@consiliency/agent-board-schema 1.64.0 → 1.74.0

package/tests/agent_board_session_identity_measured_mint.test.sql

@@ -0,0 +1,342 @@
+-- SIDSERVER blocker fix (Consiliency/message-board#653 BLOCKs 1 and 2): the MEASURED mint
+-- agent_board.mint_fleet_agent_session_measured, and its parity with every gate of the
+-- seven-argument trusted mint_fleet_agent_session it is meant to replace for the relay. Allowed paths use lives_ok then a separate state
+-- check (AGENTS.md rule 3). Refusal probes that must COMMIT their recording are asserted
+-- with lives_ok (a raise would roll the freeze back), then by state.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(63);
+
+create temp table _mm_fixture(label text primary key, root_id uuid, agent_id uuid, key_id uuid);
+create temp table _mm_results(label text, session_id text, expires_at timestamptz, epoch bigint, secret text, refusal text);
+do $$
+declare v_label text; v_root uuid; v_agent uuid; v_key uuid; v_auth uuid; v_alias uuid; v_harness text;
+begin
+  foreach v_label in array array['codex', 'codex-b', 'claude', 'claude-lapse', 'legacy', 'recorded', 'unresolved',
+    'tomb', 'unproven', 'unclaimed', 'ancestor', 'replay'] loop
+    v_root := gen_random_uuid(); v_agent := gen_random_uuid(); v_key := gen_random_uuid();
+    v_harness := case when v_label like 'claude%' then 'claude' when v_label = 'legacy' then null else 'codex' end;
+    v_auth := public.ensure_github_user('mm-' || v_agent, 'mm-' || v_agent || '@example.test', 'mm-' || v_agent, 'MM');
+    insert into agent_board.agents(id, agent_type, handle, display_name, status)
+    values (v_root, 'agent', 'mm-root-' || v_root, 'MM root', 'active');
+    insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, parent_agent_id, root_agent_id)
+    values (v_agent, 'agent', 'mm-' || v_agent, 'MM', 'active', v_auth, v_root, v_root);
+    insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+    values (v_key, v_agent, 'primary', 1, public.test_pubkey(v_key::text), 'raw_ed25519_base64url', public.test_key_fingerprint(v_key::text), 'active', 'proven');
+    insert into agent_board.session_identities(agent_id, root_agent_id, depth) values (v_root, v_root, 0);
+    insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth, identity_kind, harness, approved_risky_digest, current_risky_digest)
+    values (v_agent, v_root, v_root, 1, case when v_label = 'legacy' then 'legacy' else 'session' end, v_harness, 'approved', 'approved');
+    if v_harness is not null then
+      insert into agent_board.session_id_aliases(identity_agent_id, root_agent_id, harness, session_id)
+      values (v_agent, v_root, v_harness, 'bound-' || v_label) returning id into v_alias;
+      update agent_board.session_identities set lease_alias_id = v_alias where agent_id = v_agent;
+    end if;
+    insert into _mm_fixture values (v_label, v_root, v_agent, v_key);
+  end loop;
+  update agent_board.session_identities set tombstoned_at = now(), tombstone_reason = 'revoked'
+   where agent_id = (select agent_id from _mm_fixture where label = 'tomb');
+  update agent_board.session_identities set resolution_state = 'frozen'
+   where agent_id = (select root_id from _mm_fixture where label = 'ancestor');
+end;
+$$;
+grant select on _mm_fixture to service_role;
+grant select, insert on _mm_results to service_role;
+
+-- INVOKER, so the real RPC runs as service_role. p_digest is the MEASURED risky digest.
+create function pg_temp.mm(p_label text, p_result text, p_digest text, p_alias text, p_continuity text,
+  p_predecessor uuid default null, p_secret text default null, p_resolution text default 'resolved', p_recorded jsonb default '{}')
+returns void language plpgsql as $$
+declare v_fx record; v_issued record;
+begin
+  select * into v_fx from _mm_fixture where label = p_label;
+  select * into v_issued from agent_board.issue_signing_key_challenge(v_fx.agent_id, 'primary');
+  insert into _mm_results
+  select p_result, m.session_id, m.expires_at, m.identity_lease_epoch, m.holder_secret, m.refusal
+    from agent_board.mint_fleet_agent_session_measured(v_issued.challenge_id, split_part(v_issued.challenge, ':', 3), v_fx.key_id, v_fx.agent_id,
+      900, p_secret, p_alias, jsonb_build_object('resolution', p_resolution, 'risky_digest', p_digest, 'recorded', p_recorded),
+      p_continuity, p_predecessor) m;
+end;
+$$;
+-- A fixed challenge, so a second use can prove the inherited single-use gate.
+create temp table _mm_challenge(label text primary key, challenge_id uuid, nonce text);
+grant select, insert on _mm_challenge to service_role;
+create function pg_temp.mm_issue(p_label text) returns void language plpgsql as $$
+declare v_fx record; v_issued record;
+begin
+  select * into v_fx from _mm_fixture where label = p_label;
+  select * into v_issued from agent_board.issue_signing_key_challenge(v_fx.agent_id, 'primary');
+  insert into _mm_challenge values (p_label, v_issued.challenge_id, split_part(v_issued.challenge, ':', 3));
+end;
+$$;
+create function pg_temp.mm_fixed(p_label text, p_result text) returns void language plpgsql as $$
+declare v_fx record; v_ch record;
+begin
+  select * into v_fx from _mm_fixture where label = p_label;
+  select * into v_ch from _mm_challenge where label = p_label;
+  insert into _mm_results
+  select p_result, m.session_id, m.expires_at, m.identity_lease_epoch, m.holder_secret, m.refusal
+    from agent_board.mint_fleet_agent_session_measured(v_ch.challenge_id, v_ch.nonce, v_fx.key_id, v_fx.agent_id, 900, null,
+      'bound-' || p_label, '{"resolution":"resolved","risky_digest":"approved"}'::jsonb, 'same_alias', null) m;
+end;
+$$;
+grant execute on function pg_temp.mm_issue(text), pg_temp.mm_fixed(text, text) to service_role;
+grant execute on function pg_temp.mm(text, text, text, text, text, uuid, text, text, jsonb) to service_role;
+-- The trusted seven-argument form, for the legacy-key relay exemption's positive footprint.
