@consiliency/agent-board-schema 1.64.0 → 1.74.0

package/tests/agent_board_own_post_not_delivered.test.sql

@@ -40,7 +40,7 @@ select plan(40);
 -- The class, derived from pg_proc.
 -- ---------------------------------------------------------------------------
 select is(
-  (select array_agg(p.proname::text order by p.proname)
+  (select array_agg(p.proname::text order by p.proname::text collate "C")
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into|merge into', 'inbox_items')),
@@ -48,17 +48,17 @@ select is(
   'OPN-01: _upsert_inbox_item is the only function that inserts into inbox_items');
 
 select is(
-  (select array_agg(p.proname::text order by p.proname)
+  (select array_agg(p.proname::text order by p.proname::text collate "C")
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_upsert_inbox_item')
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.qname_re('board_memberships')
       and p.proname <> '_upsert_inbox_item'),
-  array['create_tasking_delivery', 'post_board_message'],
+  array['_deliver_board_message', 'create_tasking_delivery'],
   'OPN-02: the board-expanding delivery writers are exactly the two this file asserts behaviourally');
 
 select is(
-  (select array_agg(p.proname::text order by p.proname)
+  (select array_agg(p.proname::text order by p.proname::text collate "C")
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_upsert_inbox_item')
@@ -73,7 +73,7 @@ select is(
 create temp table _opn (
   a_user uuid, b_user uuid,
   a_agent uuid, b_agent uuid,
-  board_ab uuid, board_s uuid, thread uuid, thread_unlinked uuid, thread_unlinked2 uuid
+  board_ab uuid, board_s uuid, thread uuid, thread_unlinked uuid, thread_unlinked2 uuid, thread_sole_post uuid
 ) on commit drop;
 create temp table _opn_post (message_id uuid, board_id uuid, delivered_recipient_count integer,
   callback_outbox_count integer, created_at timestamptz) on commit drop;
@@ -106,6 +106,7 @@ declare
   v_thread uuid := '76080000-0000-4000-8000-000000000010';
   v_thread_unlinked uuid := '76080000-0000-4000-8000-000000000011';
   v_thread_unlinked2 uuid := '76080000-0000-4000-8000-000000000012';
+  v_thread_sole_post uuid := '76080000-0000-4000-8000-000000000013';
   v_board_ab uuid;
   v_board_s uuid;
   v_endpoint uuid;
@@ -120,7 +121,8 @@ begin
   insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
   values (v_thread, 'coordination', v_a, 'OPN thread'),
          (v_thread_unlinked, 'coordination', v_a, 'OPN unlinked thread'),
-         (v_thread_unlinked2, 'coordination', v_a, 'OPN second unlinked thread');
+         (v_thread_unlinked2, 'coordination', v_a, 'OPN second unlinked thread'),
+         (v_thread_sole_post, 'coordination', v_a, 'OPN empty sole-post thread');
 
   select board_id into v_board_ab
     from agent_board.create_board(v_a, 'opn-board-ab', 'OPN AB', 'two members', '{}'::jsonb, 'private');
@@ -137,7 +139,7 @@ begin
   perform agent_board.verify_callback_endpoint(v_endpoint, v_b, '{"controlProofRef":"opn/b"}'::jsonb);
   perform agent_board.subscribe_callback_endpoint(v_endpoint, v_b, 'own_inbox', 'inbox.item.delivered', null, '{}'::jsonb);
 
-  insert into _opn values (v_a_user, v_b_user, v_a, v_b, v_board_ab, v_board_s, v_thread, v_thread_unlinked, v_thread_unlinked2);
+  insert into _opn values (v_a_user, v_b_user, v_a, v_b, v_board_ab, v_board_s, v_thread, v_thread_unlinked, v_thread_unlinked2, v_thread_sole_post);
 end;
 $$;
 
@@ -219,7 +221,7 @@ set local role authenticated;
 select lives_ok(
   $$ insert into _opn_sole
        select * from agent_board.post_board_message(
-         (select thread from _opn), null, (select board_s from _opn),
+         (select thread_sole_post from _opn), null, (select board_s from _opn),
          'opn sole post', 'the author posts to a board it is alone on', 'comment', 'medium', null, '{}'::jsonb) $$,
   'OPN-12: the author can post to a board it is the only member of');
 
@@ -479,7 +481,7 @@ select is(
 -- (explicit_set recursion), the read-only resolve_recipients, and _addressing_agent_ids_or_raise --
 -- the one delivery path, where the #608 rule lives. A new caller that delivers fails this by name.
 select is(
-  (select array_agg(p.proname::text order by p.proname)
+  (select array_agg(p.proname::text order by p.proname::text collate "C")
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_resolve_addressing_recipient_rows')),

