@consiliency/agent-board-schema 1.68.0 → 1.74.0

package/tests/agent_board_667_retention.test.sql

@@ -0,0 +1,201 @@
+-- #667: exercise every admitted retention branch against real rows. This is a
+-- behavioral state check, not a proof about arbitrary dynamic SQL or concurrency.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(62);
+create temp table xb_retention_ids(kind text primary key,id uuid not null) on commit drop;
+create temp table xb_retention_before(kind text primary key,row_data jsonb not null,row_count bigint not null) on commit drop;
+select lives_ok($q$
+do $setup$
+declare a uuid:=gen_random_uuid(); th uuid:=gen_random_uuid(); other_th uuid:=gen_random_uuid(); tk uuid:=gen_random_uuid(); msg uuid:=gen_random_uuid(); other_msg uuid:=gen_random_uuid();
+  ev uuid:=gen_random_uuid(); board uuid:=gen_random_uuid(); bm uuid:=gen_random_uuid(); dr uuid:=gen_random_uuid();
+  ib uuid:=gen_random_uuid(); ep uuid:=gen_random_uuid(); sub uuid:=gen_random_uuid(); ob uuid:=gen_random_uuid(); att uuid:=gen_random_uuid();
+  suffix text:=substr(replace(gen_random_uuid()::text,'-',''),1,12);
+begin
+  perform set_config('request.jwt.claim.role','service_role',true);
+  insert into agent_board.agents(id,agent_type,handle,display_name,status) values (a,'agent','xb-ret-'||suffix,'XB retention','active');
+  insert into agent_board.threads(id,thread_type,created_by_agent_id,subject) values (th,'coordination',a,'private retention'),(other_th,'coordination',a,'other retention anchor');
+  insert into agent_board.tasks(id,thread_id,created_by_agent_id,title) values (tk,th,a,'private task');
+  insert into agent_board.messages(id,thread_id,author_agent_id,message_sequence,body,metadata) values (msg,th,a,1,'private message',jsonb_build_object('note','keep')),(other_msg,other_th,a,1,'other retention message',jsonb_build_object('note','other'));
+  insert into agent_board.task_events(id,task_id,thread_id,actor_agent_id,event_sequence,event_type,payload,origin_posture) values (ev,tk,th,a,1,'created',jsonb_build_object('note','keep'),'unattested:signed-metadata-rpc');
+  insert into agent_board.presence(agent_id,thread_id,availability,activity_summary,expires_at,metadata) values (a,th,'ready','private activity',now()-interval '1 hour',jsonb_build_object('note','keep'));
+  insert into agent_board.boards(id,slug,name,created_by_agent_id,visibility,status) values (board,'xb-ret-'||suffix,'XB retention',a,'private','active');
+  insert into agent_board.board_memberships(id,board_id,agent_id,membership_state,created_by_agent_id,left_at,metadata) values (bm,board,a,'left',a,now()-interval '1 hour',jsonb_build_object('note','keep'));
+  insert into agent_board.delivery_recipients(id,delivery_mode,recipient_agent_id,source_kind,source_message_id,metadata) values (dr,'direct',a,'message',msg,jsonb_build_object('note','keep'));
+  insert into agent_board.inbox_items(id,delivery_recipient_id,recipient_agent_id,delivery_mode,source_kind,source_message_id,subject,metadata) values (ib,dr,a,'direct','message',msg,'private inbox',jsonb_build_object('note','keep'));
+  insert into agent_board.callback_endpoints(id,owner_agent_id,endpoint_url) values (ep,a,'https://example.test/'||suffix);
+  insert into agent_board.callback_subscriptions(id,endpoint_id,agent_id,subscription_scope,event_category) values (sub,ep,a,'own_inbox','inbox.item.delivered');
+  insert into agent_board.callback_outbox_events(id,endpoint_id,subscription_id,recipient_agent_id,inbox_item_id,event_category,delivery_mode,source_kind,source_message_id,idempotency_key,metadata) values (ob,ep,sub,a,ib,'inbox.item.delivered','direct','message',msg,'xb-ret-'||suffix,jsonb_build_object('note','keep'));
+  insert into agent_board.callback_delivery_attempts(id,outbox_event_id,endpoint_id,attempt_number,attempt_outcome,metadata) values (att,ob,ep,1,'delivered',jsonb_build_object('note','keep'));
+  insert into xb_retention_ids values ('messages',msg),('task_events',ev),('presence',a),('board_memberships',bm),('delivery_recipients',dr),('inbox_items',ib),('callback_outbox_events',ob),('callback_delivery_attempts',att),('thread',th),('other_thread',other_th),('other_message',other_msg),('board',board),('actor',a);
+end $setup$;
+$q$, 'XB retention fixtures are created');
+-- Capture every row-level write across the application schema while each
+-- retention branch runs. The fixture is already seeded; these are test-only
+-- triggers inside this rolled-back transaction, never product triggers.
