@consiliency/agent-board-schema 1.64.0 → 1.74.0

package/tests/mutations/717-f1/outbox_wake_ordering/W1_regrant_queue_inbox_callbacks.sql

@@ -0,0 +1 @@
+grant execute on function agent_board._queue_inbox_callbacks(uuid,text) to service_role;

package/tests/mutations/717-f1/outbox_wake_ordering/W2_revoke_worker_from_service_role.sql

@@ -0,0 +1 @@
+revoke execute on function agent_board.claim_callback_outbox_events(integer) from service_role;

package/tests/mutations/717-f1/outbox_wake_ordering/W3_invoker_caller_of_sink.sql

@@ -0,0 +1 @@
+create function agent_board.wo_invoker_probe(p uuid) returns integer language sql security invoker as $f$ select agent_board._queue_inbox_callbacks(p, 'inbox.item.delivered') $f$;

package/tests/mutations/717-f1/outbox_wake_ordering/W4_public_regrant_board_post_sink.sql

@@ -0,0 +1 @@
+grant execute on function agent_board._queue_board_post_callbacks(uuid,uuid,text,text,text,jsonb) to public;

package/tests/mutations/717-f1/run.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Usage: PG* env set; run.sh <test.sql> <mutation.sql>...  Each mutation runs in ONE transaction with
+# the test file and is rolled back; the agent_board catalog fingerprint must match before and after.
+set -uo pipefail
+TEST="$1"; shift
+fp() { psql -qtAX -c "select md5(string_agg(p.oid::regprocedure::text||coalesce(p.proacl::text,'')||p.prosrc||coalesce(obj_description(p.oid,'pg_proc'),''), '|' order by p.oid::regprocedure::text)) from pg_proc p where p.pronamespace='agent_board'::regnamespace"; }
+for m in "$@"; do
+  before="$(fp)"
+  out="$(printf 'begin;\n\\i %s\n\\i %s\nrollback;\n' "$m" "$TEST" | psql -qtA 2>&1)"
+  after="$(fp)"
+  plan="$(sed -nE 's/^1\.\.([0-9]+)$/\1/p' <<<"$out" | head -1)"
+  nok="$(grep -cE '^ok [0-9]+' <<<"$out")"; nnot="$(grep -cE '^not ok [0-9]+' <<<"$out")"
+  errs="$(grep -E '(ERROR|FATAL):' <<<"$out" | head -3 | tr '\n' ' ')"
+  labels="$(grep -E '^not ok [0-9]+' <<<"$out" | sed -E 's/^not ok ([0-9]+) - ([A-Z]+-[A-Za-z0-9-]+( CLASS)?).*/#\1:\2/' | tr '\n' ' ')"
+  [ "$before" = "$after" ] && fpok=restored || fpok="FINGERPRINT-CHANGED"
+  echo "$(basename "$m" .sql) | plan=${plan:-none} ok=$nok not_ok=$nnot emitted=$((nok+nnot)) | $fpok | red: ${labels:-<none>} ${errs:+| errors: $errs}"
+done

package/tests/mutations/717-f2b/C1_new_delivery_route.sql

@@ -0,0 +1,4 @@
+-- a new API route that calls the delivery writer
+create function agent_board.zz_f2b_new_route(p uuid) returns void language plpgsql security definer set search_path = agent_board, public as $f$
+begin perform agent_board._upsert_delivery_recipient('direct', p, 'message', p); end $f$;
+grant execute on function agent_board.zz_f2b_new_route(uuid) to authenticated;

package/tests/mutations/717-f2b/C2_new_replay_lookup.sql

@@ -0,0 +1,3 @@
+-- a new routine that reads a message back by its idempotencyKey
+create function agent_board.zz_f2b_new_lookup(p text) returns uuid language sql as $f$
+  select id from agent_board.messages where metadata ->> 'idempotencyKey' = p limit 1 $f$;

package/tests/mutations/717-f2b/C3_internal_regranted.sql

@@ -0,0 +1,2 @@
+-- an internal delivery helper re-granted to authenticated
+grant execute on function agent_board._deliver_board_message(uuid,text,text,text) to authenticated;

package/tests/mutations/717-f2b/C4_wrapper_writes_delivery.sql

@@ -0,0 +1,9 @@
+-- a routes-core wrapper that writes a delivery itself
+do $m$ declare d text := pg_get_functiondef('agent_board.signed_send_direct_message(jsonb,jsonb)'::regprocedure); n text; begin
+  if position($q$  v_evidence_id := agent_board._record_signed_write_evidence($q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.signed_send_direct_message(jsonb,jsonb): %', left($q$  v_evidence_id := agent_board._record_signed_write_evidence($q$, 60); end if;
+  n := replace(d, $q$  v_evidence_id := agent_board._record_signed_write_evidence($q$, $q$  if false then perform agent_board._upsert_delivery_recipient('direct', v_actor, 'message', v_row.message_id); end if;
+  v_evidence_id := agent_board._record_signed_write_evidence($q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/C5_class_member_dynamic_sql.sql