package/tests/agent_board_policy_correlation.test.sql

@@ -0,0 +1,189 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(41);
+create function pg_temp.a(n integer) returns uuid language sql immutable as $$
+ select ('58900000-0000-4000-8000-'||lpad(n::text,12,'0'))::uuid
+$$;
+create function pg_temp.claim(n integer) returns void language plpgsql as $$
+begin perform set_config('request.jwt.claims',json_build_object('role','authenticated','sub',pg_temp.a(n))::text,true); end $$;
+insert into auth.users(id,instance_id,aud,role,email)
+select pg_temp.a(n),'00000000-0000-0000-0000-000000000000','authenticated','authenticated','rls589-'||n||'@test.invalid' from generate_series(1,9)n;
+insert into agent_board.agents(id,agent_type,handle,display_name,status,auth_user_id)
+select pg_temp.a(n),'agent','rls589-'||n,'RLS '||n,'active',pg_temp.a(n) from generate_series(1,9)n;
+insert into agent_board.boards(id,slug,name,created_by_agent_id,visibility) values(pg_temp.a(200),'rls589','RLS',pg_temp.a(1),'private');
+insert into agent_board.board_memberships(id,board_id,agent_id,membership_state,role,created_by_agent_id)
+values(pg_temp.a(201),pg_temp.a(200),pg_temp.a(1),'joined','owner',pg_temp.a(1)),
+      (pg_temp.a(202),pg_temp.a(200),pg_temp.a(3),'joined','member',pg_temp.a(3));
+insert into agent_board.threads(id,created_by_agent_id,subject)
+select pg_temp.a(n),pg_temp.a(1),'RLS '||n from generate_series(100,106)n;
+insert into agent_board.messages(id,thread_id,author_agent_id,message_sequence,body)
+values(pg_temp.a(300),pg_temp.a(100),pg_temp.a(2),1,'Board-visible message'),
+      (pg_temp.a(301),pg_temp.a(103),pg_temp.a(1),1,'Unrelated message');
+insert into agent_board.tasks(id,thread_id,created_by_agent_id,assigned_agent_id,title,parent_task_id,root_task_id)
+values(pg_temp.a(400),pg_temp.a(101),pg_temp.a(1),pg_temp.a(5),'Assigned task',null,null),
+      (pg_temp.a(401),pg_temp.a(102),pg_temp.a(6),pg_temp.a(6),'Parent',null,null),
+      (pg_temp.a(402),pg_temp.a(102),pg_temp.a(7),pg_temp.a(7),'Child',pg_temp.a(401),pg_temp.a(401)),
+      (pg_temp.a(403),pg_temp.a(103),pg_temp.a(1),pg_temp.a(1),'Unrelated parent',null,null),
+      (pg_temp.a(404),pg_temp.a(103),pg_temp.a(1),pg_temp.a(1),'Unrelated child',pg_temp.a(403),pg_temp.a(403)),
+      (pg_temp.a(405),pg_temp.a(105),pg_temp.a(1),pg_temp.a(1),'Board-delivered task',null,null);
+insert into agent_board.delegations(id,parent_task_id,child_task_id,delegated_by_agent_id,delegated_to_agent_id)
+values(pg_temp.a(500),pg_temp.a(401),pg_temp.a(402),pg_temp.a(8),pg_temp.a(9)),
+      (pg_temp.a(501),pg_temp.a(403),pg_temp.a(404),pg_temp.a(1),pg_temp.a(1));
+insert into agent_board.delivery_recipients(delivery_mode,recipient_agent_id,source_kind,source_message_id,source_task_id,board_id,board_membership_id)
+values('board',pg_temp.a(1),'message',pg_temp.a(300),null,pg_temp.a(200),pg_temp.a(201)),
+      ('direct',pg_temp.a(9),'message',pg_temp.a(300),null,null,null),
+      ('tasking',pg_temp.a(1),'task',null,pg_temp.a(405),pg_temp.a(200),pg_temp.a(201));
+insert into agent_board.board_authority_ceilings(board_id) values(pg_temp.a(200));
+insert into agent_board.thread_memberships(id,thread_id,agent_id,granted_by_agent_id)
+values(pg_temp.a(600),pg_temp.a(100),pg_temp.a(2),pg_temp.a(1));
+insert into agent_board.read_receipts(thread_id,agent_id) values(pg_temp.a(104),pg_temp.a(3));
+create temp table captured(label text,id uuid);
+grant select,insert on captured to authenticated;
+
+-- Compare all policies, deriving FK/key column pairs from the constraint catalog.
+create temp table policy_sites as
+select p.oid,p.polname,c.relname,p.polroles,
+       agent_board_test.strip_sql(coalesce(pg_get_expr(p.polqual,p.polrelid),'')||' '||coalesce(pg_get_expr(p.polwithcheck,p.polrelid),'')) as expr
+from pg_policy p join pg_class c on c.oid=p.polrelid join pg_namespace n on n.oid=c.relnamespace where n.nspname='agent_board';
+with pairs as (
+ select distinct a.attname::text as fk,b.attname::text as key
+ from pg_constraint c join pg_class r on r.oid=c.conrelid join pg_namespace n on n.oid=r.relnamespace
+ cross join lateral unnest(c.conkey,c.confkey) k(src,dst)
+ join pg_attribute a on a.attrelid=c.conrelid and a.attnum=k.src
+ join pg_attribute b on b.attrelid=c.confrelid and b.attnum=k.dst
+ where c.contype='f' and n.nspname='agent_board'
+), refs as (
+ select s.relname||'.'||s.polname||': '||m[1]||'.'||m[2]||' = '||m[1]||'.'||m[3] as site,trim(both '"' from m[2]) as lhs,trim(both '"' from m[3]) as rhs