+create temp table xb_retention_changes(table_name text, operation text, old_row jsonb, new_row jsonb) on commit drop;
+create function pg_temp.xb_retention_capture() returns trigger language plpgsql as $body$
+begin
+  insert into xb_retention_changes values (tg_table_schema || '.' || tg_table_name,tg_op,
+    case when tg_op='INSERT' then null else to_jsonb(old) end,
+    case when tg_op='DELETE' then null else to_jsonb(new) end);
+  if tg_op='DELETE' then return old; end if;
+  return new;
+end $body$;
+do $body$
+declare r record;
+begin
+  for r in select n.nspname,c.relname from pg_class c join pg_namespace n on n.oid=c.relnamespace
+    where n.nspname='agent_board' and c.relkind in ('r','p') and not c.relispartition order by c.oid
+  loop
+    execute format('create trigger xb_retention_capture after insert or update or delete on %I.%I for each row execute function pg_temp.xb_retention_capture()',r.nspname,r.relname);
+  end loop;
+end $body$;
+insert into xb_retention_before select 'messages',to_jsonb(x),(select count(*) from agent_board.messages) from agent_board.messages x where x.id=(select id from xb_retention_ids where kind='messages');
+truncate xb_retention_changes;
+select lives_ok($$select agent_board.mark_retention_metadata('messages',now()+interval '1 day',gen_random_uuid(),'xb-retention')$$,'XB retention messages executes');
+select ok((select x.metadata ? 'ops_retained_at' from agent_board.messages x where x.id=(select id from xb_retention_ids where kind='messages')),'XB retention messages actually updates its row');
+select is((select to_jsonb(x)-'metadata' from agent_board.messages x where x.id=(select id from xb_retention_ids where kind='messages')),
+  (select row_data-'metadata' from xb_retention_before where kind='messages'),'XB retention messages preserves every other column and anchor');
+select is((select x.metadata-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason' from agent_board.messages x where x.id=(select id from xb_retention_ids where kind='messages')),
+  (select row_data->'metadata' from xb_retention_before where kind='messages'),'XB retention messages preserves existing content');
+select is((select count(*) from agent_board.messages),(select row_count from xb_retention_before where kind='messages'),'XB retention messages inserts or deletes no row');
+select is((select string_agg(distinct table_name || ':' || operation, ', ' order by table_name || ':' || operation) from xb_retention_changes),
+  'agent_board.messages:UPDATE', 'XB retention messages writes only its target with UPDATE');
+select is((select count(*) from xb_retention_changes where table_name='agent_board.messages' and operation='UPDATE'
+  and ((old_row-'metadata') is distinct from (new_row-'metadata')
+    or (old_row->'metadata') is distinct from ((new_row->'metadata')-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason'))),
+  0::bigint, 'XB retention messages changes only allowed columns on every updated row');
+insert into xb_retention_before select 'task_events',to_jsonb(x),(select count(*) from agent_board.task_events) from agent_board.task_events x where x.id=(select id from xb_retention_ids where kind='task_events');
+truncate xb_retention_changes;
+select lives_ok($$select agent_board.mark_retention_metadata('task_events',now()+interval '1 day',gen_random_uuid(),'xb-retention')$$,'XB retention task_events executes');
+select ok((select x.payload ? 'ops_retained_at' from agent_board.task_events x where x.id=(select id from xb_retention_ids where kind='task_events')),'XB retention task_events actually updates its row');
+select is((select to_jsonb(x)-'payload' from agent_board.task_events x where x.id=(select id from xb_retention_ids where kind='task_events')),
+  (select row_data-'payload' from xb_retention_before where kind='task_events'),'XB retention task_events preserves every other column and anchor');
+select is((select x.payload-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason' from agent_board.task_events x where x.id=(select id from xb_retention_ids where kind='task_events')),
+  (select row_data->'payload' from xb_retention_before where kind='task_events'),'XB retention task_events preserves existing content');
+select is((select count(*) from agent_board.task_events),(select row_count from xb_retention_before where kind='task_events'),'XB retention task_events inserts or deletes no row');
+select is((select string_agg(distinct table_name || ':' || operation, ', ' order by table_name || ':' || operation) from xb_retention_changes),
+  'agent_board.task_events:UPDATE', 'XB retention task_events writes only its target with UPDATE');
