@consiliency/agent-board-schema 1.64.0 → 1.74.0

package/migrations/20261101000100_agent_board_session_measured_mint.sql

@@ -0,0 +1,145 @@
+-- SIDSERVER blocker fix (Consiliency/message-board#653 panel BLOCKs 1 and 2; owner decision
+-- 2026-11-01 "Fix + new replay round", shape "Measured overload" -- a separate strict function
+-- the relay calls exclusively; named distinctly by exec decision so that every frozen
+-- one-row-per-name contract (SIDCLIENT) keeps holding).
+--
+-- The seven-argument mint_fleet_agent_session is the SIDSCHEMA "trusted caller" form: it gates
+-- on the STORED current/approved digests and lets a lapsed Claude identity bind any unseen
+-- session id. Frozen SIDSCHEMA tests pin both behaviours, so that form is left byte-identical.
+-- The relay must instead call this measured function, which receives the PoP-verified binding's
+-- measured fingerprint, continuity and predecessor and:
+--
+--   1. records the measured reading after the challenge is validated and consumed, and on a
+--      changed risky digest durably freezes the identity and RETURNS a refusal row (raising
+--      would roll the freeze back; the refused session row is revoked in the same transaction);
+--   2. binds a NEW alias on a lapsed reclaim only for continuity preserved_uuids whose
+--      predecessor is this identity; any other unfamiliar alias refuses identity_continuity_refused;
+--   3. stores the CLAIMANT'S presented holder secret when it claims or reclaims (generating one
+--      only when none is presented), so a claim whose response is lost is recovered in place: the
+--      retry re-presents that secret and refreshes the claimant's own live lease (#653 re-panel
+--      BLOCK B). On a live lease the identical bound session id refuses duplicate_live_session
+--      whatever secret it presents, then a wrong secret refuses identity_lease_not_held, so every
+--      OTHER claimant is still refused while the lease is live.
+--
+-- The residual -- a service_role caller can still choose the seven-argument trusted form -- is
+-- pre-existing and recorded on Consiliency/message-board#722.
+create function agent_board.mint_fleet_agent_session_measured(
+  p_challenge_id uuid, p_nonce text, p_signing_key_id uuid, p_agent_id uuid,
+  p_max_ttl_seconds integer, p_holder_secret text, p_session_id text,
+  p_fingerprint jsonb, p_continuity text, p_predecessor_agent_id uuid
+) returns table(session_id text, expires_at timestamptz, identity_lease_epoch bigint, holder_secret text, refusal text)
+language plpgsql security definer set search_path = agent_board, public as $$
+declare v_identity agent_board.session_identities%rowtype; v_session record; v_new_secret text; v_alias uuid;
+  v_ancestor_expires timestamptz; v_grant_expires timestamptz; v_state text;
+  v_risky text := nullif(p_fingerprint ->> 'risky_digest', '');
+  v_recorded jsonb;
+begin
+  if not agent_board._is_service_role() then raise exception 'session mint is service_role-only' using errcode = '42501'; end if;
+  if p_fingerprint is null or jsonb_typeof(p_fingerprint) <> 'object'
+     or coalesce(p_fingerprint ->> 'resolution', '') not in ('resolved', 'unresolved')
+     or jsonb_typeof(coalesce(p_fingerprint -> 'recorded', '{}'::jsonb)) <> 'object' then
+    raise exception 'invalid identity fingerprint reading' using errcode = '22023';
+  end if;
+  v_recorded := coalesce(p_fingerprint -> 'recorded', '{}'::jsonb) || jsonb_build_object('resolution', p_fingerprint ->> 'resolution');
+  if p_holder_secret is not null and p_holder_secret !~ '^[0-9a-f]{64}$' then
+    raise exception 'invalid holder secret' using errcode = '22023';
+  end if;
+  if p_session_id is null or length(p_session_id) = 0
+     or p_continuity is null or p_continuity not in ('same_alias', 'preserved_uuids', 'new', 'fork', 'ambiguous_fork') then
+    raise exception 'invalid measured session binding' using errcode = '22023';
+  end if;
+  -- The predecessor is the measured continuity evidence: preserved UUIDs name this identity,
+  -- every other class names none at a token mint.
