))$$,'RLS-37 board-task-delivery SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='board-task-delivery'),array[pg_temp.a(105)]::uuid[],'RLS-38 board-task-delivery visible rows are scoped');
+
+select pg_temp.claim(9);
+set local role authenticated;
+select lives_ok($$insert into captured select 'direct-message-recipient',id from agent_board.threads where id in (pg_temp.a(100),pg_temp.a(103))$$,'RLS-39 direct-message-recipient SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='direct-message-recipient'),array[pg_temp.a(100)]::uuid[],'RLS-40 direct-message-recipient visible rows are scoped');
+
+
+-- Catalog provenance is part of the read contract: grants must not erase the ruling.
+select ok(coalesce(
+  obj_description('agent_board._current_agent_can_access_thread(uuid)'::regprocedure, 'pg_proc') like '%message-board#291%'
+  and obj_description('agent_board._current_agent_can_access_thread(uuid)'::regprocedure, 'pg_proc') like '%REVERSING A RULING%'
+  and obj_description('agent_board._current_agent_can_access_thread(uuid)'::regprocedure, 'pg_proc') like '%restricted%is UNREACHABLE%'
+  and obj_description('agent_board._current_agent_can_access_thread(uuid)'::regprocedure, 'pg_proc') like '%Callable by authenticated for its RLS policies and by service_role.%',
+  false), 'RLS-41 thread access comment preserves the ratified claims ruling and dormant ACL');
+
+select * from finish();
+rollback;

package/tests/agent_board_request_removed.test.sql

@@ -0,0 +1,96 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(33);
+create function pg_temp.a(n integer) returns uuid language sql immutable as $$
+  select ('68000000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid
+$$;
+create function pg_temp.claim(n integer) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role','authenticated','sub',pg_temp.a(n))::text,true);
+end $$;
+insert into auth.users(id, instance_id, aud, role, email)
+select pg_temp.a(n),'00000000-0000-0000-0000-000000000000','authenticated','authenticated','removed680-'||n||'@test.invalid'
+from generate_series(1,9) n;
+insert into agent_board.agents(id,agent_type,handle,display_name,status,auth_user_id)
+select pg_temp.a(n),'agent','removed680-'||n,'Removed '||n,'active',pg_temp.a(n)
+from generate_series(1,9) n;
+insert into agent_board.boards(id,slug,name,created_by_agent_id,visibility)
+values (pg_temp.a(100),'removed680-open','Open',pg_temp.a(1),'open'),
+       (pg_temp.a(101),'removed680-link','Link',pg_temp.a(1),'invite_only'),
+       (pg_temp.a(102),'removed680-private','Private',pg_temp.a(1),'private');
+insert into agent_board.board_memberships(board_id,agent_id,membership_state,role,created_by_agent_id)
+select pg_temp.a(n),pg_temp.a(1),'joined','owner',pg_temp.a(1) from generate_series(100,102) n;
+insert into agent_board.board_memberships(board_id,agent_id,membership_state,role,created_by_agent_id,left_at,metadata)
+values (pg_temp.a(100),pg_temp.a(2),'removed','member',pg_temp.a(1),now(),'{"eviction":true}'),
+       (pg_temp.a(101),pg_temp.a(2),'removed','member',pg_temp.a(1),now(),'{"eviction":true}'),
+       (pg_temp.a(100),pg_temp.a(3),'removed','member',pg_temp.a(1),now(),'{"eviction":true}'),
+       (pg_temp.a(100),pg_temp.a(3),'left','member',pg_temp.a(1),now(),'{"left":true}'),
+       (pg_temp.a(100),pg_temp.a(5),'left','member',pg_temp.a(5),now(),'{}'),
+       (pg_temp.a(100),pg_temp.a(6),'requested','member',pg_temp.a(6),null,'{}'),
+       (pg_temp.a(100),pg_temp.a(7),'removed','member',pg_temp.a(1),now(),'{"eviction":true}'),
+       (pg_temp.a(100),pg_temp.a(7),'joined','member',pg_temp.a(7),null,'{"active":true}'),
+       (pg_temp.a(100),pg_temp.a(8),'subscribed','member',pg_temp.a(8),null,'{"active":true}');
+update agent_board.board_memberships set created_at=now()-interval '1 day'
+ where board_id=pg_temp.a(100) and agent_id=pg_temp.a(3) and membership_state='removed';
+select pg_temp.claim(1);
+create temp table live_link as select * from agent_board.create_invite_link(pg_temp.a(101),'member','joined',null,null,pg_temp.a(1));
+
+create temp table request_sites as
+select p.oid,p.proname::text as name,agent_board_test.stripped_body(p.oid) as body,
+       agent_board_test.stripped_body(p.oid,true) as literals
+from pg_proc p join pg_namespace n on n.oid=p.pronamespace
+where n.nspname='agent_board' and has_function_privilege('authenticated',p.oid,'EXECUTE')
+  and agent_board_test.stripped_body(p.oid,true) ~ agent_board_test.re(
+    agent_board_test.call_frag('_upsert_board_membership_state') || '[^,;]*,[^,;]*,\s*''requested''\s*,');
+select is((select string_agg(name,',' order by name) from request_sites),'request_join_board','REM-1 literal-request sink callers enumerated from catalog');
+select is((select coalesce(string_agg(name,','),'') from request_sites where body !~ agent_board_test.row_lock_re('board_memberships')),'','REM-2 every request writer locks membership rows; offenders named');
+select is((select coalesce(string_agg(name,','),'') from request_sites