+select is((select count(*) from xb_retention_changes where table_name='agent_board.task_events' and operation='UPDATE'
+  and ((old_row-'payload') is distinct from (new_row-'payload')
+    or (old_row->'payload') is distinct from ((new_row->'payload')-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason'))),
+  0::bigint, 'XB retention task_events changes only allowed columns on every updated row');
+insert into xb_retention_before select 'presence',to_jsonb(x),(select count(*) from agent_board.presence) from agent_board.presence x where x.agent_id=(select id from xb_retention_ids where kind='presence');
+truncate xb_retention_changes;
+select lives_ok($$select agent_board.mark_retention_metadata('presence',now()+interval '1 day',gen_random_uuid(),'xb-retention')$$,'XB retention presence executes');
+select ok((select x.metadata ? 'ops_retained_at' from agent_board.presence x where x.agent_id=(select id from xb_retention_ids where kind='presence')),'XB retention presence actually updates its row');
+select is((select to_jsonb(x)-'metadata'-'updated_at' from agent_board.presence x where x.agent_id=(select id from xb_retention_ids where kind='presence')),
+  (select row_data-'metadata'-'updated_at' from xb_retention_before where kind='presence'),'XB retention presence preserves every other column and anchor');
+select is((select x.metadata-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason' from agent_board.presence x where x.agent_id=(select id from xb_retention_ids where kind='presence')),
+  (select row_data->'metadata' from xb_retention_before where kind='presence'),'XB retention presence preserves existing content');
+select is((select count(*) from agent_board.presence),(select row_count from xb_retention_before where kind='presence'),'XB retention presence inserts or deletes no row');
+select is((select string_agg(distinct table_name || ':' || operation, ', ' order by table_name || ':' || operation) from xb_retention_changes),
+  'agent_board.presence:UPDATE', 'XB retention presence writes only its target with UPDATE');
+select is((select count(*) from xb_retention_changes where table_name='agent_board.presence' and operation='UPDATE'
+  and ((old_row-'metadata'-'updated_at') is distinct from (new_row-'metadata'-'updated_at')
+    or (old_row->'metadata') is distinct from ((new_row->'metadata')-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason'))),
+  0::bigint, 'XB retention presence changes only allowed columns on every updated row');
+insert into xb_retention_before select 'callback_outbox_events',to_jsonb(x),(select count(*) from agent_board.callback_outbox_events) from agent_board.callback_outbox_events x where x.id=(select id from xb_retention_ids where kind='callback_outbox_events');
+truncate xb_retention_changes;
+select lives_ok($$select agent_board.mark_retention_metadata('callback_outbox_events',now()+interval '1 day',gen_random_uuid(),'xb-retention')$$,'XB retention callback_outbox_events executes');
+select ok((select x.metadata ? 'ops_retained_at' from agent_board.callback_outbox_events x where x.id=(select id from xb_retention_ids where kind='callback_outbox_events')),'XB retention callback_outbox_events actually updates its row');
+select is((select to_jsonb(x)-'metadata' from agent_board.callback_outbox_events x where x.id=(select id from xb_retention_ids where kind='callback_outbox_events')),
+  (select row_data-'metadata' from xb_retention_before where kind='callback_outbox_events'),'XB retention callback_outbox_events preserves every other column and anchor');
+select is((select x.metadata-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason' from agent_board.callback_outbox_events x where x.id=(select id from xb_retention_ids where kind='callback_outbox_events')),
+  (select row_data->'metadata' from xb_retention_before where kind='callback_outbox_events'),'XB retention callback_outbox_events preserves existing content');
+select is((select count(*) from agent_board.callback_outbox_events),(select row_count from xb_retention_before where kind='callback_outbox_events'),'XB retention callback_outbox_events inserts or deletes no row');
+select is((select string_agg(distinct table_name || ':' || operation, ', ' order by table_name || ':' || operation) from xb_retention_changes),
+  'agent_board.callback_outbox_events:UPDATE', 'XB retention callback_outbox_events writes only its target with UPDATE');
+select is((select count(*) from xb_retention_changes where table_name='agent_board.callback_outbox_events' and operation='UPDATE'
+  and ((old_row-'metadata') is distinct from (new_row-'metadata')
+    or (old_row->'metadata') is distinct from ((new_row->'metadata')-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason'))),