@@ -0,0 +1,9 @@
+-- a class member that builds dynamic SQL (outside the name-match boundary)
+do $m$ declare d text := pg_get_functiondef('agent_board.signed_send_direct_message(jsonb,jsonb)'::regprocedure); n text; begin
+  if position($q$  v_evidence_id := agent_board._record_signed_write_evidence($q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.signed_send_direct_message(jsonb,jsonb): %', left($q$  v_evidence_id := agent_board._record_signed_write_evidence($q$, 60); end if;
+  n := replace(d, $q$  v_evidence_id := agent_board._record_signed_write_evidence($q$, $q$  if false then execute format('select 1'); end if;
+  v_evidence_id := agent_board._record_signed_write_evidence($q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/C6_drop_board_scope_constraint.sql

@@ -0,0 +1,2 @@
+-- the delivery_recipients board-scope CHECK the cores' mode conjunct relies on is dropped
+alter table agent_board.delivery_recipients drop constraint delivery_recipients_board_scope;

package/tests/mutations/717-f2b/C7_state_private_helper_content.sql

@@ -0,0 +1,14 @@
+do $m$
+declare d text := pg_get_functiondef('agent_board.update_inbox_item_state(uuid,uuid,text,jsonb)'::regprocedure);
+ anchor text := '  v_callback_count := agent_board._queue_inbox_callbacks';
+begin
+ if position(anchor in d)=0 then raise exception 'missing anchor'; end if;
+ execute replace(d, anchor, $inject$
+  perform agent_board._upsert_inbox_item(
+    v_inbox.delivery_recipient_id, v_inbox.recipient_agent_id, v_inbox.board_id,
+    v_inbox.delivery_mode, v_inbox.source_kind, v_inbox.source_message_id,
+    v_inbox.source_task_id, v_inbox.source_delegation_id, v_inbox.subject,
+    'REVIEW740-TRANSITIVE-CORRUPTION', v_inbox.priority, v_inbox.visible_in_inbox,
+    v_inbox.visible_in_board_feed, v_inbox.fetch_descriptor, v_inbox.metadata);
+$inject$ || anchor);
+end $m$;

package/tests/mutations/717-f2b/L1_dm_lock_split_by_recipient.sql

@@ -0,0 +1,8 @@
+-- direct: the idempotency lock is keyed by recipient (split domain)
+do $m$ declare d text := pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$    'send_direct_message:' || p_thread_id::text || ':' || v_actor_agent_id::text,$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb): %', left($q$    'send_direct_message:' || p_thread_id::text || ':' || v_actor_agent_id::text,$q$, 60); end if;
+  n := replace(d, $q$    'send_direct_message:' || p_thread_id::text || ':' || v_actor_agent_id::text,$q$, $q$    'send_direct_message:' || p_thread_id::text || ':' || v_actor_agent_id::text || ':' || p_recipient_agent_id::text,$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/L2_dm_lock_removed.sql

@@ -0,0 +1,12 @@
+-- direct: the idempotency lock is removed
+do $m$ declare d text := pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$  perform agent_board._lock_idempotency_key(
+    'send_direct_message:'$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb): %', left($q$  perform agent_board._lock_idempotency_key(
+    'send_direct_message:'$q$, 60); end if;
+  n := replace(d, $q$  perform agent_board._lock_idempotency_key(
+    'send_direct_message:'$q$, $q$  perform concat(
+    'send_direct_message:'$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/L3_mc_lock_split_by_recipients.sql

@@ -0,0 +1,8 @@
+-- multicast: the idempotency lock is keyed by the recipient set (split domain)
+do $m$ declare d text := pg_get_functiondef('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$    'send_multicast_message:' || p_thread_id::text || ':' || v_actor_agent_id::text,$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb): %', left($q$    'send_multicast_message:' || p_thread_id::text || ':' || v_actor_agent_id::text,$q$, 60); end if;
+  n := replace(d, $q$    'send_multicast_message:' || p_thread_id::text || ':' || v_actor_agent_id::text,$q$, $q$    'send_multicast_message:' || p_thread_id::text || ':' || v_actor_agent_id::text || ':' || array_to_string(v_recipient_ids, ','),$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/L4_mc_lock_removed.sql