+create function pg_temp.mm_trusted(p_label text, p_alias text)
+returns void language plpgsql as $$
+declare v_fx record; v_issued record;
+begin
+  select * into v_fx from _mm_fixture where label = p_label;
+  select * into v_issued from agent_board.issue_signing_key_challenge(v_fx.agent_id, 'primary');
+  perform * from agent_board.mint_fleet_agent_session(v_issued.challenge_id, split_part(v_issued.challenge, ':', 3), v_fx.key_id, v_fx.agent_id, 900, null, p_alias);
+end;
+$$;
+grant execute on function pg_temp.mm_trusted(text, text) to service_role;
+create function pg_temp.mm_refuse(p_call text)
+returns void language plpgsql as $$
+begin
+  execute p_call;
+  raise exception 'expected refusal but RPC succeeded' using errcode = 'P0001';
+end;
+$$;
+grant execute on function pg_temp.mm_refuse(text) to service_role;
+create function pg_temp.mm_state(p_label text)
+returns table(resolution_state text, current_risky_digest text, approved_risky_digest text, epoch bigint, holder boolean, recorded jsonb)
+language sql as $$
+  select si.resolution_state, si.current_risky_digest, si.approved_risky_digest, si.credential_epoch, si.holder_secret_hash is not null, si.recorded_fingerprint
+    from agent_board.session_identities si join _mm_fixture f on f.agent_id = si.agent_id where f.label = p_label;
+$$;
+grant execute on function pg_temp.mm_state(text) to service_role;
+-- Fixture clock: the runner's own role ages the lease (service_role has no UPDATE).
+create function pg_temp.mm_lapse(p_label text) returns void language sql security definer as $$
+  update agent_board.session_identities set last_heartbeat = now() - interval '181 seconds'
+   where agent_id = (select agent_id from _mm_fixture where label = p_label);
+$$;
+create function pg_temp.mm_alias_count(p_label text, p_session text) returns bigint language sql as $$
+  select count(*) from agent_board.session_id_aliases a join _mm_fixture f on f.agent_id = a.identity_agent_id
+   where f.label = p_label and a.session_id = p_session;
+$$;
+
+-- Catalog: the mint class, enumerated from pg_proc, never from a written list.
+select is((select string_agg(p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')', ' | ' order by p.proname)
+    from pg_proc p where p.pronamespace = 'agent_board'::regnamespace and p.proname in ('mint_fleet_agent_session', 'mint_fleet_agent_session_measured')),
+  'mint_fleet_agent_session(p_challenge_id uuid, p_nonce text, p_signing_key_id uuid, p_agent_id uuid, p_max_ttl_seconds integer, p_holder_secret text, p_session_id text)'
+  || ' | mint_fleet_agent_session_measured(p_challenge_id uuid, p_nonce text, p_signing_key_id uuid, p_agent_id uuid, p_max_ttl_seconds integer, p_holder_secret text, p_session_id text, p_fingerprint jsonb, p_continuity text, p_predecessor_agent_id uuid)',
+  'SIDSERVER-MM-CAT-01: exactly one trusted and one measured mint exist; any added overload names itself');
+select ok((select bool_and(p.prosecdef and p.proconfig @> array['search_path=agent_board, public']
+      and has_function_privilege('service_role', p.oid, 'EXECUTE')
+      and not has_function_privilege('anon', p.oid, 'EXECUTE') and not has_function_privilege('authenticated', p.oid, 'EXECUTE')
+      and not exists (select 1 from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) a where a.grantee = 0 and a.privilege_type = 'EXECUTE')
+      and obj_description(p.oid, 'pg_proc') is not null)
+    from pg_proc p where p.pronamespace = 'agent_board'::regnamespace and p.proname in ('mint_fleet_agent_session', 'mint_fleet_agent_session_measured')),
+  'SIDSERVER-MM-CAT-02: both mints are pinned-search_path definers, service_role-only (no PUBLIC/anon/authenticated) and commented');
+select is((select coalesce(string_agg(distinct c.root_name, ', ' order by c.root_name), '')
+    from agent_board_test.fn_call_closure() c join pg_proc p on p.oid = c.reached_oid
+   where p.pronamespace = 'agent_board'::regnamespace and p.proname in ('mint_fleet_agent_session', 'mint_fleet_agent_session_measured')
+     and c.root_oid <> c.reached_oid), '',
+  'SIDSERVER-MM-CAT-03: no SQL function calls either mint; the relay is the only caller class (repo side: check-sidserver-measured-mint-callers)');
+select ok(agent_board_test.stripped_body('agent_board.mint_fleet_agent_session_measured(uuid,text,uuid,uuid,integer,text,text,jsonb,text,uuid)'::regprocedure, true)
+    like '%_mint_fleet_agent_session_legacy(%',
+  'SIDSERVER-MM-CAT-04: the measured mint validates and consumes the challenge through the private legacy issuer');
+-- Gate parity, catalog half: every function the trusted form reaches (derived from pg_catalog,
+-- not listed here) is reached by the measured form, so no inherited gate can be dropped by
+-- omitting its call. The behavioural half is SIDSERVER-MM-GATE-* below.
+select is((select coalesce(string_agg(distinct t.reached_oid::regprocedure::text, ', '), '')
+    from agent_board_test.fn_call_closure() t
+   where t.root_oid = 'agent_board.mint_fleet_agent_session(uuid,text,uuid,uuid,integer,text,text)'::regprocedure
+     and t.reached_oid <> t.root_oid
+     and not exists (select 1 from agent_board_test.fn_call_closure() m
+       where m.root_oid = 'agent_board.mint_fleet_agent_session_measured(uuid,text,uuid,uuid,integer,text,text,jsonb,text,uuid)'::regprocedure
+         and m.reached_oid = t.reached_oid)), '',
+  'SIDSERVER-MM-PARITY-01: the measured mint reaches every function the trusted mint reaches');
+select ok((select count(distinct t.reached_oid) >= 5 from agent_board_test.fn_call_closure() t
+   where t.root_oid = 'agent_board.mint_fleet_agent_session(uuid,text,uuid,uuid,integer,text,text)'::regprocedure and t.reached_oid <> t.root_oid),
+  'SIDSERVER-MM-PARITY-01-nonvacuous: the trusted closure is populated (legacy issuer, ceiling, limits, lease, service-role gate)');
+
+set local role service_role;
+select set_config('request.jwt.claim.role', 'service_role', true);
+
+-- BLOCK 1 control: a first claim measuring the approved digest issues a token.
