@consiliency/agent-board-schema 1.63.0 → 1.68.0

package/tests/agent_board_roomdeleg.test.sql

@@ -36,6 +36,7 @@ declare
   v_requester uuid := gen_random_uuid();
   v_nomember uuid := gen_random_uuid();
   v_suspended uuid := gen_random_uuid();
+  v_coowner uuid := gen_random_uuid();
   v_board uuid;
   v_slug text := 'roomdeleg-board-' || v_suffix;
 begin
@@ -54,6 +55,9 @@ begin
     (v_requester, 'agent', 'rd-requester-' || v_suffix, 'RD Requester', 'active', null, null),
     (v_nomember, 'agent', 'rd-nomember-' || v_suffix, 'RD NoMember', 'active', null, null);
 
+  insert into agent_board.agents(id, agent_type, handle, display_name, status)
+  values (v_coowner, 'agent', 'rd-coowner-' || v_suffix, 'RD Coowner', 'active');
+
   -- Alice creates board (service_role null-actor here -> supplied arg honored):
   -- create_board seeds Alice's joined owner membership (ROOMOWN).
   select board_id into v_board
@@ -66,6 +70,9 @@ begin
     (v_board, v_bob, 'joined', v_alice, 'member'),
     (v_board, v_requester, 'requested', v_alice, 'member');
 
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values (v_board, v_coowner, 'joined', v_alice, 'owner');
+
   insert into _roomdeleg_fixture values
     (v_board, v_alice, v_bob, v_target, v_requester, v_nomember, v_suspended,
      v_alice_user, v_bob_user, v_suspended_user);
@@ -127,6 +134,7 @@ select lives_ok(
 
 -- Demote the creator to member (bare statement, not an assertion). created_by is
 -- immutable, so this models a creator who has lost owner authority.
+select agent_board._lock_board_authority_ceiling(board) from _roomdeleg_fixture;
 update agent_board.board_memberships bm
    set role = 'member'
   from _roomdeleg_fixture f

package/tests/agent_board_roomown.test.sql

@@ -73,7 +73,9 @@ begin
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
   values
     (v_board, v_member, 'joined', v_alice, 'member'),
-    (v_board, v_grantee, 'joined', v_alice, 'observer');
+    (v_board, v_grantee, 'joined', v_alice, 'observer'),
+    -- Keep another owner for the creator self-demotion / slug-collision control.
+    (v_board, v_b2owner, 'joined', v_alice, 'owner');
 
   -- Board B2: an owner-LESS board (direct insert, no membership) for the bootstrap sweep.
   insert into agent_board.boards(id, slug, name, description, created_by_agent_id, visibility)

package/tests/agent_board_rowid.test.sql

@@ -323,6 +323,9 @@ begin
       v_left_creator, 'rowid-bootstrap-left-' || s, 'ROWID Bootstrap Left',
       'leave-again recovery', '{}'::jsonb, 'open'
     );
+  -- ROLEGUARD: this creator may depart while another active owner remains.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role)
+  values (v_left_board, v_writer_owner, 'joined', 'owner');
 
   -- Writer 1: a genuine create_board insert.
   select board_id into v_writer_board
@@ -660,7 +663,7 @@ select is(
        on bm.board_id = f.left_board and bm.agent_id = f.left_creator
     where bm.membership_state in ('joined', 'subscribed')),
   'member',
-  'left recovery: ROLERESET rejoin clamps the sole creator to member');
+  'left recovery: ROLERESET rejoin clamps the departing creator to member');
 select lives_ok(
   (select format(
     $q$select agent_board.update_board_membership(%L::uuid, %L::uuid, 'left')$q$,