+  if p_continuity = 'preserved_uuids' and p_predecessor_agent_id is distinct from p_agent_id
+     or p_continuity <> 'preserved_uuids' and p_predecessor_agent_id is not null then
+    raise exception 'identity_continuity_refused' using errcode = '42501';
+  end if;
+  -- Same challenge-before-principal and identity/alias-before-key order as the trusted form.
+  perform 1 from agent_board.agent_signing_key_challenges where id = p_challenge_id for update;
+  perform 1 from agent_board.agents where id = (
+    select root_agent_id from agent_board.session_identities where agent_id = p_agent_id
+  ) for no key update;
+  select * into v_identity from agent_board.session_identities where agent_id = p_agent_id for update;
+  perform 1 from agent_board.session_id_aliases where identity_agent_id = p_agent_id order by id for update;
+  if v_identity.tombstoned_at is not null then raise exception 'identity_tombstoned' using errcode = '42501'; end if;
+  if v_identity.agent_id is null or v_identity.identity_kind <> 'session' then
+    raise exception 'measured mint requires a session identity' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.agent_signing_keys k where k.id = p_signing_key_id
+    and k.agent_id = p_agent_id and k.proof_state = 'proven') then
+    raise exception 'key_unproven: session key requires proof' using errcode = '42501';
+  end if;
+  -- Validates and consumes the challenge (and the key/principal/grant gates) BEFORE the reading
+  -- is stored, so only a reading bound to a proven, single-use challenge can be recorded.
+  select * into v_session from agent_board._mint_fleet_agent_session_legacy(p_challenge_id, p_nonce, p_signing_key_id, p_agent_id, p_max_ttl_seconds);
+  v_state := case
+    when p_fingerprint ->> 'resolution' is distinct from 'resolved' or v_risky is null
+      or v_identity.approved_risky_digest is null then 'frozen'
+    when v_risky is distinct from v_identity.approved_risky_digest or v_identity.resolution_state = 'frozen' then 'frozen'
+    else 'active' end;
+  update agent_board.session_identities
+     set current_risky_digest = v_risky, recorded_fingerprint = v_recorded, resolution_state = v_state, updated_at = now()
+   where agent_id = p_agent_id;
+  if v_state = 'frozen' or exists (
+    with recursive ancestry(id, parent_agent_id) as (
+      select id, parent_agent_id from agent_board.agents where id = p_agent_id
+      union all
+      select a.id, a.parent_agent_id from agent_board.agents a join ancestry c on a.id = c.parent_agent_id
+    )
+    select 1 from ancestry a join agent_board.session_identities si on si.agent_id = a.id
+     where si.resolution_state = 'frozen'
+  ) then
+    -- Return, never raise: the recorded reading and freeze must commit with this refusal.
+    update agent_board.nonfleet_sessions s set revoked_at = now() where s.session_id = v_session.session_id;
+    return query select null::text, null::timestamptz, null::bigint, null::text, 'identity_fingerprint_unapproved'::text; return;
+  end if;
+  v_ancestor_expires := agent_board._session_identity_ancestor_ceiling(v_identity.parent_agent_id);
+  if not agent_board._session_identity_lease_live(p_agent_id) then
+    perform agent_board._session_identity_check_limits(v_identity.root_agent_id, v_identity.parent_agent_id, p_agent_id);
+  end if;
+  select g.grant_expires_at into v_grant_expires from agent_board.delegation_grants g where g.child_agent_id = p_agent_id;
+  v_session.expires_at := least(v_session.expires_at, v_ancestor_expires, v_grant_expires);
+  update agent_board.nonfleet_sessions s set expires_at = v_session.expires_at where s.session_id = v_session.session_id;
+  if v_identity.holder_secret_hash is not null and v_identity.last_heartbeat > now() - interval '180 seconds' then
+    if p_holder_secret is not null and extensions.digest(p_holder_secret, 'sha256') = v_identity.holder_secret_hash then
+      return query select v_session.session_id, v_session.expires_at, v_identity.credential_epoch, null::text, null::text; return;
+    end if;
+    if exists (select 1 from agent_board.session_id_aliases a where a.id = v_identity.lease_alias_id and a.session_id = p_session_id) then
+      raise exception 'duplicate_live_session' using errcode = '42501';
+    end if;
+    if p_holder_secret is not null then raise exception 'identity_lease_not_held' using errcode = '42501'; end if;
+    raise exception 'identity_lease_live' using errcode = '42501';
+  end if;
+  select a.id into v_alias from agent_board.session_id_aliases a
+   where a.identity_agent_id = p_agent_id and a.session_id = p_session_id;
+  if v_identity.holder_secret_hash is null then
+    if v_alias is null or v_alias is distinct from v_identity.lease_alias_id then raise exception 'identity_continuity_refused' using errcode = '42501'; end if;
+  elsif v_alias is null then
+    -- A lapsed reclaim may bind an unseen session id only as measured preserved-UUID continuity
+    -- (Claude resume; the predecessor = this identity rule is enforced once, above). Same-alias,
+    -- new and fork claims never mint a new alias.