+select lives_ok($q$select pg_temp.mm('codex', 'first-a', 'approved', 'bound-codex', 'same_alias')$q$,
+  'SIDSERVER-MM-FP-control: a first claim measuring the approved digest enters the measured mint');
+select is((select (refusal is null and session_id is not null and epoch is not null and secret ~ '^[0-9a-f]{64}$') from _mm_results where label = 'first-a'),
+  true, 'SIDSERVER-MM-FP-control-state: the approved reading claims with a token, epoch and holder secret');
+select is((select row(resolution_state, current_risky_digest)::text from pg_temp.mm_state('codex')), '(active,approved)',
+  'SIDSERVER-MM-FP-control-recorded: the approved reading is recorded and stays active');
+
+-- BLOCK 1: a live holder re-minting with a CHANGED measured digest is refused AND frozen.
+select lives_ok(format($q$select pg_temp.mm('codex', 'remint-b', 'changed-b', 'bound-codex', 'same_alias', null, %L)$q$,
+    (select secret from _mm_results where label = 'first-a')),
+  'SIDSERVER-MM-FP-remint-returns: a changed re-mint RETURNS its refusal so the freeze commits');
+select is((select row(refusal, session_id, epoch, secret)::text from _mm_results where label = 'remint-b'),
+  '(identity_fingerprint_unapproved,,,)', 'SIDSERVER-MM-FP-remint-refused: a changed re-mint gets no session, epoch or holder secret');
+select is((select row(resolution_state, current_risky_digest, approved_risky_digest)::text from pg_temp.mm_state('codex')),
+  '(frozen,changed-b,approved)', 'SIDSERVER-MM-FP-remint-frozen: the measured digest B is recorded and the identity frozen');
+select is((select count(*) from agent_board.nonfleet_sessions s join _mm_fixture f on f.agent_id = s.agent_id
+    where f.label = 'codex' and s.revoked_at is null and s.session_id <> (select session_id from _mm_results where label = 'first-a')), 0::bigint,
+  'SIDSERVER-MM-FP-remint-session-revoked: the refused mint leaves no unrevoked session row');
+select is((select count(*) from agent_board.agent_signing_key_challenges c join _mm_fixture f on f.agent_id = c.agent_id
+    where f.label = 'codex' and c.consumed_at is null), 0::bigint,
+  'SIDSERVER-MM-FP-remint-challenge-consumed: the refused proof is single-use');
+select lives_ok(format($q$select pg_temp.mm('codex', 'after-freeze-a', 'approved', 'bound-codex', 'same_alias', null, %L)$q$,
+    (select secret from _mm_results where label = 'first-a')),
+  'SIDSERVER-MM-FP-sticky-returns: an approved reading after the freeze still enters the measured mint');
+select is((select refusal from _mm_results where label = 'after-freeze-a'), 'identity_fingerprint_unapproved',
+  'SIDSERVER-MM-FP-sticky: the freeze is sticky; restoring the reading does not unfreeze');
+
+-- BLOCK 1: a FIRST claim measuring digest B is refused and frozen, never claimed.
+select lives_ok($q$select pg_temp.mm('codex-b', 'first-b', 'changed-b', 'bound-codex-b', 'same_alias')$q$,
+  'SIDSERVER-MM-FP-first-returns: a changed first claim RETURNS its refusal so the freeze commits');
+select is((select row(refusal, session_id, secret)::text from _mm_results where label = 'first-b'),
+  '(identity_fingerprint_unapproved,,)', 'SIDSERVER-MM-FP-first-refused: a changed first claim gets no session or holder secret');
+select is((select row(resolution_state, current_risky_digest, holder)::text from pg_temp.mm_state('codex-b')),
+  '(frozen,changed-b,f)', 'SIDSERVER-MM-FP-first-frozen: digest B is recorded, frozen, and the lease is never claimed');
+
+-- Unresolved never approves; recorded-only changes do not freeze.
+-- The digest equals the approved one, so only the resolution term can freeze this reading.
+select lives_ok($q$select pg_temp.mm('unresolved', 'unresolved', 'approved', 'bound-unresolved', 'same_alias', null, null, 'unresolved')$q$,
+  'SIDSERVER-MM-FP-unresolved-returns: an unresolved reading enters and returns');
+select is((select row(r.refusal, s.resolution_state)::text from _mm_results r, pg_temp.mm_state('unresolved') s where r.label = 'unresolved'),
+  '(identity_fingerprint_unapproved,frozen)', 'SIDSERVER-MM-FP-unresolved: an unresolved reading freezes and refuses');
+select lives_ok($q$select pg_temp.mm('recorded', 'recorded', 'approved', 'bound-recorded', 'same_alias', null, null, 'resolved', '{"model":"m2"}')$q$,
+  'SIDSERVER-MM-FP-recorded-only-control: a recorded-only change enters the measured mint');
+select is((select row(r.refusal is null, s.resolution_state, s.recorded ->> 'model')::text from _mm_results r, pg_temp.mm_state('recorded') s where r.label = 'recorded'),
+  '(t,active,m2)', 'SIDSERVER-MM-FP-recorded-only: a recorded-only change is stored without freezing and still claims');
+
+-- Measurement shape is mandatory on the measured form.
+select throws_ok($q$select pg_temp.mm_refuse('select * from agent_board.mint_fleet_agent_session_measured(gen_random_uuid(), ''n'', gen_random_uuid(), gen_random_uuid(), 900, null, ''s'', null::jsonb, ''same_alias'', null)')$q$,
+  '22023', 'invalid identity fingerprint reading', 'SIDSERVER-MM-FP-reading-required: the measured form refuses a missing reading');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''legacy'', ''legacy'', ''approved'', ''x'', ''same_alias'')')$q$,
+  '22023', 'measured mint requires a session identity', 'SIDSERVER-MM-FP-legacy-refused: a legacy identity cannot enter the measured form');
+
+-- BLOCK 2: lapsed Claude reclaim through an UNFAMILIAR alias.