@@ -0,0 +1,12 @@
+-- multicast: the idempotency lock is removed
+do $m$ declare d text := pg_get_functiondef('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$  perform agent_board._lock_idempotency_key(
+    'send_multicast_message:'$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb): %', left($q$  perform agent_board._lock_idempotency_key(
+    'send_multicast_message:'$q$, 60); end if;
+  n := replace(d, $q$  perform agent_board._lock_idempotency_key(
+    'send_multicast_message:'$q$, $q$  perform concat(
+    'send_multicast_message:'$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M0_prefix_definitions.sql

@@ -0,0 +1,17 @@
+-- pre-fix send_direct_message + send_multicast_message (exploit baseline)
+do $m$
+declare d text; s int; e int;
+begin
+  foreach d in array array[pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure), pg_get_functiondef('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure)] loop
+    s := position('  -- #717 F2b:' in d);
+    e := position('    raise exception ''message replay cannot widen delivery scope'' using errcode = ''42501'';
+  end if;
+
+' in d);
+    if s = 0 or e = 0 or e < s then raise exception 'M0 anchors not found'; end if;
+    execute left(d, s - 1) || substr(d, e + length('    raise exception ''message replay cannot widen delivery scope'' using errcode = ''42501'';
+  end if;
+
+'));
+  end loop;
+end $m$;

package/tests/mutations/717-f2b/M10_mc_lookup_any_author.sql

@@ -0,0 +1,15 @@
+-- multicast: the replay lookup is widened across authors
+do $m$ declare d text := pg_get_functiondef('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb): %', left($q$     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+$q$, 60); end if;
+  n := replace(d, $q$     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+$q$, $q$     where thread_id = p_thread_id
+$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M11_dm_swallow_refusal.sql

@@ -0,0 +1,8 @@
+-- direct: the core swallows its refusal and returns nothing
+do $m$ declare d text := pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$    raise exception 'message replay cannot widen delivery scope' using errcode = '42501';$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb): %', left($q$    raise exception 'message replay cannot widen delivery scope' using errcode = '42501';$q$, 60); end if;
+  n := replace(d, $q$    raise exception 'message replay cannot widen delivery scope' using errcode = '42501';$q$, $q$    return;$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M12_mc_swallow_refusal.sql

@@ -0,0 +1,8 @@
+-- multicast: the core swallows its refusal and returns nothing
+do $m$ declare d text := pg_get_functiondef('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$    raise exception 'message replay cannot widen delivery scope' using errcode = '42501';$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb): %', left($q$    raise exception 'message replay cannot widen delivery scope' using errcode = '42501';$q$, 60); end if;
+  n := replace(d, $q$    raise exception 'message replay cannot widen delivery scope' using errcode = '42501';$q$, $q$    return;$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M13_signed_dm_swallows_refusal.sql

@@ -0,0 +1,32 @@
+-- signed direct wrapper catches the core's 42501 and records evidence anyway
+do $m$ declare d text := pg_get_functiondef('agent_board.signed_send_direct_message(jsonb,jsonb)'::regprocedure); n text; begin
+  if position($q$  select *
+    into v_row
+    from agent_board.send_direct_message($q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.signed_send_direct_message(jsonb,jsonb): %', left($q$  select *
+    into v_row
+    from agent_board.send_direct_message($q$, 60); end if;
+  n := replace(d, $q$  select *
+    into v_row
+    from agent_board.send_direct_message($q$, $q$  begin
+  select *
+    into v_row
+    from agent_board.send_direct_message($q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  if position($q$    );
+
+  v_evidence_id :=$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.signed_send_direct_message(jsonb,jsonb): %', left($q$    );
+
+  v_evidence_id :=$q$, 60); end if;
+  n := replace(d, $q$    );
+
+  v_evidence_id :=$q$, $q$    );
+  exception when insufficient_privilege then
+    select null::uuid as message_id, null::uuid as delivery_recipient_id, null::uuid as inbox_item_id, 0 as callback_outbox_count, now() as created_at into v_row;
+  end;
+
+  v_evidence_id :=$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M14_signed_mc_swallows_refusal.sql