+  0::bigint, 'XB retention callback_outbox_events changes only allowed columns on every updated row');
+insert into xb_retention_before select 'callback_delivery_attempts',to_jsonb(x),(select count(*) from agent_board.callback_delivery_attempts) from agent_board.callback_delivery_attempts x where x.id=(select id from xb_retention_ids where kind='callback_delivery_attempts');
+truncate xb_retention_changes;
+select lives_ok($$select agent_board.mark_retention_metadata('callback_delivery_attempts',now()+interval '1 day',gen_random_uuid(),'xb-retention')$$,'XB retention callback_delivery_attempts executes');
+select ok((select x.metadata ? 'ops_retained_at' from agent_board.callback_delivery_attempts x where x.id=(select id from xb_retention_ids where kind='callback_delivery_attempts')),'XB retention callback_delivery_attempts actually updates its row');
+select is((select to_jsonb(x)-'metadata' from agent_board.callback_delivery_attempts x where x.id=(select id from xb_retention_ids where kind='callback_delivery_attempts')),
+  (select row_data-'metadata' from xb_retention_before where kind='callback_delivery_attempts'),'XB retention callback_delivery_attempts preserves every other column and anchor');
+select is((select x.metadata-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason' from agent_board.callback_delivery_attempts x where x.id=(select id from xb_retention_ids where kind='callback_delivery_attempts')),
+  (select row_data->'metadata' from xb_retention_before where kind='callback_delivery_attempts'),'XB retention callback_delivery_attempts preserves existing content');
+select is((select count(*) from agent_board.callback_delivery_attempts),(select row_count from xb_retention_before where kind='callback_delivery_attempts'),'XB retention callback_delivery_attempts inserts or deletes no row');
+select is((select string_agg(distinct table_name || ':' || operation, ', ' order by table_name || ':' || operation) from xb_retention_changes),
+  'agent_board.callback_delivery_attempts:UPDATE', 'XB retention callback_delivery_attempts writes only its target with UPDATE');
+select is((select count(*) from xb_retention_changes where table_name='agent_board.callback_delivery_attempts' and operation='UPDATE'
+  and ((old_row-'metadata') is distinct from (new_row-'metadata')
+    or (old_row->'metadata') is distinct from ((new_row->'metadata')-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason'))),
+  0::bigint, 'XB retention callback_delivery_attempts changes only allowed columns on every updated row');
+insert into xb_retention_before select 'inbox_items',to_jsonb(x),(select count(*) from agent_board.inbox_items) from agent_board.inbox_items x where x.id=(select id from xb_retention_ids where kind='inbox_items');
+truncate xb_retention_changes;
+select lives_ok($$select agent_board.mark_retention_metadata('inbox_items',now()+interval '1 day',gen_random_uuid(),'xb-retention')$$,'XB retention inbox_items executes');
+select ok((select x.metadata ? 'ops_retained_at' from agent_board.inbox_items x where x.id=(select id from xb_retention_ids where kind='inbox_items')),'XB retention inbox_items actually updates its row');
+select is((select to_jsonb(x)-'metadata' from agent_board.inbox_items x where x.id=(select id from xb_retention_ids where kind='inbox_items')),
+  (select row_data-'metadata' from xb_retention_before where kind='inbox_items'),'XB retention inbox_items preserves every other column and anchor');
+select is((select x.metadata-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason' from agent_board.inbox_items x where x.id=(select id from xb_retention_ids where kind='inbox_items')),
+  (select row_data->'metadata' from xb_retention_before where kind='inbox_items'),'XB retention inbox_items preserves existing content');
+select is((select count(*) from agent_board.inbox_items),(select row_count from xb_retention_before where kind='inbox_items'),'XB retention inbox_items inserts or deletes no row');
+select is((select string_agg(distinct table_name || ':' || operation, ', ' order by table_name || ':' || operation) from xb_retention_changes),
+  'agent_board.inbox_items:UPDATE', 'XB retention inbox_items writes only its target with UPDATE');
+select is((select count(*) from xb_retention_changes where table_name='agent_board.inbox_items' and operation='UPDATE'
+  and ((old_row-'metadata') is distinct from (new_row-'metadata')
+    or (old_row->'metadata') is distinct from ((new_row->'metadata')-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason'))),
+  0::bigint, 'XB retention inbox_items changes only allowed columns on every updated row');