+ from policy_sites s cross join lateral regexp_matches(s.expr,agent_board_test.re('('||agent_board_test.ident_any_frag()||')\s*\.\s*('||agent_board_test.ident_any_frag()||')\s*=\s*\1\s*\.\s*('||agent_board_test.ident_any_frag()||')'),'g')m
+)
+select is((select coalesce(string_agg(distinct site,', ' order by site),'') from refs where lhs=rhs or exists(select 1 from pairs where (lhs=fk and rhs=key) or (rhs=fk and lhs=key))),'','RLS-1 no policy self-comparison or same-alias foreign-key/key comparison; offenders named');
+create temp table policy_functions as
+select distinct s.relname,s.polname,f.oid,f.oid::regprocedure::text as signature,f.prosecdef
+from policy_sites s join pg_depend d on d.classid='pg_policy'::regclass and d.objid=s.oid and d.refclassid='pg_proc'::regclass
+join pg_proc f on f.oid=d.refobjid join pg_namespace n on n.oid=f.pronamespace
+where n.nspname='agent_board' and exists(select 1 from unnest(s.polroles) r(role_id)
+ where case when role_id=0 then true else pg_has_role('authenticated',role_id,'USAGE') end);
+select is((select coalesce(string_agg(relname||'.'||polname||': '||signature,', ' order by relname,polname,signature),'') from policy_functions where not has_function_privilege('authenticated',oid,'EXECUTE')),'','RLS-2 every authenticated policy function is executable; offenders named');
+select cmp_ok((select count(*) from policy_sites),'>',0::bigint,'RLS-3 catalog policy class is nonempty');
+select is((select coalesce(string_agg(distinct signature,', ' order by signature),'') from policy_functions where prosecdef and has_function_privilege('anon',oid,'EXECUTE')),'','RLS-4 authenticated policy definers are not anonymous-callable');
+
+select pg_temp.claim(2);
+set local role authenticated;
+select lives_ok($$insert into captured select 'message-author',id from agent_board.threads where id in (pg_temp.a(100),pg_temp.a(103))$$,'RLS-5 message-author SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='message-author'),array[pg_temp.a(100)]::uuid[],'RLS-6 message-author visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'board-member',id from agent_board.threads where id in (pg_temp.a(100),pg_temp.a(103))$$,'RLS-7 board-member SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='board-member'),array[pg_temp.a(100)]::uuid[],'RLS-8 board-member visible rows are scoped');
+
+select pg_temp.claim(5);
+set local role authenticated;
+select lives_ok($$insert into captured select 'task-assignee',id from agent_board.threads where id in (pg_temp.a(101),pg_temp.a(103))$$,'RLS-9 task-assignee SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='task-assignee'),array[pg_temp.a(101)]::uuid[],'RLS-10 task-assignee visible rows are scoped');
+
+select pg_temp.claim(6);
+set local role authenticated;
+select lives_ok($$insert into captured select 'parent-task-owner',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-11 parent-task-owner SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='parent-task-owner'),array[pg_temp.a(500)]::uuid[],'RLS-12 parent-task-owner visible rows are scoped');
+
+select pg_temp.claim(7);
+set local role authenticated;
+select lives_ok($$insert into captured select 'child-task-owner',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-13 child-task-owner SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='child-task-owner'),array[pg_temp.a(500)]::uuid[],'RLS-14 child-task-owner visible rows are scoped');
+
+select pg_temp.claim(8);
+set local role authenticated;
+select lives_ok($$insert into captured select 'delegator',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-15 delegator SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='delegator'),array[pg_temp.a(500)]::uuid[],'RLS-16 delegator visible rows are scoped');
+
+select pg_temp.claim(9);
+set local role authenticated;
+select lives_ok($$insert into captured select 'delegate-recipient',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-17 delegate-recipient SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='delegate-recipient'),array[pg_temp.a(500)]::uuid[],'RLS-18 delegate-recipient visible rows are scoped');
+
+select pg_temp.claim(1);
+set local role authenticated;
+select lives_ok($$insert into captured select 'thread-creator',id from agent_board.threads where id=pg_temp.a(106)$$,'RLS-19 thread-creator SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='thread-creator'),array[pg_temp.a(106)]::uuid[],'RLS-20 thread-creator visible rows are scoped');