@@ -0,0 +1,20 @@
+-- signed multicast wrapper (both branches) catches the core's 42501
+do $m$ declare d text := pg_get_functiondef('agent_board.signed_send_multicast_message(jsonb,jsonb)'::regprocedure); n text; begin
+  if position($q$  if p_payload ? 'p_recipient_agent_ids' then$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.signed_send_multicast_message(jsonb,jsonb): %', left($q$  if p_payload ? 'p_recipient_agent_ids' then$q$, 60); end if;
+  n := replace(d, $q$  if p_payload ? 'p_recipient_agent_ids' then$q$, $q$  begin
+  if p_payload ? 'p_recipient_agent_ids' then$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  if position($q$  end if;
+  v_evidence_id :=$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.signed_send_multicast_message(jsonb,jsonb): %', left($q$  end if;
+  v_evidence_id :=$q$, 60); end if;
+  n := replace(d, $q$  end if;
+  v_evidence_id :=$q$, $q$  end if;
+  exception when insufficient_privilege then
+    select null::uuid as message_id, 0 as delivered_recipient_count, 0 as inbox_item_count, 0 as callback_outbox_count, now() as created_at into v_row;
+  end;
+  v_evidence_id :=$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M15_mc_any_source.sql

@@ -0,0 +1,7 @@
+do $m$
+declare d text := pg_get_functiondef('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure);
+ anchor text := '          and dr.source_message_id = v_message.id';
+begin
+ if position(anchor in d)=0 then raise exception 'missing anchor'; end if;
+ execute replace(d,anchor,'');
+end $m$;

package/tests/mutations/717-f2b/M1_dm_drop_recipient_proof.sql

@@ -0,0 +1,16 @@
+-- direct: the replay ceiling never fires
+do $m$ declare d text := pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$  if v_message.id is not null and not exists (
+    select 1
+      from agent_board.delivery_recipients dr$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb): %', left($q$  if v_message.id is not null and not exists (
+    select 1
+      from agent_board.delivery_recipients dr$q$, 60); end if;
+  n := replace(d, $q$  if v_message.id is not null and not exists (
+    select 1
+      from agent_board.delivery_recipients dr$q$, $q$  if false and not exists (
+    select 1
+      from agent_board.delivery_recipients dr$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M2_mc_drop_recipient_proof.sql

@@ -0,0 +1,16 @@
+-- multicast: the replay ceiling never fires
+do $m$ declare d text := pg_get_functiondef('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$  if v_message.id is not null and exists (
+    select 1
+      from unnest(v_recipient_ids) as requested(recipient_id)$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb): %', left($q$  if v_message.id is not null and exists (
+    select 1
+      from unnest(v_recipient_ids) as requested(recipient_id)$q$, 60); end if;
+  n := replace(d, $q$  if v_message.id is not null and exists (
+    select 1
+      from unnest(v_recipient_ids) as requested(recipient_id)$q$, $q$  if false and exists (
+    select 1
+      from unnest(v_recipient_ids) as requested(recipient_id)$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M3_dm_metadata_as_proof.sql

@@ -0,0 +1,12 @@
+-- direct: caller metadata naming the recipient substitutes for a delivery
+do $m$ declare d text := pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$       and dr.board_id is null
+  ) then$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb): %', left($q$       and dr.board_id is null
+  ) then$q$, 60); end if;
+  n := replace(d, $q$       and dr.board_id is null
+  ) then$q$, $q$       and dr.board_id is null
+  ) and coalesce(p_metadata ->> 'recipientAgentId', '') <> p_recipient_agent_id::text then$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M4_mc_metadata_as_proof.sql

@@ -0,0 +1,16 @@
+-- multicast: caller metadata naming the recipient substitutes for a delivery
+do $m$ declare d text := pg_get_functiondef('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$          and dr.board_id is null
+     )
+  ) then$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb): %', left($q$          and dr.board_id is null
+     )
+  ) then$q$, 60); end if;
+  n := replace(d, $q$          and dr.board_id is null
+     )
+  ) then$q$, $q$          and dr.board_id is null
+     ) and not (coalesce(p_metadata -> 'recipientAgentIds', '[]'::jsonb) ? requested.recipient_id::text)
+  ) then$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M5_dm_any_mode.sql