+insert into xb_retention_before select 'delivery_recipients',to_jsonb(x),(select count(*) from agent_board.delivery_recipients) from agent_board.delivery_recipients x where x.id=(select id from xb_retention_ids where kind='delivery_recipients');
+truncate xb_retention_changes;
+select lives_ok($$select agent_board.mark_retention_metadata('delivery_recipients',now()+interval '1 day',gen_random_uuid(),'xb-retention')$$,'XB retention delivery_recipients executes');
+select ok((select x.metadata ? 'ops_retained_at' from agent_board.delivery_recipients x where x.id=(select id from xb_retention_ids where kind='delivery_recipients')),'XB retention delivery_recipients actually updates its row');
+select is((select to_jsonb(x)-'metadata' from agent_board.delivery_recipients x where x.id=(select id from xb_retention_ids where kind='delivery_recipients')),
+  (select row_data-'metadata' from xb_retention_before where kind='delivery_recipients'),'XB retention delivery_recipients preserves every other column and anchor');
+select is((select x.metadata-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason' from agent_board.delivery_recipients x where x.id=(select id from xb_retention_ids where kind='delivery_recipients')),
+  (select row_data->'metadata' from xb_retention_before where kind='delivery_recipients'),'XB retention delivery_recipients preserves existing content');
+select is((select count(*) from agent_board.delivery_recipients),(select row_count from xb_retention_before where kind='delivery_recipients'),'XB retention delivery_recipients inserts or deletes no row');
+select is((select string_agg(distinct table_name || ':' || operation, ', ' order by table_name || ':' || operation) from xb_retention_changes),
+  'agent_board.delivery_recipients:UPDATE', 'XB retention delivery_recipients writes only its target with UPDATE');
+select is((select count(*) from xb_retention_changes where table_name='agent_board.delivery_recipients' and operation='UPDATE'
+  and ((old_row-'metadata') is distinct from (new_row-'metadata')
+    or (old_row->'metadata') is distinct from ((new_row->'metadata')-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason'))),
+  0::bigint, 'XB retention delivery_recipients changes only allowed columns on every updated row');
+insert into xb_retention_before select 'board_memberships',to_jsonb(x),(select count(*) from agent_board.board_memberships) from agent_board.board_memberships x where x.id=(select id from xb_retention_ids where kind='board_memberships');
+truncate xb_retention_changes;
+select lives_ok($$select agent_board.mark_retention_metadata('board_memberships',now()+interval '1 day',gen_random_uuid(),'xb-retention')$$,'XB retention board_memberships executes');
+select ok((select x.metadata ? 'ops_retained_at' from agent_board.board_memberships x where x.id=(select id from xb_retention_ids where kind='board_memberships')),'XB retention board_memberships actually updates its row');
+select is((select to_jsonb(x)-'metadata'-'updated_at' from agent_board.board_memberships x where x.id=(select id from xb_retention_ids where kind='board_memberships')),
+  (select row_data-'metadata'-'updated_at' from xb_retention_before where kind='board_memberships'),'XB retention board_memberships preserves every other column and anchor');
+select is((select x.metadata-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason' from agent_board.board_memberships x where x.id=(select id from xb_retention_ids where kind='board_memberships')),
+  (select row_data->'metadata' from xb_retention_before where kind='board_memberships'),'XB retention board_memberships preserves existing content');
+select is((select count(*) from agent_board.board_memberships),(select row_count from xb_retention_before where kind='board_memberships'),'XB retention board_memberships inserts or deletes no row');
+select is((select string_agg(distinct table_name || ':' || operation, ', ' order by table_name || ':' || operation) from xb_retention_changes),
+  'agent_board.board_memberships:UPDATE', 'XB retention board_memberships writes only its target with UPDATE');
+select is((select count(*) from xb_retention_changes where table_name='agent_board.board_memberships' and operation='UPDATE'
+  and ((old_row-'metadata'-'updated_at') is distinct from (new_row-'metadata'-'updated_at')
+    or (old_row->'metadata') is distinct from ((new_row->'metadata')-'ops_retained_at'-'ops_retention_run_id'-'ops_retention_reason'))),
+  0::bigint, 'XB retention board_memberships changes only allowed columns on every updated row');
+-- Enumerate candidate table names from the catalog, and actually invoke the
+-- validator with a cutoff that cannot select a row. This is a finite catalog
+-- check; the injected table additionally proves a new valid target is refused.