+           where regexp_instr(body,agent_board_test.row_lock_re('board_memberships'))=0
+              or regexp_instr(body,agent_board_test.row_lock_re('board_memberships')) >= regexp_instr(body,agent_board_test.call_re('_upsert_board_membership_state'))
+              or regexp_instr(body,agent_board_test.row_lock_re('board_memberships')) >= regexp_instr(body,agent_board_test.re(agent_board_test.ci_re('if') || '\s+' || agent_board_test.ci_re('exists') || '\s*\('))
+              or literals !~ 'board join request refused for removed standing'),
+          '','REM-3 every request writer checks removed standing before its sink');
+select is((select coalesce(string_agg(name,','),'') from request_sites where has_function_privilege('anon',oid,'EXECUTE') or not has_function_privilege('service_role',oid,'EXECUTE') or obj_description(oid,'pg_proc') is null),'','REM-4 request writer ACL and comment');
+
+select pg_temp.claim(2);
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(2),'{"overwrite":true}')$$,'42501',null,'REM-5 removed open-board request refused');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(2)),'removed','REM-6 eviction persists after request');
+select is((select count(*)::integer from agent_board.board_membership_events where board_id=pg_temp.a(100) and agent_id=pg_temp.a(2)),0,'REM-7 refused request emits no membership event');
+select throws_ok($$select agent_board.join_board(pg_temp.a(100),pg_temp.a(2))$$,'P0002',null,'REM-8 request cannot unlock open self-join');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(2)),'removed','REM-9 self-join leaves eviction intact');
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(101),pg_temp.a(2))$$,'42501',null,'REM-10 removed invite-only request refused');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(2)),'removed','REM-11 invite-only eviction persists');
+select throws_ok($$select agent_board.redeem_invite_link((select code from live_link))$$,'42501',null,'REM-12 request cannot unlock live-link redemption');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(2)),'removed','REM-13 live link leaves eviction intact');
+select is((select uses_count from agent_board.board_invite_tokens where id=(select invite_id from live_link)),0,'REM-14 refused redemption consumes no use');
+
+select pg_temp.claim(3);
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(3),'{"overwrite":true}')$$,'42501',null,'REM-15 removed plus left standing refused');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(3)),'left,removed','REM-16 whole row set preserved');
+select is((select metadata from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(3) and membership_state='removed'),'{"eviction":true}'::jsonb,'REM-17 denied request preserves eviction metadata');
+select pg_temp.claim(4);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(4))$$,'REM-18 first request succeeds');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(4)),'requested','REM-19 first request stored');
+select pg_temp.claim(5);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(5))$$,'REM-20 voluntary leaver can request');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(5)),'requested','REM-21 voluntary request stored');
+select pg_temp.claim(6);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(6))$$,'REM-22 repeated pending request succeeds');
+select is((select count(*)::integer from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(6) and membership_state='requested'),1,'REM-23 repeat preserves one pending row');
+select pg_temp.claim(7);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(7),'{"overwrite":true}')$$,'REM-24 active plus removed remains a no-op');
+select is((select metadata from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(7) and membership_state='joined'),'{"active":true}'::jsonb,'REM-25 active row remains unchanged');
+select pg_temp.claim(8);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(8))$$,'REM-26 subscribed request remains a no-op');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(8)),'subscribed','REM-27 subscription preserved');
+select set_config('request.jwt.claims','{"role":"service_role"}',true);
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(2))$$,'42501',null,'REM-28 service request cannot erase removal');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(2)),'removed','REM-29 service refusal preserves eviction');
+select pg_temp.claim(9);
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(102),pg_temp.a(9))$$,'P0002',null,'REM-30 private board request still hidden');
+select is((select count(*)::integer from agent_board.board_memberships where board_id=pg_temp.a(102) and agent_id=pg_temp.a(9)),0,'REM-31 hidden request writes nothing');
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(4))$$,'42501',null,'REM-32 request remains self-only');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(4)),'requested','REM-33 actor mismatch preserves target');
+select * from finish();
+rollback;