package/tests/agent_board_session_provenance.test.sql

@@ -0,0 +1,106 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(32);
+
+create function pg_temp.a(n integer) returns uuid language sql immutable as $$
+  select ('66500000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid
+$$;
+create function pg_temp.claim(n integer) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub', pg_temp.a(n))::text, true);
+end
+$$;
+insert into auth.users(id, instance_id, aud, role, email)
+select pg_temp.a(n), '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'prov665-' || n || '@test.invalid'
+from generate_series(1, 15) n;
+insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id)
+select pg_temp.a(n), 'agent', 'prov665-' || n, 'Provenance ' || n, 'active', pg_temp.a(n)
+from generate_series(1, 15) n;
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility)
+values (pg_temp.a(100), 'prov665', 'Provenance', pg_temp.a(1), 'open');
+insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
+values (pg_temp.a(100), pg_temp.a(1), 'joined', 'owner', pg_temp.a(1)),
+       (pg_temp.a(100), pg_temp.a(5), 'requested', 'member', pg_temp.a(5)),
+       (pg_temp.a(100), pg_temp.a(6), 'requested', 'member', pg_temp.a(6)),
+       (pg_temp.a(100), pg_temp.a(6), 'joined', 'member', pg_temp.a(6)),
+       (pg_temp.a(100), pg_temp.a(10), 'requested', 'member', pg_temp.a(10)),
+       (pg_temp.a(100), pg_temp.a(15), 'requested', 'member', pg_temp.a(15)),
+       (pg_temp.a(100), pg_temp.a(15), 'joined', 'member', pg_temp.a(15));
+-- Subject-authored requests establish the consent an approval needs (#82).
+do $$ declare a integer; begin
+  for a in 13..14 loop
+    perform pg_temp.claim(a);
+    perform agent_board.request_join_board(pg_temp.a(100), pg_temp.a(a));
+  end loop;
+end $$;
+create temp table active_before as
+select id, created_by_agent_id from agent_board.board_memberships
+ where board_id = pg_temp.a(100) and agent_id = pg_temp.a(15) and membership_state = 'joined';
+
+-- The population is catalog-derived. No exemption list or hard-coded RPC scan.
+create temp table provenance_sites as
+select p.oid, p.oid::regprocedure::text as signature,
+       agent_board_test.stripped_body(p.oid) as body
+from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = 'agent_board'
+  and 'p_created_by_agent_id' = any(p.proargnames)
+  and has_function_privilege('authenticated', p.oid, 'EXECUTE')
+  and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('agent_board._upsert_board_membership_state');
+select is((select string_agg(p.proname::text, ',' order by p.proname) from provenance_sites s join pg_proc p on p.oid = s.oid),
+          'invite_board_member,join_board,resolve_board_request', 'PROV-1 membership provenance class population');
+select is((select coalesce(string_agg(signature, ', '), '') from provenance_sites where body ~ agent_board_test.ident_re('p_created_by_agent_id')),
+          '', 'PROV-2 no membership RPC consumes caller-asserted provenance; offenders named');
+select is((select coalesce(string_agg(signature, ', '), '') from provenance_sites
+           where has_function_privilege('anon', oid, 'EXECUTE') or not has_function_privilege('service_role', oid, 'EXECUTE')),
+          '', 'PROV-3 membership provenance class has restricted ACLs');
+select is((select coalesce(string_agg(signature, ', '), '') from provenance_sites where obj_description(oid, 'pg_proc') is null),
+          '', 'PROV-4 membership provenance class documents attribution');
+
+select pg_temp.claim(1);
+select lives_ok($$select agent_board.invite_board_member(pg_temp.a(100), pg_temp.a(3), pg_temp.a(2))$$, 'PROV-5 invite accepts compatibility attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(3)), pg_temp.a(1), 'PROV-6 invite attribution is session actor');
+select lives_ok($$select agent_board.invite_board_member(pg_temp.a(100), pg_temp.a(4), null)$$, 'PROV-7 invite accepts NULL attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(4)), pg_temp.a(1), 'PROV-8 NULL invite attribution is session actor');
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(5), 'removed', pg_temp.a(2))$$, 'PROV-9 resolution accepts compatibility attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(5) and membership_state = 'left'), pg_temp.a(1), 'PROV-10 resolution attribution is session actor');
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(6), 'joined', pg_temp.a(2))$$, 'PROV-11 redundant pending retirement succeeds');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(6) and membership_state = 'left'), pg_temp.a(1), 'PROV-12 retirement attribution is session actor');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(6) and membership_state = 'joined'), pg_temp.a(6), 'PROV-13 no-op preserves active row attribution');
+
+select pg_temp.claim(7);
+select lives_ok($$select agent_board.join_board(pg_temp.a(100), pg_temp.a(7), 'joined', pg_temp.a(2))$$, 'PROV-14 self-join accepts compatibility attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(7)), pg_temp.a(7), 'PROV-15 join attribution is session actor');
+select pg_temp.claim(8);
+select lives_ok($$select agent_board.join_board(pg_temp.a(100), pg_temp.a(8), 'joined', null)$$, 'PROV-16 self-join accepts NULL attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(8)), pg_temp.a(8), 'PROV-17 NULL join attribution is session actor');
+
+select set_config('request.jwt.claims', '{"role":"service_role"}', true);
+select lives_ok($$select agent_board.invite_board_member(pg_temp.a(100), pg_temp.a(9), pg_temp.a(2))$$, 'PROV-18 unresolved service invitation succeeds');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(9)), null::uuid, 'PROV-19 service invitation does not invent agent attribution');
+-- #668 (owner-confirmed 2026-10-26): resolution requires a RESOLVED same-board owner/admin, so an
+-- unresolved service-role session is refused and the pending row keeps its state and provenance.
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(10), 'removed', pg_temp.a(2))$$, '42501', null, 'PROV-20 unresolved service resolution refused');
+select is((select string_agg(membership_state || ':' || coalesce(created_by_agent_id::text, 'null'), ',') from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(10)),
+          'requested:' || pg_temp.a(10)::text, 'PROV-21 refused service resolution leaves the pending row and its provenance unchanged');
+select lives_ok($$select agent_board.join_board(pg_temp.a(100), pg_temp.a(11), 'joined', pg_temp.a(2))$$, 'PROV-22 unresolved service join succeeds');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(11)), null::uuid, 'PROV-23 service join does not invent agent attribution');
+select set_config('request.jwt.claims', '{"role":"authenticated"}', true);
+select throws_ok($$select agent_board.invite_board_member(pg_temp.a(100), pg_temp.a(12), pg_temp.a(1))$$, '42501', null, 'PROV-24 unresolved authenticated invite denied');
+select is((select count(*)::integer from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(12)), 0, 'PROV-25 denied invitation writes nothing');
+
+-- A RESOLVED service-role owner session: attribution is that session's agent, never the forged
+-- compatibility argument (pg_temp.a(2) is not even a member).
+select set_config('request.jwt.claims', json_build_object('role', 'service_role', 'sub', pg_temp.a(1))::text, true);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(13), 'joined', pg_temp.a(2))$$, 'PROV-26 resolved service owner approves with forged attribution');
+select is((select string_agg(membership_state || ':' || coalesce(created_by_agent_id::text, 'null'), ',') from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(13)),
+          'joined:' || pg_temp.a(1)::text, 'PROV-27 service owner approval attribution is the session actor');
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(14), 'removed', pg_temp.a(2))$$, 'PROV-28 resolved service owner rejects with forged attribution');
+select is((select string_agg(membership_state || ':' || coalesce(created_by_agent_id::text, 'null'), ',') from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(14)),
+          'left:' || pg_temp.a(1)::text, 'PROV-29 service owner rejection attribution is the session actor');
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(15), 'joined', pg_temp.a(2))$$, 'PROV-30 resolved service owner no-op retires the redundant request');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(15) and membership_state = 'left'), pg_temp.a(1), 'PROV-31 service owner retirement attribution is the session actor');
+select is((select array_agg(row(id, created_by_agent_id)::text) from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(15) and membership_state = 'joined'),
+          (select array_agg(row(id, created_by_agent_id)::text) from active_before), 'PROV-32 no-op keeps the active row identity and attribution');
+select * from finish();
+rollback;