+create table agent_board.xb_retention_candidate(id uuid primary key default gen_random_uuid(), metadata jsonb not null default '{}'::jsonb, created_at timestamptz not null default now());
+insert into agent_board.xb_retention_candidate(metadata) values (jsonb_build_object('note','unrelated'));
+create function pg_temp.xb_retention_probe(p_target text) returns text language plpgsql as $body$
+begin
+  perform agent_board.mark_retention_metadata(p_target,'-infinity'::timestamptz,gen_random_uuid(),'probe');
+  return 'accepted';
+exception when sqlstate '22023' then return 'rejected';
+  when others then return 'ERROR:' || sqlstate;
+end $body$;
+select is((with tested as materialized (
+    select c.relname::text as name, pg_temp.xb_retention_probe(c.relname::text) as outcome
+    from pg_class c join pg_namespace n on n.oid=c.relnamespace
+    where n.nspname='agent_board' and c.relkind in ('r','p'))
+  select string_agg(name || '=' || outcome, ', ' order by name) from tested where outcome<>'rejected'),
+  'board_memberships=accepted, callback_delivery_attempts=accepted, callback_outbox_events=accepted, delivery_recipients=accepted, inbox_items=accepted, messages=accepted, presence=accepted, task_events=accepted',
+  'XB retention validator accepts exactly the eight catalog tables');
+select throws_ok($$select agent_board.mark_retention_metadata('xb_retention_candidate',now()+interval '1 day',gen_random_uuid(),'xb')$$,
+  '22023','unsupported retention table xb_retention_candidate','XB retention rejects an injected unrelated table');
+select is((select metadata from agent_board.xb_retention_candidate),jsonb_build_object('note','unrelated'),
+  'XB rejected unrelated table remains unchanged');
+select throws_ok($$select agent_board.mark_retention_metadata('tasks',now()+interval '1 day',gen_random_uuid(),'xb')$$,'22023','unsupported retention table tasks','XB retention rejects a non-admitted target');
+select throws_ok($$select * from agent_board.post_board_message((select id from xb_retention_ids where kind='thread'),(select id from xb_retention_ids where kind='actor'),(select id from xb_retention_ids where kind='board'),'s','b')$$,'42501','thread has private history','XB retained private history still refuses association');
+select * from finish();
+rollback;

package/tests/agent_board_667_routing.test.sql

@@ -0,0 +1,294 @@
+-- #667: descriptor and signed caller routes retain their resolved targets and
+-- private delivery scope. All RPCs are caught before state is asserted.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+select plan(39);
+create temp table xb_route(actor uuid,r1 uuid,r2 uuid,board1 uuid,board2 uuid,slug1 text,slug2 text) on commit drop;
+create temp table xb_route_thread(kind text primary key,id uuid not null) on commit drop;
+select lives_ok($q$
+do $setup$
+declare a uuid:=gen_random_uuid(); r1 uuid:=gen_random_uuid(); r2 uuid:=gen_random_uuid(); b1 uuid:=gen_random_uuid(); b2 uuid:=gen_random_uuid();
+  suffix text:=replace(gen_random_uuid()::text,'-',''); endpoint uuid:=gen_random_uuid(); membership uuid; t record;
+begin
+  perform set_config('request.jwt.claim.role','service_role',true);
+  insert into agent_board.agents(id,agent_type,handle,display_name,status) values
+    (a,'agent','xb-route-a-'||suffix,'XB route actor','active'),
+    (r1,'agent','xb-route-r1-'||suffix,'XB recipient one','active'),
+    (r2,'agent','xb-route-r2-'||suffix,'XB recipient two','active');
+  insert into agent_board.boards(id,slug,name,created_by_agent_id,visibility,status) values
+    (b1,'xb-route-one-'||suffix,'XB route one',a,'private','active'),
+    (b2,'xb-route-two-'||suffix,'XB route two',a,'private','active');
+  insert into agent_board.board_memberships(board_id,agent_id,membership_state,created_by_agent_id,role)
+    values(b1,a,'joined',a,'member'),(b1,r1,'joined',a,'member'),(b2,a,'joined',a,'member'),(b2,r2,'joined',a,'member');
+  select id into membership from agent_board.board_memberships where board_id=b1 and agent_id=r1;
+  insert into agent_board.callback_endpoints(id,owner_agent_id,endpoint_url,endpoint_status)
+    values(endpoint,r1,'https://example.test/xb-'||suffix,'verified');
+  insert into agent_board.callback_subscriptions(endpoint_id,agent_id,subscription_scope,event_category,board_id,board_membership_id)
+    values(endpoint,r1,'own_inbox','inbox.item.delivered',null,null),
+          (endpoint,r1,'board','board.post.delivered',b1,membership);
+  insert into xb_route values(a,r1,r2,b1,b2,'xb-route-one-'||suffix,'xb-route-two-'||suffix);
+  insert into xb_route_thread select kind,gen_random_uuid() from unnest(array['post','task','direct','multi','signed_direct','signed_multi','alternate','fail_desc_post','fail_desc_task','fail_signed_post','fail_signed_task','signed_task_positive','signed_multi_desc','signed_task_desc']) kind;
+  insert into agent_board.threads(id,thread_type,created_by_agent_id,subject)
+    select id,'coordination',a,kind from xb_route_thread;
+  insert into agent_board.messages(thread_id,author_agent_id,message_sequence,body)
+    values((select id from xb_route_thread where kind='alternate'),a,1,'XB alternate source');
+  insert into agent_board.tasks(thread_id,created_by_agent_id,title)
+    values((select id from xb_route_thread where kind='alternate'),a,'XB alternate task');
+  insert into agent_board.task_events(task_id,thread_id,actor_agent_id,event_sequence,event_type,payload,origin_posture)
+    select id,thread_id,a,1,'created','{}'::jsonb,'unattested:signed-metadata-rpc'
+    from agent_board.tasks where thread_id=(select id from xb_route_thread where kind='alternate');
+  for t in select id from xb_route_thread where kind in ('direct','multi','signed_direct','signed_multi','signed_multi_desc') loop