+select lives_ok($q$select pg_temp.mm('claude', 'claude-first', 'approved', 'bound-claude', 'same_alias')$q$,
+  'SIDSERVER-MM-CONT-control-first: the Claude initial reserved alias claims through the measured form');
+select pg_temp.mm_lapse('claude');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''claude'', ''x'', ''approved'', ''unseen-same'', ''same_alias'')')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-same-alias: a lapsed Claude same_alias claim cannot bind an unseen id');
+select is(pg_temp.mm_alias_count('claude', 'unseen-same'), 0::bigint, 'SIDSERVER-MM-CONT-same-alias-no-row: no alias row is written');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''claude'', ''x'', ''approved'', ''unseen-new'', ''new'')')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-new: a lapsed Claude "new" claim cannot bind an unseen id');
+select is(pg_temp.mm_alias_count('claude', 'unseen-new'), 0::bigint, 'SIDSERVER-MM-CONT-new-no-row: no alias row is written');
+select is((select epoch from pg_temp.mm_state('claude')), (select epoch from _mm_results where label = 'claude-first'),
+  'SIDSERVER-MM-CONT-epoch-unchanged: refused unfamiliar-alias claims never rotate the epoch');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'unseen-other', 'preserved_uuids', %L)$r$,
+    (select agent_id from _mm_fixture where label = 'codex'))),
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-predecessor-other: preserved UUIDs naming another identity are refused');
+select is(pg_temp.mm_alias_count('claude', 'unseen-other'), 0::bigint, 'SIDSERVER-MM-CONT-predecessor-other-no-row: no alias row is written');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'bound-claude', 'same_alias', %L)$r$,
+    (select agent_id from _mm_fixture where label = 'claude'))),
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-predecessor-without-preserved: only preserved UUIDs may name a predecessor');
+reset role;
+insert into agent_board.session_id_aliases(identity_agent_id, root_agent_id, harness, session_id)
+select root_id, root_id, 'claude', 'taken-claude' from _mm_fixture where label = 'claude';
+set local role service_role;
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'taken-claude', 'preserved_uuids', %L)$r$,
+    (select agent_id from _mm_fixture where label = 'claude'))),
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-GATE-alias-collision: an id already bound under the same root and harness is never rebound');
+select lives_ok(format($q$select pg_temp.mm('claude', 'claude-resumed', 'approved', 'resumed-claude', 'preserved_uuids', %L)$q$,
+    (select agent_id from _mm_fixture where label = 'claude')),
+  'SIDSERVER-MM-CONT-preserved: measured preserved-UUID continuity of this identity reclaims through a new id');
+select is((select row(r.refusal is null, r.secret ~ '^[0-9a-f]{64}$', r.epoch - (select epoch from _mm_results where label = 'claude-first'),
+    pg_temp.mm_alias_count('claude', 'resumed-claude'))::text from _mm_results r where r.label = 'claude-resumed'),
+  '(t,t,1,1)', 'SIDSERVER-MM-CONT-preserved-state: the resumed id is bound, a new holder issued and the epoch fenced');
+
+-- Own-alias reclaim and the live-lease refusal are unchanged.
+select pg_temp.mm_lapse('claude');
+select lives_ok($q$select pg_temp.mm('claude', 'claude-own', 'approved', 'bound-claude', 'same_alias')$q$,
+  'SIDSERVER-MM-CONT-own-alias: a lapsed holder reclaims through its own bound alias');
+select is((select r.epoch - (select epoch from _mm_results where label = 'claude-resumed') from _mm_results r where r.label = 'claude-own'), 1::bigint,
+  'SIDSERVER-MM-CONT-own-alias-epoch: own-alias reclaim fences the prior holder');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''claude'', ''x'', ''approved'', ''bound-claude'', ''same_alias'')')$q$,
+  '42501', 'duplicate_live_session', 'SIDSERVER-MM-CONT-live-duplicate: the identical live session is still refused');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''claude'', ''x'', ''approved'', ''resumed-claude'', ''same_alias'')')$q$,
+  '42501', 'identity_lease_live', 'SIDSERVER-MM-CONT-live-lease: another id cannot take a live lease');
+
+-- Codex never binds a new alias, whatever it measures ('recorded' is a claimed Codex identity).
+select pg_temp.mm_lapse('recorded');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''recorded'', ''x'', ''approved'', ''unseen-codex'', ''same_alias'')')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-codex-same-alias: a lapsed Codex identity cannot bind an unseen id');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('recorded', 'x', 'approved', 'unseen-codex', 'preserved_uuids', %L)$r$,
+    (select agent_id from _mm_fixture where label = 'recorded'))),
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-codex-preserved: a lapsed Codex identity cannot bind an unseen id even claiming preserved UUIDs');
+select is(pg_temp.mm_alias_count('recorded', 'unseen-codex'), 0::bigint, 'SIDSERVER-MM-CONT-codex-no-row: no Codex alias row is written');
+
+-- Behavioural half of gate parity: one refusal per gate of the trusted form, entered through the
+-- measured mint with every other gate satisfied.
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''tomb'', ''x'', ''approved'', ''bound-tomb'', ''same_alias'')')$q$,
+  '42501', 'identity_tombstoned', 'SIDSERVER-MM-GATE-tombstoned: a tombstoned identity is refused');
+-- The challenge is issued while the key is still active and proven (issuance refuses an inactive
+-- key); the key then loses its proof before the mint, so only the mint's own gate can refuse it.