+
+select pg_temp.claim(4);
+set local role authenticated;
+select lives_ok($$insert into captured select 'outsider-threads',id from agent_board.threads where id between pg_temp.a(100) and pg_temp.a(105)$$,'RLS-21 outsider-threads SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='outsider-threads'),array[]::uuid[],'RLS-22 outsider-threads visible rows are scoped');
+
+select pg_temp.claim(4);
+set local role authenticated;
+select lives_ok($$insert into captured select 'outsider-delegations',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-23 outsider-delegations SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='outsider-delegations'),array[]::uuid[],'RLS-24 outsider-delegations visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'member-ceiling',board_id from agent_board.board_authority_ceilings where board_id=pg_temp.a(200)$$,'RLS-25 member-ceiling SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='member-ceiling'),array[pg_temp.a(200)]::uuid[],'RLS-26 member-ceiling visible rows are scoped');
+
+select pg_temp.claim(4);
+set local role authenticated;
+select lives_ok($$insert into captured select 'outsider-ceiling',board_id from agent_board.board_authority_ceilings where board_id=pg_temp.a(200)$$,'RLS-27 outsider-ceiling SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='outsider-ceiling'),array[]::uuid[],'RLS-28 outsider-ceiling visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'member-thread-acl',id from agent_board.thread_memberships where id=pg_temp.a(600)$$,'RLS-29 member-thread-acl SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='member-thread-acl'),array[pg_temp.a(600)]::uuid[],'RLS-30 member-thread-acl visible rows are scoped');
+
+select pg_temp.claim(4);
+set local role authenticated;
+select lives_ok($$insert into captured select 'outsider-thread-acl',id from agent_board.thread_memberships where id=pg_temp.a(600)$$,'RLS-31 outsider-thread-acl SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='outsider-thread-acl'),array[]::uuid[],'RLS-32 outsider-thread-acl visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'receipt-reader',id from agent_board.threads where id=pg_temp.a(104)$$,'RLS-33 receipt-reader SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='receipt-reader'),array[pg_temp.a(104)]::uuid[],'RLS-34 receipt-reader visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'member-unrelated-delegation',id from agent_board.delegations where id in (pg_temp.a(500),pg_temp.a(501))$$,'RLS-35 member-unrelated-delegation SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='member-unrelated-delegation'),array[]::uuid[],'RLS-36 member-unrelated-delegation visible rows are scoped');
+
+select pg_temp.claim(3);
+set local role authenticated;
+select lives_ok($$insert into captured select 'board-task-delivery',id from agent_board.threads where id in (pg_temp.a(105),pg_temp.a(103))$$,'RLS-37 board-task-delivery SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='board-task-delivery'),array[pg_temp.a(105)]::uuid[],'RLS-38 board-task-delivery visible rows are scoped');
+
+select pg_temp.claim(9);
+set local role authenticated;
+select lives_ok($$insert into captured select 'direct-message-recipient',id from agent_board.threads where id in (pg_temp.a(100),pg_temp.a(103))$$,'RLS-39 direct-message-recipient SELECT executes');
+reset role;
+select is((select coalesce(array_agg(id order by id),array[]::uuid[]) from captured where label='direct-message-recipient'),array[pg_temp.a(100)]::uuid[],'RLS-40 direct-message-recipient visible rows are scoped');
+
+
+-- Catalog provenance is part of the read contract: grants must not erase the ruling.
+select ok(coalesce(
+  obj_description('agent_board._current_agent_can_access_thread(uuid)'::regprocedure, 'pg_proc') like '%message-board#291%'
+  and obj_description('agent_board._current_agent_can_access_thread(uuid)'::regprocedure, 'pg_proc') like '%REVERSING A RULING%'
+  and obj_description('agent_board._current_agent_can_access_thread(uuid)'::regprocedure, 'pg_proc') like '%restricted%is UNREACHABLE%'
+  and obj_description('agent_board._current_agent_can_access_thread(uuid)'::regprocedure, 'pg_proc') like '%Callable by authenticated for its RLS policies and by service_role.%',
+  false), 'RLS-41 thread access comment preserves the ratified claims ruling and dormant ACL');
+
+select * from finish();
+rollback;