@@ -0,0 +1,11 @@
+-- direct: a delivery of the source in ANY mode counts as proof
+do $m$ declare d text := pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$       and dr.delivery_mode = 'direct'
+$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb): %', left($q$       and dr.delivery_mode = 'direct'
+$q$, 60); end if;
+  n := replace(d, $q$       and dr.delivery_mode = 'direct'
+$q$, $q$$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M6_dm_board_delivery_counts.sql

@@ -0,0 +1,11 @@
+-- direct: the `board_id is null` conjunct is dropped (EQUIVALENT given delivery_recipients_board_scope; see C6 and assertion 64)
+do $m$ declare d text := pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$       and dr.board_id is null
+  ) then$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb): %', left($q$       and dr.board_id is null
+  ) then$q$, 60); end if;
+  n := replace(d, $q$       and dr.board_id is null
+  ) then$q$, $q$  ) then$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M7_mc_any_mode.sql

@@ -0,0 +1,11 @@
+-- multicast: a delivery of the source in ANY mode counts as proof
+do $m$ declare d text := pg_get_functiondef('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$          and dr.delivery_mode = 'multicast'
+$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb): %', left($q$          and dr.delivery_mode = 'multicast'
+$q$, 60); end if;
+  n := replace(d, $q$          and dr.delivery_mode = 'multicast'
+$q$, $q$$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M8_dm_thread_stamp_as_proof.sql

@@ -0,0 +1,12 @@
+-- direct: a recipient on the thread's stamped board counts as proof
+do $m$ declare d text := pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$       and dr.board_id is null
+  ) then$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb): %', left($q$       and dr.board_id is null
+  ) then$q$, 60); end if;
+  n := replace(d, $q$       and dr.board_id is null
+  ) then$q$, $q$       and dr.board_id is null
+  ) and not exists (select 1 from agent_board.threads th join agent_board.board_memberships bm on bm.board_id = th.board_id where th.id = p_thread_id and bm.agent_id = p_recipient_agent_id and bm.membership_state = 'joined') then$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/M9_dm_lookup_any_author.sql

@@ -0,0 +1,15 @@
+-- direct: the replay lookup is widened across authors
+do $m$ declare d text := pg_get_functiondef('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure); n text; begin
+  if position($q$     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+$q$ in d) = 0 then raise exception 'mutation anchor not found in agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb): %', left($q$     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+$q$, 60); end if;
+  n := replace(d, $q$     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+$q$, $q$     where thread_id = p_thread_id
+$q$);
+  if n = d then raise exception 'mutation is a no-op'; end if;
+  d := n;
+  execute d;
+end $m$;