+select pg_temp.mm_issue('unproven');
+reset role;
+update agent_board.agent_signing_keys set status = 'revoked', revoked_at = now(), proof_state = 'unproven'
+ where id = (select key_id from _mm_fixture where label = 'unproven');
+set local role service_role;
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_fixed(''unproven'', ''x'')')$q$,
+  '42501', 'key_unproven: session key requires proof', 'SIDSERVER-MM-GATE-key-unproven: an unproven session key is refused before the challenge is used');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''unclaimed'', ''x'', ''approved'', ''not-reserved'', ''same_alias'')')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-GATE-first-claim-alias: a first claim must use the reserved alias');
+select lives_ok($q$select pg_temp.mm('ancestor', 'ancestor', 'approved', 'bound-ancestor', 'same_alias')$q$,
+  'SIDSERVER-MM-GATE-frozen-ancestor-returns: a frozen ancestor refusal is returned, not raised');
+select is((select row(r.refusal, r.secret, s.resolution_state)::text from _mm_results r, pg_temp.mm_state('ancestor') s where r.label = 'ancestor'),
+  '(identity_fingerprint_unapproved,,active)', 'SIDSERVER-MM-GATE-frozen-ancestor: a frozen ancestor refuses an approved child without freezing it');
+select pg_temp.mm_issue('replay');
+select lives_ok($q$select pg_temp.mm_fixed('replay', 'replay-first')$q$, 'SIDSERVER-MM-GATE-replay-control: the fixed challenge mints once');
+reset role;
+select pg_temp.mm_lapse('replay');
+set local role service_role;
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_fixed(''replay'', ''replay-again'')')$q$,
+  '23505', null, 'SIDSERVER-MM-GATE-nonce-replay: the inherited challenge gate refuses a second use');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'resumed-claude', 'same_alias', null, %L)$r$,
+    repeat('0', 64))),
+  '42501', 'identity_lease_not_held', 'SIDSERVER-MM-GATE-holder-mismatch: a live lease with the wrong holder secret is refused');
+
+-- Claimant-chosen holder secret (#653 re-panel BLOCK B): a claim stores the presented secret, so
+-- a claimant whose response was lost refreshes its own live lease by re-presenting it, while any
+-- other claimant of the identical session id is still refused.
+select pg_temp.mm_lapse('claude');
+select lives_ok(format($q$select pg_temp.mm('claude', 'claimant-claim', 'approved', 'bound-claude', 'same_alias', null, %L)$q$, repeat('a', 64)),
+  'SIDSERVER-MM-CLAIMANT-claim-control: a lapsed holder reclaims presenting its own secret');
+select lives_ok(format($q$select pg_temp.mm('claude', 'claimant-retry', 'approved', 'bound-claude', 'same_alias', null, %L)$q$, repeat('a', 64)),
+  'SIDSERVER-MM-CLAIMANT-lost-response: re-presenting the claimed secret after a lost response is not refused');
+select is((select row(c.secret = repeat('a', 64), r.refusal is null, r.secret is null, r.epoch = c.epoch)::text
+    from _mm_results c, _mm_results r where c.label = 'claimant-claim' and r.label = 'claimant-retry'),
+  '(t,t,t,t)', 'SIDSERVER-MM-CLAIMANT-stored: the claim stored the presented secret and the retry refreshed it at the same epoch');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'bound-claude', 'same_alias', null, %L)$r$,
+    repeat('b', 64))),
+  '42501', 'duplicate_live_session', 'SIDSERVER-MM-CLAIMANT-other: another claimant of the identical live session id is refused whatever it presents');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, $r$select pg_temp.mm('claude', 'x', 'approved', 'bound-claude', 'same_alias', null, 'not-a-secret')$r$),
+  '22023', 'invalid holder secret', 'SIDSERVER-MM-CLAIMANT-malformed: a presented secret that is not 64 lower hex is refused before it could be stored');
+
+-- Positive footprint of the legacy-key relay exemption (deps.ts five-key call): the trusted
+-- form WITHOUT a session id can never claim a session identity.
+select lives_ok($q$select pg_temp.mm('claude-lapse', 'cl-first', 'approved', 'bound-claude-lapse', 'same_alias')$q$,
+  'SIDSERVER-MM-EXEMPT-control: a Claude fixture claims before its lease lapses');
+select pg_temp.mm_lapse('claude-lapse');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_trusted(''claude-lapse'', null)')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-EXEMPT-legacy-key-lapsed: the trusted form without a session id refuses a lapsed session identity');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_trusted(''codex-b'', null)')$q$,
+  '42501', 'identity_fingerprint_unapproved', 'SIDSERVER-MM-EXEMPT-legacy-key-frozen: the trusted form refuses the identity frozen by a measured mint');
+reset role;
+update agent_board.session_identities set resolution_state = 'active', current_risky_digest = 'approved'
+ where agent_id = (select agent_id from _mm_fixture where label = 'unresolved');
+set local role service_role;
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_trusted(''unresolved'', null)')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-EXEMPT-legacy-key-unclaimed: the trusted form without a session id refuses an unclaimed session identity');
+-- And a direct non-service caller is refused by both overloads.
+reset role;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+set local role authenticated;
+select throws_ok($q$select * from agent_board.mint_fleet_agent_session_measured(gen_random_uuid(), 'n', gen_random_uuid(), gen_random_uuid(), 900, null, 's', '{"resolution":"resolved","risky_digest":"approved"}'::jsonb, 'same_alias', null)$q$,
+  '42501', null, 'SIDSERVER-MM-CAT-05: authenticated cannot execute the measured mint');
+reset role;
+-- Inherited service-role gate, entered by a caller that CAN execute it (the owner) without the
+-- service_role claim, so the grant cannot mask the in-body gate.