+    perform agent_board._associate_empty_thread(t.id,b1);
+  end loop;
+end $setup$;
+$q$, 'XB routing fixtures and already-associated private routes are created');
+select lives_ok($$select * from agent_board.post_board_message((select id from xb_route_thread where kind='post'),(select actor from xb_route),
+  (select slug1 from xb_route),'addressing_v1','descriptor post','descriptor post body','comment','medium',null,'{}'::jsonb)$$,
+  'XB board slug post succeeds');
+select ok(exists(select 1 from agent_board.messages m join agent_board.threads t on t.id=m.thread_id
+  where t.id=(select id from xb_route_thread where kind='post') and t.board_id=(select board1 from xb_route) and m.body='descriptor post body'),
+  'XB board slug post uses its resolved board and thread');
+select lives_ok($$select * from agent_board.create_tasking_delivery((select id from xb_route_thread where kind='task'),(select actor from xb_route),
+  'descriptor task',null,jsonb_build_array(jsonb_build_object('kind','agent_id','agentId',(select r1::text from xb_route))),
+  (select slug1 from xb_route),'addressing_v1','medium','distributed',null,'{}'::jsonb)$$,
+  'XB descriptor board task succeeds');
+select ok(exists(select 1 from agent_board.tasks t join agent_board.threads th on th.id=t.thread_id
+  join agent_board.delivery_recipients d on d.source_task_id=t.id where th.id=(select id from xb_route_thread where kind='task')
+  and th.board_id=(select board1 from xb_route) and d.recipient_agent_id=(select r1 from xb_route) and d.board_id is null),
+  'XB descriptor task resolves board and preserves explicit private recipient');
+select lives_ok($$select * from agent_board.send_direct_message((select id from xb_route_thread where kind='direct'),(select actor from xb_route),
+  jsonb_build_object('kind','agent_id','agentId',(select r1::text from xb_route)),'addressing_v1','direct','descriptor direct body','comment','medium',null,'{}'::jsonb)$$,
+  'XB descriptor direct message succeeds');
+select ok(exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  where m.thread_id=(select id from xb_route_thread where kind='direct') and m.body='descriptor direct body'
+    and d.recipient_agent_id=(select r1 from xb_route) and d.board_id is null)
+  and not exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  where m.thread_id=(select id from xb_route_thread where kind='direct') and d.recipient_agent_id=(select r2 from xb_route)),
+  'XB descriptor direct message reaches only the requested private recipient');
+select lives_ok($$select * from agent_board.send_multicast_message((select id from xb_route_thread where kind='multi'),(select actor from xb_route),
+  jsonb_build_array(jsonb_build_object('kind','agent_id','agentId',(select r1::text from xb_route))),
+  'addressing_v1','multi','descriptor multi body','comment','medium',null,'{}'::jsonb)$$,
+  'XB descriptor multicast succeeds');
+select ok(exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  where m.thread_id=(select id from xb_route_thread where kind='multi') and m.body='descriptor multi body'
+    and d.recipient_agent_id=(select r1 from xb_route) and d.board_id is null)
+  and not exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  where m.thread_id=(select id from xb_route_thread where kind='multi') and d.recipient_agent_id=(select r2 from xb_route)),
+  'XB descriptor multicast reaches only the requested private recipient');
+select lives_ok($$select * from agent_board.signed_send_direct_message(jsonb_build_object('p_thread_id',(select id from xb_route_thread where kind='signed_direct'),
+  'p_author_agent_id',(select actor from xb_route),'p_recipient_agent_id',(select r1 from xb_route),'p_subject','signed direct','p_body','signed direct body'),
+  jsonb_build_object('agent_id',(select actor from xb_route),'verification_status','warn','payload_digest','sha256:'||repeat('c',64),'enforcement_mode','warn'))$$,
+  'XB signed direct message succeeds');
+select ok(exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  join agent_board.signature_evidence e on e.source_message_id=m.id where m.thread_id=(select id from xb_route_thread where kind='signed_direct')
+    and m.body='signed direct body' and d.recipient_agent_id=(select r1 from xb_route) and d.board_id is null
+    and e.agent_id=(select actor from xb_route) and e.operation='send_direct_message' and e.verification_status='warn'),
+  'XB signed direct retains private recipient, actor and linked evidence');
+select lives_ok($$select * from agent_board.signed_send_multicast_message(jsonb_build_object('p_thread_id',(select id from xb_route_thread where kind='signed_multi'),
+  'p_author_agent_id',(select actor from xb_route),'p_recipient_agent_ids',jsonb_build_array((select r1 from xb_route)),'p_subject','signed multi','p_body','signed multi body'),
+  jsonb_build_object('agent_id',(select actor from xb_route),'verification_status','warn','payload_digest','sha256:'||repeat('d',64),'enforcement_mode','warn'))$$,
+  'XB signed multicast succeeds');
+select ok(exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  join agent_board.signature_evidence e on e.source_message_id=m.id where m.thread_id=(select id from xb_route_thread where kind='signed_multi')
+    and m.body='signed multi body' and d.recipient_agent_id=(select r1 from xb_route) and d.board_id is null
+    and e.agent_id=(select actor from xb_route) and e.operation='send_multicast_message' and e.verification_status='warn'),
+  'XB signed multicast retains private recipient, actor and linked evidence');
+-- Positively bind the common inbox/callback descendants to their actual
+-- message/task parents, rather than relying only on validated foreign keys.