package/tests/agent_board_request_removed.test.sql

@@ -0,0 +1,96 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(33);
+create function pg_temp.a(n integer) returns uuid language sql immutable as $$
+  select ('68000000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid
+$$;
+create function pg_temp.claim(n integer) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role','authenticated','sub',pg_temp.a(n))::text,true);
+end $$;
+insert into auth.users(id, instance_id, aud, role, email)
+select pg_temp.a(n),'00000000-0000-0000-0000-000000000000','authenticated','authenticated','removed680-'||n||'@test.invalid'
+from generate_series(1,9) n;
+insert into agent_board.agents(id,agent_type,handle,display_name,status,auth_user_id)
+select pg_temp.a(n),'agent','removed680-'||n,'Removed '||n,'active',pg_temp.a(n)
+from generate_series(1,9) n;
+insert into agent_board.boards(id,slug,name,created_by_agent_id,visibility)
+values (pg_temp.a(100),'removed680-open','Open',pg_temp.a(1),'open'),
+       (pg_temp.a(101),'removed680-link','Link',pg_temp.a(1),'invite_only'),
+       (pg_temp.a(102),'removed680-private','Private',pg_temp.a(1),'private');
+insert into agent_board.board_memberships(board_id,agent_id,membership_state,role,created_by_agent_id)
+select pg_temp.a(n),pg_temp.a(1),'joined','owner',pg_temp.a(1) from generate_series(100,102) n;
+insert into agent_board.board_memberships(board_id,agent_id,membership_state,role,created_by_agent_id,left_at,metadata)
+values (pg_temp.a(100),pg_temp.a(2),'removed','member',pg_temp.a(1),now(),'{"eviction":true}'),
+       (pg_temp.a(101),pg_temp.a(2),'removed','member',pg_temp.a(1),now(),'{"eviction":true}'),
+       (pg_temp.a(100),pg_temp.a(3),'removed','member',pg_temp.a(1),now(),'{"eviction":true}'),
+       (pg_temp.a(100),pg_temp.a(3),'left','member',pg_temp.a(1),now(),'{"left":true}'),
+       (pg_temp.a(100),pg_temp.a(5),'left','member',pg_temp.a(5),now(),'{}'),
+       (pg_temp.a(100),pg_temp.a(6),'requested','member',pg_temp.a(6),null,'{}'),
+       (pg_temp.a(100),pg_temp.a(7),'removed','member',pg_temp.a(1),now(),'{"eviction":true}'),
+       (pg_temp.a(100),pg_temp.a(7),'joined','member',pg_temp.a(7),null,'{"active":true}'),
+       (pg_temp.a(100),pg_temp.a(8),'subscribed','member',pg_temp.a(8),null,'{"active":true}');
+update agent_board.board_memberships set created_at=now()-interval '1 day'
+ where board_id=pg_temp.a(100) and agent_id=pg_temp.a(3) and membership_state='removed';
+select pg_temp.claim(1);
+create temp table live_link as select * from agent_board.create_invite_link(pg_temp.a(101),'member','joined',null,null,pg_temp.a(1));
+
+create temp table request_sites as
+select p.oid,p.proname::text as name,agent_board_test.stripped_body(p.oid) as body,
+       agent_board_test.stripped_body(p.oid,true) as literals
+from pg_proc p join pg_namespace n on n.oid=p.pronamespace
+where n.nspname='agent_board' and has_function_privilege('authenticated',p.oid,'EXECUTE')
+  and agent_board_test.stripped_body(p.oid,true) ~ agent_board_test.re(
+    agent_board_test.call_frag('_upsert_board_membership_state') || '[^,;]*,[^,;]*,\s*''requested''\s*,');
+select is((select string_agg(name,',' order by name) from request_sites),'request_join_board','REM-1 literal-request sink callers enumerated from catalog');
+select is((select coalesce(string_agg(name,','),'') from request_sites where body !~ agent_board_test.row_lock_re('board_memberships')),'','REM-2 every request writer locks membership rows; offenders named');
+select is((select coalesce(string_agg(name,','),'') from request_sites
+           where regexp_instr(body,agent_board_test.row_lock_re('board_memberships'))=0
+              or regexp_instr(body,agent_board_test.row_lock_re('board_memberships')) >= regexp_instr(body,agent_board_test.call_re('_upsert_board_membership_state'))
+              or regexp_instr(body,agent_board_test.row_lock_re('board_memberships')) >= regexp_instr(body,agent_board_test.re(agent_board_test.ci_re('if') || '\s+' || agent_board_test.ci_re('exists') || '\s*\('))
+              or literals !~ 'board join request refused for removed standing'),
+          '','REM-3 every request writer checks removed standing before its sink');
+select is((select coalesce(string_agg(name,','),'') from request_sites where has_function_privilege('anon',oid,'EXECUTE') or not has_function_privilege('service_role',oid,'EXECUTE') or obj_description(oid,'pg_proc') is null),'','REM-4 request writer ACL and comment');
+
+select pg_temp.claim(2);
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(2),'{"overwrite":true}')$$,'42501',null,'REM-5 removed open-board request refused');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(2)),'removed','REM-6 eviction persists after request');
+select is((select count(*)::integer from agent_board.board_membership_events where board_id=pg_temp.a(100) and agent_id=pg_temp.a(2)),0,'REM-7 refused request emits no membership event');
+select throws_ok($$select agent_board.join_board(pg_temp.a(100),pg_temp.a(2))$$,'P0002',null,'REM-8 request cannot unlock open self-join');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(2)),'removed','REM-9 self-join leaves eviction intact');
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(101),pg_temp.a(2))$$,'42501',null,'REM-10 removed invite-only request refused');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(2)),'removed','REM-11 invite-only eviction persists');
+select throws_ok($$select agent_board.redeem_invite_link((select code from live_link))$$,'42501',null,'REM-12 request cannot unlock live-link redemption');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(2)),'removed','REM-13 live link leaves eviction intact');
+select is((select uses_count from agent_board.board_invite_tokens where id=(select invite_id from live_link)),0,'REM-14 refused redemption consumes no use');
+
+select pg_temp.claim(3);
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(3),'{"overwrite":true}')$$,'42501',null,'REM-15 removed plus left standing refused');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(3)),'left,removed','REM-16 whole row set preserved');
+select is((select metadata from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(3) and membership_state='removed'),'{"eviction":true}'::jsonb,'REM-17 denied request preserves eviction metadata');
+select pg_temp.claim(4);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(4))$$,'REM-18 first request succeeds');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(4)),'requested','REM-19 first request stored');
+select pg_temp.claim(5);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(5))$$,'REM-20 voluntary leaver can request');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(5)),'requested','REM-21 voluntary request stored');
+select pg_temp.claim(6);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(6))$$,'REM-22 repeated pending request succeeds');
+select is((select count(*)::integer from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(6) and membership_state='requested'),1,'REM-23 repeat preserves one pending row');
+select pg_temp.claim(7);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(7),'{"overwrite":true}')$$,'REM-24 active plus removed remains a no-op');
+select is((select metadata from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(7) and membership_state='joined'),'{"active":true}'::jsonb,'REM-25 active row remains unchanged');
+select pg_temp.claim(8);
+select lives_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(8))$$,'REM-26 subscribed request remains a no-op');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(8)),'subscribed','REM-27 subscription preserved');
+select set_config('request.jwt.claims','{"role":"service_role"}',true);
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(2))$$,'42501',null,'REM-28 service request cannot erase removal');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(2)),'removed','REM-29 service refusal preserves eviction');
+select pg_temp.claim(9);
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(102),pg_temp.a(9))$$,'P0002',null,'REM-30 private board request still hidden');
+select is((select count(*)::integer from agent_board.board_memberships where board_id=pg_temp.a(102) and agent_id=pg_temp.a(9)),0,'REM-31 hidden request writes nothing');
+select throws_ok($$select agent_board.request_join_board(pg_temp.a(100),pg_temp.a(4))$$,'42501',null,'REM-32 request remains self-only');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(4)),'requested','REM-33 actor mismatch preserves target');
+select * from finish();
+rollback;