+select throws_ok($q$select pg_temp.mm_refuse('select * from agent_board.mint_fleet_agent_session_measured(gen_random_uuid(), ''n'', gen_random_uuid(), gen_random_uuid(), 900, null, ''s'', ''{"resolution":"resolved","risky_digest":"approved"}''::jsonb, ''same_alias'', null)')$q$,
+  '42501', 'session mint is service_role-only', 'SIDSERVER-MM-GATE-service-role: a non-service claim is refused in the body, not only by the grant');
+
+select * from finish();
+rollback;

package/tests/agent_board_session_identity_predicate_isolation.test.sql

@@ -0,0 +1,146 @@
+-- SIDSERVER SL-5 acceptance-audit closure (plan amendment 2026-11-01, decision 2): RPC-level predicate isolation for
+-- the matrix rows `mismatch-renewed` (row 17) and `ancestor-digest-bypassed` (row 42). Every allow path is lives_ok
+-- followed by a separate state check. Where another guard would mask a predicate, the assertion isolates it with
+-- every other gate satisfied. renew_session_identity calls renew_delegated_grant, and that function repeats the
+-- refusal, so these assertions pin the function that RAISED as well as the SQLSTATE and message. States the public
+-- writers cannot produce (active but drifted, active with a null approval) are constructed inside this rolled-back
+-- transaction, only to isolate a predicate. They are never an approved test parent.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(21);
+create temp table _sid_iso_root(root_id uuid, root_auth uuid);
+create temp table _sid_iso_children(label text primary key, agent_id uuid, key_id uuid, expires_at timestamptz);
+create temp table _sid_iso_tokens(label text, expires_at timestamptz, epoch bigint);
+create temp table _sid_iso_results(label text primary key, value boolean);
+do $$
+declare v_root uuid := gen_random_uuid(); v_auth uuid;
+begin
+  v_auth := public.ensure_github_user('sid-iso-' || v_root, 'sid-iso-' || v_root || '@example.test', 'sid-iso-' || v_root, 'Isolation root');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_root, 'agent', 'sid-iso-' || v_root, 'Isolation root', 'active', v_auth, v_auth);
+  insert into agent_board.session_identities(agent_id, root_agent_id, depth, current_risky_digest, approved_risky_digest)
+  values (v_root, v_root, 0, 'approved', 'approved');
+  insert into _sid_iso_root values (v_root, v_auth);
+end;
+$$;
+grant select on _sid_iso_root, _sid_iso_children to authenticated, service_role;
+grant insert on _sid_iso_children, _sid_iso_tokens, _sid_iso_results to service_role;
+create function pg_temp.sid_iso_mint(p_label text, p_parent text default null)
+returns void language plpgsql as $$
+declare v_parent uuid;
+begin
+  v_parent := coalesce((select agent_id from _sid_iso_children where label = p_parent), (select root_id from _sid_iso_root));
+  insert into _sid_iso_children
+  select p_label, m.child_agent_id, m.signing_key_id, m.grant_expires_at
+  from agent_board.mint_delegated_child(v_parent, 'sid-iso-' || p_label || '-' || substr(v_parent::text, 1, 8), '[]',
+    public.test_pubkey(p_label || v_parent), interval '30 days', false, 'claude', 'iso-' || p_label,
+    case when p_parent is not null then '0' end, '[]', '{"resolution":"resolved","risky_digest":"approved"}'::jsonb) m;
+end;
+$$;
+create function pg_temp.sid_iso_token(p_label text)
+returns void language plpgsql as $$
+declare v_child record; v_challenge record;
+begin
+  select * into v_child from _sid_iso_children where label = p_label;
+  select * into v_challenge from agent_board.issue_signing_key_challenge(v_child.agent_id, 'delegated-ephemeral');
+  insert into _sid_iso_tokens
+  select p_label, m.expires_at, m.identity_lease_epoch from agent_board.mint_fleet_agent_session(
+    v_challenge.challenge_id, split_part(v_challenge.challenge, ':', 3), v_child.key_id, v_child.agent_id, 900, null, 'iso-' || p_label) m;
+end;
+$$;
+-- Never raises: returns '<sqlstate>|<message>|<name of the function that raised>' for a refusal, or 'no refusal'.
+create function pg_temp.sid_iso_refusal(p_call text)
+returns text language plpgsql as $$
+declare v_state text; v_message text; v_context text;
+begin
+  execute p_call;
+  return 'no refusal';
+exception when others then
+  get stacked diagnostics v_state = returned_sqlstate, v_message = message_text, v_context = pg_exception_context;
+  return v_state || '|' || v_message || '|'
+    || coalesce(substring(split_part(v_context, E'\n', 1) from 'function (?:[a-z_]+\.)?([a-z_]+)\('), 'unknown');
+end;
+$$;
+grant execute on function pg_temp.sid_iso_mint(text, text), pg_temp.sid_iso_token(text), pg_temp.sid_iso_refusal(text) to service_role, authenticated;
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sid_iso_root), 'root_minted', '[]', 200, interval '30 days', true)$q$,
+  'SIDSERVER-FP-03/isolation-policy-control: operator configures the root delegation policy');
+select lives_ok($q$select pg_temp.sid_iso_mint('parent'); select pg_temp.sid_iso_mint('target', 'parent')$q$,
+  'SIDSERVER-FP-03/isolation-mint-control: approved parent and target session children enter the real issuer');
+reset role;
+select is((select count(*) from _sid_iso_children), 2::bigint, 'SIDSERVER-FP-03/isolation-mint-state: both principals exist');
+select is((select array[approved_risky_digest, current_risky_digest, resolution_state] from agent_board.session_identities
+  where agent_id = (select agent_id from _sid_iso_children where label = 'parent')), array['approved', 'approved', 'active'],
+  'SIDSERVER-FP-03/isolation-parent-state: the parent is approved, unchanged and active');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_iso_token('parent')$q$,
+  'SIDSERVER-FP-03/isolation-token-control: real challenge and key gates claim the parent lease');
+reset role;
+select is((select count(*) from _sid_iso_tokens where label = 'parent'), 1::bigint, 'SIDSERVER-FP-03/isolation-token-state: the parent holds an epoch-fenced lease');
+select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where id = (select agent_id from _sid_iso_children where label = 'parent')), true);
+select set_config('request.jwt.claim.identity_lease_epoch', (select epoch::text from _sid_iso_tokens where label = 'parent'), true);
+update agent_board.delegation_grants set grant_expires_at = now() + interval '1 hour' where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select lives_ok($q$select agent_board.renew_session_identity((select agent_id from _sid_iso_children where label = 'parent'), 'approved')$q$,
+  'SIDSERVER-FP-03/isolation-renew-control: the approved live holder renews through renew_session_identity');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent')), now() + interval '7 days',
+  'SIDSERVER-FP-03/isolation-renew-state: that renewal extends the grant to the seven-day ceiling');
+update agent_board.delegation_grants set grant_expires_at = now() + interval '1 hour' where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select lives_ok($q$select agent_board.renew_delegated_grant((select agent_id from _sid_iso_children where label = 'parent'), interval '2 hours')$q$,
+  'SIDSERVER-FP-03/isolation-delegated-control: the approved live holder renews through renew_delegated_grant');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent')), now() + interval '2 hours',
+  'SIDSERVER-FP-03/isolation-delegated-state: that renewal extends the grant by the requested interval');
+
+-- Row 17, renew_session_identity/current-vs-approved: active, approved = supplied, current drifted.