+    if v_identity.harness <> 'claude' or p_continuity <> 'preserved_uuids' then
+      raise exception 'identity_continuity_refused' using errcode = '42501';
+    end if;
+    if exists (select 1 from agent_board.session_id_aliases a where a.root_agent_id = v_identity.root_agent_id
+      and a.harness = v_identity.harness and a.session_id = p_session_id) then
+      raise exception 'identity_continuity_refused' using errcode = '42501';
+    end if;
+    insert into agent_board.session_id_aliases(identity_agent_id, root_agent_id, harness, session_id)
+    values (p_agent_id, v_identity.root_agent_id, v_identity.harness, p_session_id) returning id into v_alias;
+  end if;
+  -- The claimant's own presented secret becomes the lease secret (the relay admits only 64 lower
+  -- hex); a claimant presenting none gets a generated one, as in the trusted form.
+  v_new_secret := coalesce(p_holder_secret, encode(extensions.gen_random_bytes(32), 'hex'));
+  update agent_board.session_identities
+     set holder_secret_hash = extensions.digest(v_new_secret, 'sha256'), lease_alias_id = v_alias,
+         credential_epoch = case when holder_secret_hash is null then credential_epoch else credential_epoch + 1 end,
+         last_heartbeat = now(), updated_at = now()
+   where agent_id = p_agent_id
+  returning credential_epoch into identity_lease_epoch;
+  return query select v_session.session_id, v_session.expires_at, identity_lease_epoch, v_new_secret, null::text;
+end;
+$$;
+revoke all on function agent_board.mint_fleet_agent_session_measured(uuid, text, uuid, uuid, integer, text, text, jsonb, text, uuid) from public, anon, authenticated, service_role;
+grant execute on function agent_board.mint_fleet_agent_session_measured(uuid, text, uuid, uuid, integer, text, text, jsonb, text, uuid) to service_role;
+comment on function agent_board.mint_fleet_agent_session_measured(uuid, text, uuid, uuid, integer, text, text, jsonb, text, uuid) is 'Service-role MEASURED session-identity PoP mint, the only session-identity mint the /session relay calls. It enforces every gate of the seven-argument mint_fleet_agent_session trusted form (pgTAP SIDSERVER-MM-PARITY-*) plus measured-reading and continuity gates. Fingerprint, continuity and predecessor come from the PoP-verified session binding. After the challenge is validated and consumed it records the measured reading; a changed or unresolved risky digest (or any frozen ancestor) durably freezes and RETURNS refusal identity_fingerprint_unapproved instead of raising, so the freeze commits and the refused session row is revoked. A lapsed reclaim binds an unseen alias only for preserved_uuids continuity naming this identity; otherwise identity_continuity_refused. A claim or reclaim stores the claimant-presented holder secret (generated only when none is presented), so a claim whose response was lost refreshes on retry; on a live lease the bound session id refuses duplicate_live_session before a wrong secret refuses identity_lease_not_held. Epoch rotation matches the seven-argument trusted form, which remains for SIDSCHEMA callers (residual: Consiliency/message-board#722).';