package/tests/agent_board_resolution_authority.test.sql

@@ -0,0 +1,190 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(76);
+create function pg_temp.a(n integer) returns uuid language sql immutable as $$
+ select ('66800000-0000-4000-8000-'||lpad(n::text,12,'0'))::uuid
+$$;
+create function pg_temp.claim(n integer) returns void language plpgsql as $$
+begin perform set_config('request.jwt.claims',json_build_object('role','authenticated','sub',pg_temp.a(n))::text,true); end $$;
+insert into auth.users(id,instance_id,aud,role,email)
+select pg_temp.a(n),'00000000-0000-0000-0000-000000000000','authenticated','authenticated','resolve668-'||n||'@test.invalid' from generate_series(1,39)n;
+insert into agent_board.agents(id,agent_type,handle,display_name,status,auth_user_id)
+select pg_temp.a(n),'agent','resolve668-'||n,'Resolver '||n,'active',pg_temp.a(n) from generate_series(1,39)n;
+insert into agent_board.boards(id,slug,name,created_by_agent_id,visibility,role_gate_enforced)
+values(pg_temp.a(100),'resolve668-off','Gate off',pg_temp.a(1),'open',false),
+      (pg_temp.a(101),'resolve668-on','Gate on',pg_temp.a(1),'open',true),
+      (pg_temp.a(102),'resolve668-other','Other board',pg_temp.a(6),'private',false);
+insert into agent_board.board_memberships(board_id,agent_id,membership_state,role,created_by_agent_id,left_at)
+select pg_temp.a(b),pg_temp.a(a),state,role,pg_temp.a(1),case when state in ('left','removed') then now() else null end
+from generate_series(100,101)b cross join (values
+ (1,'joined','observer'),(2,'joined','owner'),(3,'subscribed','admin'),
+ (4,'joined','member'),(5,'joined','observer'),(7,'left','owner'),(8,'removed','admin')
+)r(a,state,role);
+insert into agent_board.board_memberships(board_id,agent_id,membership_state,role,created_by_agent_id)
+values(pg_temp.a(102),pg_temp.a(6),'joined','owner',pg_temp.a(6));
+-- Real subject-authored requests establish consent for approval-side probes.
+do $$declare b integer;a integer; begin
+ for b in 100..101 loop for a in 21..39 loop
+  perform pg_temp.claim(a);
+  perform agent_board.request_join_board(pg_temp.a(b),pg_temp.a(a));
+ end loop; end loop;
+end $$;
+create temp table resolution_sites as
+select p.oid,p.proname::text as name,agent_board_test.stripped_body(p.oid) as body,agent_board_test.stripped_body(p.oid,true) as literals
+from pg_proc p join pg_namespace n on n.oid=p.pronamespace
+where n.nspname='agent_board' and has_function_privilege('authenticated',p.oid,'EXECUTE')
+ and 'p_membership_state'=any(p.proargnames)
+ and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_upsert_board_membership_state')
+ and agent_board_test.stripped_body(p.oid,true) ~ agent_board_test.re(agent_board_test.col_ref_frag('membership_state')||'\s+'||agent_board_test.ci_re('in')||'\s*\(\s*(?:''requested''\s*,\s*''invited''|''invited''\s*,\s*''requested'')\s*\)');
+select is((select string_agg(name,',' order by name) from resolution_sites),'resolve_board_request','AUTH-1 catalog-derived pending resolver population');
+select is((select coalesce(string_agg(name,','),'') from resolution_sites where body ~ agent_board_test.ident_re('role_gate_enforced')),'','AUTH-2 pending resolution never depends on the role gate; offenders named');
+select is((select coalesce(string_agg(name,','),'') from resolution_sites where literals !~ agent_board_test.re(agent_board_test.col_ref_frag('role')||'\s+'||agent_board_test.ci_re('in')||'\s*\(\s*''owner''\s*,\s*''admin''\s*\)')),'','AUTH-3 every resolver requires owner/admin standing');
+select is((select coalesce(string_agg(name,','),'') from resolution_sites where has_function_privilege('anon',oid,'EXECUTE') or not has_function_privilege('service_role',oid,'EXECUTE') or obj_description(oid,'pg_proc') is null),'','AUTH-4 resolver ACL and comment');
+
+select pg_temp.claim(2);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(21),'joined',pg_temp.a(2))$$,'AUTH-5 gate off: active owner resolves joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(21)),'joined','AUTH-6 gate off: allowed result stored');
+
+select pg_temp.claim(2);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(22),'removed',pg_temp.a(2))$$,'AUTH-7 gate off: active owner resolves removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(22)),'left','AUTH-8 gate off: allowed result stored');
+
+select pg_temp.claim(3);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(23),'subscribed',pg_temp.a(3))$$,'AUTH-9 gate off: active admin resolves subscribed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(23)),'subscribed','AUTH-10 gate off: allowed result stored');
+
+select pg_temp.claim(3);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(24),'removed',pg_temp.a(3))$$,'AUTH-11 gate off: active admin resolves removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(24)),'left','AUTH-12 gate off: allowed result stored');
+
+select pg_temp.claim(4);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(25),'joined',pg_temp.a(4))$$,'42501',null,'AUTH-13 gate off: member cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(25)),'requested','AUTH-14 gate off: denied request unchanged');
+
+select pg_temp.claim(4);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(26),'removed',pg_temp.a(4))$$,'42501',null,'AUTH-15 gate off: member cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(26)),'requested','AUTH-16 gate off: denied request unchanged');
+
+select pg_temp.claim(5);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(27),'joined',pg_temp.a(5))$$,'42501',null,'AUTH-17 gate off: observer cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(27)),'requested','AUTH-18 gate off: denied request unchanged');
+
+select pg_temp.claim(5);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(28),'removed',pg_temp.a(5))$$,'42501',null,'AUTH-19 gate off: observer cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(28)),'requested','AUTH-20 gate off: denied request unchanged');
+
+select pg_temp.claim(1);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(29),'joined',pg_temp.a(1))$$,'42501',null,'AUTH-21 gate off: demoted creator cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(29)),'requested','AUTH-22 gate off: denied request unchanged');
+
+select pg_temp.claim(1);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(30),'removed',pg_temp.a(1))$$,'42501',null,'AUTH-23 gate off: demoted creator cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(30)),'requested','AUTH-24 gate off: denied request unchanged');
+
+select pg_temp.claim(6);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(31),'joined',pg_temp.a(6))$$,'42501',null,'AUTH-25 gate off: outsider cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(31)),'requested','AUTH-26 gate off: denied request unchanged');
+
+select pg_temp.claim(6);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(32),'removed',pg_temp.a(6))$$,'42501',null,'AUTH-27 gate off: outsider cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(32)),'requested','AUTH-28 gate off: denied request unchanged');
+