+update agent_board.session_identities set current_risky_digest = 'changed' where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select is(pg_temp.sid_iso_refusal($q$select agent_board.renew_session_identity((select agent_id from _sid_iso_children where label = 'parent'), 'approved')$q$),
+  '42501|identity_fingerprint_unapproved|renew_session_identity',
+  'SIDSERVER-FP-03/mismatch/renew_session_identity/current-vs-approved: renew_session_identity itself refuses a drifted current reading before the delegated grant gate');
+reset role;
+-- Row 17, renew_session_identity/approved-null and renew_delegated_grant/approved-null: active, no approval, no reading.
+update agent_board.session_identities set current_risky_digest = null, approved_risky_digest = null where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+select is((select array[coalesce(approved_risky_digest, '<null>'), coalesce(current_risky_digest, '<null>'), resolution_state] from agent_board.session_identities
+  where agent_id = (select agent_id from _sid_iso_children where label = 'parent')), array['<null>', '<null>', 'active'],
+  'SIDSERVER-FP-03/isolation-null-state: the constructed identity is active with neither approval nor reading');
+set local role service_role;
+select is(pg_temp.sid_iso_refusal($q$select agent_board.renew_session_identity((select agent_id from _sid_iso_children where label = 'parent'), null)$q$),
+  '42501|identity_fingerprint_unapproved|renew_session_identity',
+  'SIDSERVER-FP-03/mismatch/renew_session_identity/approved-null: renew_session_identity itself refuses an identity without an approval before the delegated grant gate');
+select is(pg_temp.sid_iso_refusal($q$select agent_board.renew_delegated_grant((select agent_id from _sid_iso_children where label = 'parent'), interval '3 hours')$q$),
+  '42501|identity_fingerprint_unapproved|renew_delegated_grant',
+  'SIDSERVER-FP-03/mismatch/renew_delegated_grant/approved-null: renew_delegated_grant refuses a session identity without an approval');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent')), now() + interval '2 hours',
+  'SIDSERVER-FP-03/isolation-null-no-renewal: neither refused renewal extended the grant');
+update agent_board.session_identities set current_risky_digest = 'approved', approved_risky_digest = 'approved' where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+
+-- Row 42: _session_identity_ancestor_actor with the parent as the verified current actor and the target's reading approved.
+set local role service_role;
+select lives_ok($q$insert into _sid_iso_results select 'ancestor-control', agent_board._session_identity_ancestor_actor((select agent_id from _sid_iso_children where label = 'target'))$q$,
+  'SIDSERVER-APPROVE-01/ancestor-digest/isolation-control: the predicate is evaluated for the approved live parent');
+reset role;
+select is((select value from _sid_iso_results where label = 'ancestor-control'), true,
+  'SIDSERVER-APPROVE-01/ancestor-digest/isolation-state: the approved live parent is the target''s ancestor approver');
+update agent_board.session_identities set current_risky_digest = 'drifted' where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select lives_ok($q$insert into _sid_iso_results select 'ancestor-current', agent_board._session_identity_ancestor_actor((select agent_id from _sid_iso_children where label = 'target'))$q$,
+  'SIDSERVER-APPROVE-01/ancestor-digest/current-control: the predicate is evaluated for an active parent whose reading drifted');
+reset role;
+select is((select value from _sid_iso_results where label = 'ancestor-current'), false,
+  'SIDSERVER-APPROVE-01/ancestor-digest/current: an active parent whose own current reading drifted from its approval cannot approve the target');
+update agent_board.session_identities set current_risky_digest = null, approved_risky_digest = null where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select lives_ok($q$insert into _sid_iso_results select 'ancestor-null', agent_board._session_identity_ancestor_actor((select agent_id from _sid_iso_children where label = 'target'))$q$,
+  'SIDSERVER-APPROVE-01/ancestor-digest/non-null-control: the predicate is evaluated for an active parent without any approval');
+reset role;
+select is((select value from _sid_iso_results where label = 'ancestor-null'), false,
+  'SIDSERVER-APPROVE-01/ancestor-digest/non-null: an active parent without any approval cannot approve the target');
+select * from finish();
+rollback;

package/tests/agent_board_session_provenance.test.sql

@@ -0,0 +1,106 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(32);
+
+create function pg_temp.a(n integer) returns uuid language sql immutable as $$
+  select ('66500000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid
+$$;
+create function pg_temp.claim(n integer) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub', pg_temp.a(n))::text, true);
+end
+$$;
+insert into auth.users(id, instance_id, aud, role, email)
+select pg_temp.a(n), '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'prov665-' || n || '@test.invalid'
+from generate_series(1, 15) n;
+insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id)
+select pg_temp.a(n), 'agent', 'prov665-' || n, 'Provenance ' || n, 'active', pg_temp.a(n)
+from generate_series(1, 15) n;
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility)
+values (pg_temp.a(100), 'prov665', 'Provenance', pg_temp.a(1), 'open');
+insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
+values (pg_temp.a(100), pg_temp.a(1), 'joined', 'owner', pg_temp.a(1)),
+       (pg_temp.a(100), pg_temp.a(5), 'requested', 'member', pg_temp.a(5)),
+       (pg_temp.a(100), pg_temp.a(6), 'requested', 'member', pg_temp.a(6)),
+       (pg_temp.a(100), pg_temp.a(6), 'joined', 'member', pg_temp.a(6)),
+       (pg_temp.a(100), pg_temp.a(10), 'requested', 'member', pg_temp.a(10)),
+       (pg_temp.a(100), pg_temp.a(15), 'requested', 'member', pg_temp.a(15)),
+       (pg_temp.a(100), pg_temp.a(15), 'joined', 'member', pg_temp.a(15));
+-- Subject-authored requests establish the consent an approval needs (#82).
+do $$ declare a integer; begin
+  for a in 13..14 loop
+    perform pg_temp.claim(a);
+    perform agent_board.request_join_board(pg_temp.a(100), pg_temp.a(a));
+  end loop;
+end $$;
+create temp table active_before as
+select id, created_by_agent_id from agent_board.board_memberships
+ where board_id = pg_temp.a(100) and agent_id = pg_temp.a(15) and membership_state = 'joined';
+
+-- The population is catalog-derived. No exemption list or hard-coded RPC scan.