package/tests/catalog/function_execute_privileges.json

@@ -109,6 +109,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "_board_memberships_last_owner_guard",
+      "signature": "_board_memberships_last_owner_guard()",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
     {
       "name": "_build_fetch_descriptor",
       "signature": "_build_fetch_descriptor(p_surface text, p_target_id uuid, p_view text, p_reason text, p_filters jsonb)",
@@ -286,7 +295,7 @@
       "executable_by": {
         "anon": false,
         "service_role": true,
-        "authenticated": false
+        "authenticated": true
       }
     },
     {
@@ -322,7 +331,7 @@
       "executable_by": {
         "anon": false,
         "service_role": true,
-        "authenticated": false
+        "authenticated": true
       }
     },
     {

package/tests/catalog/p_metadata_parameters.json

@@ -49,6 +49,10 @@
       "signature": "_board_membership_events_provenance_guard()",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_board_memberships_last_owner_guard()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_build_fetch_descriptor(p_surface text, p_target_id uuid, p_view text, p_reason text, p_filters jsonb)",
       "declares_p_metadata": false

package/tests/isolation/expected/consent_approval_lock.out

@@ -1,7 +1,7 @@
 Parsed test spec with 3 sessions
 
 starting permutation: a_begin a_resolve w_begin w_leave a_commit w_commit chk
-step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = '115d0000-0000-4000-8000-000000000001';
 step a_resolve: 
   select membership_state
     from agent_board.resolve_board_request(