+select pg_temp.claim(7);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(33),'joined',pg_temp.a(7))$$,'42501',null,'AUTH-29 gate off: departed owner cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(33)),'requested','AUTH-30 gate off: denied request unchanged');
+
+select pg_temp.claim(7);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(34),'removed',pg_temp.a(7))$$,'42501',null,'AUTH-31 gate off: departed owner cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(34)),'requested','AUTH-32 gate off: denied request unchanged');
+
+select pg_temp.claim(8);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(35),'joined',pg_temp.a(8))$$,'42501',null,'AUTH-33 gate off: removed admin cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(35)),'requested','AUTH-34 gate off: denied request unchanged');
+
+select pg_temp.claim(8);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(36),'removed',pg_temp.a(8))$$,'42501',null,'AUTH-35 gate off: removed admin cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(36)),'requested','AUTH-36 gate off: denied request unchanged');
+
+select pg_temp.claim(2);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(21),'joined',pg_temp.a(2))$$,'AUTH-37 gate on: active owner resolves joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(21)),'joined','AUTH-38 gate on: allowed result stored');
+
+select pg_temp.claim(2);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(22),'removed',pg_temp.a(2))$$,'AUTH-39 gate on: active owner resolves removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(22)),'left','AUTH-40 gate on: allowed result stored');
+
+select pg_temp.claim(3);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(23),'subscribed',pg_temp.a(3))$$,'AUTH-41 gate on: active admin resolves subscribed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(23)),'subscribed','AUTH-42 gate on: allowed result stored');
+
+select pg_temp.claim(3);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(24),'removed',pg_temp.a(3))$$,'AUTH-43 gate on: active admin resolves removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(24)),'left','AUTH-44 gate on: allowed result stored');
+
+select pg_temp.claim(4);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(25),'joined',pg_temp.a(4))$$,'42501',null,'AUTH-45 gate on: member cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(25)),'requested','AUTH-46 gate on: denied request unchanged');
+
+select pg_temp.claim(4);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(26),'removed',pg_temp.a(4))$$,'42501',null,'AUTH-47 gate on: member cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(26)),'requested','AUTH-48 gate on: denied request unchanged');
+
+select pg_temp.claim(5);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(27),'joined',pg_temp.a(5))$$,'42501',null,'AUTH-49 gate on: observer cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(27)),'requested','AUTH-50 gate on: denied request unchanged');
+
+select pg_temp.claim(5);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(28),'removed',pg_temp.a(5))$$,'42501',null,'AUTH-51 gate on: observer cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(28)),'requested','AUTH-52 gate on: denied request unchanged');
+
+select pg_temp.claim(1);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(29),'joined',pg_temp.a(1))$$,'42501',null,'AUTH-53 gate on: demoted creator cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(29)),'requested','AUTH-54 gate on: denied request unchanged');
+
+select pg_temp.claim(1);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(30),'removed',pg_temp.a(1))$$,'42501',null,'AUTH-55 gate on: demoted creator cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(30)),'requested','AUTH-56 gate on: denied request unchanged');
+
+select pg_temp.claim(6);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(31),'joined',pg_temp.a(6))$$,'42501',null,'AUTH-57 gate on: outsider cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(31)),'requested','AUTH-58 gate on: denied request unchanged');
+
+select pg_temp.claim(6);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(32),'removed',pg_temp.a(6))$$,'42501',null,'AUTH-59 gate on: outsider cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(32)),'requested','AUTH-60 gate on: denied request unchanged');
+
+select pg_temp.claim(7);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(33),'joined',pg_temp.a(7))$$,'42501',null,'AUTH-61 gate on: departed owner cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(33)),'requested','AUTH-62 gate on: denied request unchanged');
+
+select pg_temp.claim(7);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(34),'removed',pg_temp.a(7))$$,'42501',null,'AUTH-63 gate on: departed owner cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(34)),'requested','AUTH-64 gate on: denied request unchanged');
+
+select pg_temp.claim(8);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(35),'joined',pg_temp.a(8))$$,'42501',null,'AUTH-65 gate on: removed admin cannot resolve joined');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(35)),'requested','AUTH-66 gate on: denied request unchanged');
+
+select pg_temp.claim(8);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(36),'removed',pg_temp.a(8))$$,'42501',null,'AUTH-67 gate on: removed admin cannot resolve removed');
+select is((select string_agg(membership_state,',' order by membership_state) from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(36)),'requested','AUTH-68 gate on: denied request unchanged');
+
+select set_config('request.jwt.claims','{"role":"service_role"}',true);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(37),'removed',pg_temp.a(2))$$,'42501',null,'AUTH-69 unresolved service resolver has no owner identity');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(37)),'requested','AUTH-70 unresolved service refusal preserves request');
+
+select set_config('request.jwt.claims','{"role":"service_role"}',true);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(101),pg_temp.a(37),'removed',pg_temp.a(2))$$,'42501',null,'AUTH-71 unresolved service resolver has no owner identity');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(101) and agent_id=pg_temp.a(37)),'requested','AUTH-72 unresolved service refusal preserves request');
+
+select set_config('request.jwt.claims',json_build_object('role','service_role','sub',pg_temp.a(2))::text,true);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(38),'joined',pg_temp.a(2))$$,'AUTH-73 resolved service owner may approve');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(38)),'joined','AUTH-74 service owner approval stored');
+
+select set_config('request.jwt.claims','{"role":"authenticated"}',true);
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100),pg_temp.a(39),'removed',pg_temp.a(2))$$,'42501',null,'AUTH-75 unresolved authenticated resolver refused');
+select is((select membership_state from agent_board.board_memberships where board_id=pg_temp.a(100) and agent_id=pg_temp.a(39)),'requested','AUTH-76 unresolved authenticated refusal preserves request');
+
+select * from finish();
+rollback;