+create temp table provenance_sites as
+select p.oid, p.oid::regprocedure::text as signature,
+       agent_board_test.stripped_body(p.oid) as body
+from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = 'agent_board'
+  and 'p_created_by_agent_id' = any(p.proargnames)
+  and has_function_privilege('authenticated', p.oid, 'EXECUTE')
+  and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('agent_board._upsert_board_membership_state');
+select is((select string_agg(p.proname::text, ',' order by p.proname) from provenance_sites s join pg_proc p on p.oid = s.oid),
+          'invite_board_member,join_board,resolve_board_request', 'PROV-1 membership provenance class population');
+select is((select coalesce(string_agg(signature, ', '), '') from provenance_sites where body ~ agent_board_test.ident_re('p_created_by_agent_id')),
+          '', 'PROV-2 no membership RPC consumes caller-asserted provenance; offenders named');
+select is((select coalesce(string_agg(signature, ', '), '') from provenance_sites
+           where has_function_privilege('anon', oid, 'EXECUTE') or not has_function_privilege('service_role', oid, 'EXECUTE')),
+          '', 'PROV-3 membership provenance class has restricted ACLs');
+select is((select coalesce(string_agg(signature, ', '), '') from provenance_sites where obj_description(oid, 'pg_proc') is null),
+          '', 'PROV-4 membership provenance class documents attribution');
+
+select pg_temp.claim(1);
+select lives_ok($$select agent_board.invite_board_member(pg_temp.a(100), pg_temp.a(3), pg_temp.a(2))$$, 'PROV-5 invite accepts compatibility attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(3)), pg_temp.a(1), 'PROV-6 invite attribution is session actor');
+select lives_ok($$select agent_board.invite_board_member(pg_temp.a(100), pg_temp.a(4), null)$$, 'PROV-7 invite accepts NULL attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(4)), pg_temp.a(1), 'PROV-8 NULL invite attribution is session actor');
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(5), 'removed', pg_temp.a(2))$$, 'PROV-9 resolution accepts compatibility attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(5) and membership_state = 'left'), pg_temp.a(1), 'PROV-10 resolution attribution is session actor');
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(6), 'joined', pg_temp.a(2))$$, 'PROV-11 redundant pending retirement succeeds');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(6) and membership_state = 'left'), pg_temp.a(1), 'PROV-12 retirement attribution is session actor');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(6) and membership_state = 'joined'), pg_temp.a(6), 'PROV-13 no-op preserves active row attribution');
+
+select pg_temp.claim(7);
+select lives_ok($$select agent_board.join_board(pg_temp.a(100), pg_temp.a(7), 'joined', pg_temp.a(2))$$, 'PROV-14 self-join accepts compatibility attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(7)), pg_temp.a(7), 'PROV-15 join attribution is session actor');
+select pg_temp.claim(8);
+select lives_ok($$select agent_board.join_board(pg_temp.a(100), pg_temp.a(8), 'joined', null)$$, 'PROV-16 self-join accepts NULL attribution');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(8)), pg_temp.a(8), 'PROV-17 NULL join attribution is session actor');
+
+select set_config('request.jwt.claims', '{"role":"service_role"}', true);
+select lives_ok($$select agent_board.invite_board_member(pg_temp.a(100), pg_temp.a(9), pg_temp.a(2))$$, 'PROV-18 unresolved service invitation succeeds');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(9)), null::uuid, 'PROV-19 service invitation does not invent agent attribution');
+-- #668 (owner-confirmed 2026-10-26): resolution requires a RESOLVED same-board owner/admin, so an
+-- unresolved service-role session is refused and the pending row keeps its state and provenance.
+select throws_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(10), 'removed', pg_temp.a(2))$$, '42501', null, 'PROV-20 unresolved service resolution refused');
+select is((select string_agg(membership_state || ':' || coalesce(created_by_agent_id::text, 'null'), ',') from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(10)),
+          'requested:' || pg_temp.a(10)::text, 'PROV-21 refused service resolution leaves the pending row and its provenance unchanged');
+select lives_ok($$select agent_board.join_board(pg_temp.a(100), pg_temp.a(11), 'joined', pg_temp.a(2))$$, 'PROV-22 unresolved service join succeeds');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(11)), null::uuid, 'PROV-23 service join does not invent agent attribution');
+select set_config('request.jwt.claims', '{"role":"authenticated"}', true);
+select throws_ok($$select agent_board.invite_board_member(pg_temp.a(100), pg_temp.a(12), pg_temp.a(1))$$, '42501', null, 'PROV-24 unresolved authenticated invite denied');
+select is((select count(*)::integer from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(12)), 0, 'PROV-25 denied invitation writes nothing');
+
+-- A RESOLVED service-role owner session: attribution is that session's agent, never the forged
+-- compatibility argument (pg_temp.a(2) is not even a member).
+select set_config('request.jwt.claims', json_build_object('role', 'service_role', 'sub', pg_temp.a(1))::text, true);
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(13), 'joined', pg_temp.a(2))$$, 'PROV-26 resolved service owner approves with forged attribution');
+select is((select string_agg(membership_state || ':' || coalesce(created_by_agent_id::text, 'null'), ',') from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(13)),
+          'joined:' || pg_temp.a(1)::text, 'PROV-27 service owner approval attribution is the session actor');
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(14), 'removed', pg_temp.a(2))$$, 'PROV-28 resolved service owner rejects with forged attribution');
+select is((select string_agg(membership_state || ':' || coalesce(created_by_agent_id::text, 'null'), ',') from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(14)),
+          'left:' || pg_temp.a(1)::text, 'PROV-29 service owner rejection attribution is the session actor');
+select lives_ok($$select agent_board.resolve_board_request(pg_temp.a(100), pg_temp.a(15), 'joined', pg_temp.a(2))$$, 'PROV-30 resolved service owner no-op retires the redundant request');
+select is((select created_by_agent_id from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(15) and membership_state = 'left'), pg_temp.a(1), 'PROV-31 service owner retirement attribution is the session actor');
+select is((select array_agg(row(id, created_by_agent_id)::text) from agent_board.board_memberships where board_id = pg_temp.a(100) and agent_id = pg_temp.a(15) and membership_state = 'joined'),
+          (select array_agg(row(id, created_by_agent_id)::text) from active_before), 'PROV-32 no-op keeps the active row identity and attribution');
+select * from finish();
+rollback;