package/tests/mutations/717-f2b/run.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# #717 F2b mutation receipts. Connection comes ONLY from libpq environment (PGHOST/PGPORT/PGUSER/
+# PGPASSWORD/PGDATABASE), never argv. The target must be an OWNED database holding this tree's
+# applied bundle.
+#
+# Per mutation:
+#   pgTAP     the mutation and the test file run in ONE transaction that is rolled back; the file's
+#             plan / emitted / ok / not ok counts and the failing numbers are recorded (counted,
+#             never inferred from absence).
+#   isolation (M*, L* only) the mutation is COMMITTED, the spec is diffed against its golden, and
+#             every touched definition is restored from text captured BEFORE mutating.
+#   Both legs require the agent_board catalog fingerprint (every routine's signature, ACL, source
+#   and comment) to equal the pre-run value afterwards, or the run stops.
+# Usage: run.sh <receipt-path> [mutation.sql ...]   (default: every *.sql beside this script)
+set -uo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+PKG="$(cd "$HERE/../../.." && pwd)"
+TEST="$PKG/tests/agent_board_717_message_replay_scope.test.sql"
+SPEC="$PKG/tests/isolation/specs/message_replay_scope.spec"
+GOLDEN="$PKG/tests/isolation/expected/message_replay_scope.out"
+OUT="${1:?receipt path}"; shift
+if [ "$#" -gt 0 ]; then MUTS=("$@"); else mapfile -t MUTS < <(find "$HERE" -maxdepth 1 -name '*.sql' | sort -V); fi
+[ -n "${PGDATABASE:-}" ] || { echo "FATAL: PGDATABASE unset (libpq environment required)" >&2; exit 3; }
+ISO="$(ls -1 /usr/lib/postgresql/*/lib/pgxs/src/test/isolation/isolationtester 2>/dev/null | sort -V | tail -1)"
+[ -x "$ISO" ] || { echo "FATAL: isolationtester not found" >&2; exit 3; }
+WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+P=(psql -X -qtA)
+FNS=("agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)"
+     "agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)"
+     "agent_board.signed_send_direct_message(jsonb,jsonb)"
+     "agent_board.signed_send_multicast_message(jsonb,jsonb)")
+fp() { "${P[@]}" -c "select md5(string_agg(p.oid::regprocedure::text || coalesce(p.proacl::text, '') || p.prosrc || coalesce(obj_description(p.oid, 'pg_proc'), ''), '|' order by p.oid::regprocedure::text)) from pg_proc p where p.pronamespace = 'agent_board'::regnamespace"; }
+: > "$WORK/restore.sql"
+for f in "${FNS[@]}"; do
+  "${P[@]}" -c "select pg_get_functiondef('$f'::regprocedure)" >> "$WORK/restore.sql" || exit 3
+  printf ';\n' >> "$WORK/restore.sql"
+done
+ORIG="$(fp)"
+
+tap() { # $1 label, $2 mutation file or empty
+  local out plan ok nok
+  if [ -n "$2" ]; then out="$(printf 'begin;\n\\i %s\n\\i %s\nrollback;\n' "$2" "$TEST" | "${P[@]}" 2>&1)"
+  else out="$(printf 'begin;\n\\i %s\nrollback;\n' "$TEST" | "${P[@]}" 2>&1)"; fi
+  plan="$(sed -nE 's/^1\.\.([0-9]+)$/\1/p' <<<"$out" | head -1)"
+  ok="$(grep -cE '^ok [0-9]+' <<<"$out")"; nok="$(grep -cE '^not ok [0-9]+' <<<"$out")"
+  printf '%s: pgtap plan=%s emitted=%s ok=%s not_ok=%s\n' "$1" "${plan:-NONE}" "$((ok + nok))" "$ok" "$nok"
+  grep -E '^not ok [0-9]+' <<<"$out" | sed 's/^/    /'
+  grep -E '(ERROR|FATAL):' <<<"$out" | grep -v 'mutation' | head -3 | sed 's/^/    ERR /'
+  grep -E 'ERROR: .*mutation' <<<"$out" | head -1 | sed 's/^/    FATAL-MUTATION /'
+}
+iso() { # $1 label
+  "$ISO" "dbname=$PGDATABASE" < "$SPEC" > "$WORK/iso.out" 2>&1
+  if diff -q "$GOLDEN" "$WORK/iso.out" >/dev/null; then echo "    isolation=identical"
+  else
+    echo "    isolation=DIFFERS ($(diff "$GOLDEN" "$WORK/iso.out" | grep -cE '^[<>]') lines)"
+    diff "$GOLDEN" "$WORK/iso.out" | grep -E '^[<>] .*(ERROR|\|)' | head -6 | sed 's/^/      /'
+  fi
+}
+
+{
+  echo "# #717 F2b mutation receipt -- $(date -u +%FT%TZ)"
+  echo "# tree $(git -C "$PKG" rev-parse HEAD)$(git -C "$PKG" diff --quiet HEAD -- . || echo ' + uncommitted changes')"
+  echo "# catalog fingerprint before: $ORIG"
+  tap "BASELINE" ""; iso "BASELINE"
+  for m in "${MUTS[@]}"; do
+    name="$(basename "$m" .sql)"
+    echo "-- $name: $(head -1 "$m" | sed 's/^-- //')"
+    tap "$name" "$m"
+    [ "$(fp)" = "$ORIG" ] || { echo "FATAL: fingerprint changed after the rolled-back pgTAP leg of $name"; exit 3; }
+    case "$name" in
+      M*|L*)
+        "${P[@]}" -v ON_ERROR_STOP=1 -1 -f "$m" >/dev/null 2>&1 || { echo "FATAL: $name did not apply for the isolation leg"; exit 3; }
+        [ "$(fp)" != "$ORIG" ] || { echo "FATAL: $name applied but the fingerprint is unchanged (no-op)"; exit 3; }
+        iso "$name"
+        "${P[@]}" -v ON_ERROR_STOP=1 -1 -f "$WORK/restore.sql" >/dev/null || { echo "FATAL: restore failed after $name"; exit 3; }
+        [ "$(fp)" = "$ORIG" ] || { echo "FATAL: restore fingerprint differs after $name"; exit 3; }
+        echo "    restored: fingerprint identical" ;;
+    esac
+  done
+  tap "AFTER-RESTORE" ""; iso "AFTER-RESTORE"
+  echo "# catalog fingerprint after: $(fp)"
+} | tee "$OUT"