package/tests/agent_board_session_identity_behavior_classes.test.sql

@@ -14,7 +14,7 @@ select * from _sid_behavior_fns f where f.body ~ agent_board_test.re(
   agent_board_test.write_frag('session_identities',agent_board_test.bare_ok(f.oid)) || '|'
   || agent_board_test.write_frag('session_id_aliases',agent_board_test.bare_ok(f.oid)));
 select is((select string_agg(proname,', ' order by proname) from _sid_behavior_writers),
-  '_revoke_agent_principal, _session_identity_agent_lineage, approve_identity_state, heartbeat_session_identity, link_session_alias, mint_delegated_child, mint_fleet_agent_session, readmit_session_identity, record_session_identity_state, renew_session_identity',
+  '_revoke_agent_principal, _session_identity_agent_lineage, approve_identity_state, heartbeat_session_identity, link_session_alias, mint_delegated_child, mint_fleet_agent_session, mint_fleet_agent_session_measured, readmit_session_identity, record_session_identity_state, renew_session_identity',
   'EC-SIDSCHEMA-5-protected-population: every catalog-derived identity/alias writer has a gate or a positively proved lifecycle exemption');
 create temp view _sid_behavior_unguarded as
 select w.* from _sid_behavior_writers w
@@ -66,7 +66,7 @@ select is((select string_agg(proname,', ' order by proname) from _sid_behavior_i
 select is((select coalesce(string_agg(c.root_name,', ' order by c.root_name),'')
   from agent_board_test.fn_call_closure() c
   where c.reached_oid='agent_board._mint_fleet_agent_session_legacy(uuid,text,uuid,uuid,integer)'::regprocedure
-    and c.root_oid<>c.reached_oid and c.root_name<>'mint_fleet_agent_session'),'',
+    and c.root_oid<>c.reached_oid and c.root_name<>'mint_fleet_agent_session'),'mint_fleet_agent_session_measured',
   'EC-SIDSCHEMA-4-issuer-wrapper-class: only the gated fleet session mint reaches the private legacy token issuer; a new bypass wrapper names itself');
 select ok(not has_function_privilege('service_role',
   'agent_board._mint_fleet_agent_session_legacy(uuid,text,uuid,uuid,integer)','EXECUTE')

package/tests/agent_board_session_identity_limits.test.sql

@@ -160,7 +160,7 @@ from pg_proc p where p.pronamespace = 'agent_board'::regnamespace
   and (agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('delegation_grants', 'grant_expires_at')
     or agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('session_identities', 'holder_secret_hash'));
 select is((select string_agg(proname, ', ' order by proname) from _sid_activation_writers),
-  '_session_identity_agent_lineage, mint_delegated_child, mint_fleet_agent_session, readmit_session_identity, renew_delegated_grant',
+  '_session_identity_agent_lineage, mint_delegated_child, mint_fleet_agent_session, mint_fleet_agent_session_measured, readmit_session_identity, renew_delegated_grant',
   'EC-SIDSCHEMA-6-activation-population: every discovered expiry or holder writer has a positive activation path');
 -- An INSERT is conservatively a writer of defaulted columns too. This one
 -- writes a legacy/default-NULL identity, not a live holder or grant. Prove the