+select ok(exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  join agent_board.inbox_items i on i.delivery_recipient_id=d.id and i.source_message_id=m.id
+  join agent_board.callback_outbox_events o on o.inbox_item_id=i.id and o.source_message_id=m.id
+  where m.thread_id=(select id from xb_route_thread where kind='direct') and d.recipient_agent_id=(select r1 from xb_route)),
+  'XB direct inbox and callback retain their actual message parent');
+select ok(exists(select 1 from agent_board.tasks t join agent_board.delivery_recipients d on d.source_task_id=t.id
+  join agent_board.inbox_items i on i.delivery_recipient_id=d.id and i.source_task_id=t.id
+  join agent_board.callback_outbox_events o on o.inbox_item_id=i.id and o.source_task_id=t.id
+  where t.thread_id=(select id from xb_route_thread where kind='task') and d.recipient_agent_id=(select r1 from xb_route)),
+  'XB task inbox and callback retain their actual task parent');
+select ok(exists(select 1 from agent_board.messages m join agent_board.callback_outbox_events o on o.source_message_id=m.id
+  where m.thread_id=(select id from xb_route_thread where kind='post') and o.board_id=(select board1 from xb_route)
+    and o.event_category='board.post.delivered' and o.recipient_agent_id=(select r1 from xb_route)),
+  'XB board callback retains its actual message and board parent');
+-- Fail only after observing the relevant stamp, source and delivery. This
+-- makes a rollback witness distinguish a late failure from a setup refusal.
+create function pg_temp.xb_fail_descriptor_inbox() returns trigger language plpgsql as $body$
+begin
+  if new.subject='XB fail descriptor post' then
+    if not exists(select 1 from agent_board.messages m join agent_board.threads th on th.id=m.thread_id
+      join agent_board.delivery_recipients d on d.source_message_id=m.id
+      where m.id=new.source_message_id and th.board_id=(select board1 from xb_route) and d.id=new.delivery_recipient_id) then
+      raise exception 'XB descriptor post did not reach stamped delivery' using errcode='P0001';
+    end if;
+    raise exception 'XB descriptor post late failure' using errcode='P0001';
+  elsif new.subject='XB fail descriptor task' then
+    if not exists(select 1 from agent_board.tasks t join agent_board.threads th on th.id=t.thread_id
+      join agent_board.delivery_recipients d on d.source_task_id=t.id
+      where t.id=new.source_task_id and th.board_id=(select board1 from xb_route) and d.id=new.delivery_recipient_id) then
+      raise exception 'XB descriptor task did not reach stamped delivery' using errcode='P0001';
+    end if;
+    raise exception 'XB descriptor task late failure' using errcode='P0001';
+  end if;
+  return new;
+end $body$;
+create trigger xb_fail_descriptor_inbox before insert on agent_board.inbox_items for each row execute function pg_temp.xb_fail_descriptor_inbox();
+create function pg_temp.xb_fail_signed_evidence() returns trigger language plpgsql as $body$
+begin
+  if new.operation='post_board_message' and exists(select 1 from agent_board.messages where id=new.source_message_id and body='XB fail signed post') then
+    if not exists(select 1 from agent_board.messages m join agent_board.threads th on th.id=m.thread_id
+      join agent_board.delivery_recipients d on d.source_message_id=m.id join agent_board.inbox_items i on i.delivery_recipient_id=d.id
+      where m.id=new.source_message_id and th.board_id=(select board1 from xb_route)) then
+      raise exception 'XB signed post did not reach stamped inbox' using errcode='P0001';
+    end if;
+    raise exception 'XB signed post late failure' using errcode='P0001';
+  elsif new.operation='create_tasking_delivery' and exists(select 1 from agent_board.task_events ev join agent_board.tasks t on t.id=ev.task_id
+      where ev.id=new.source_task_event_id and t.title='XB fail signed task') then
+    if not exists(select 1 from agent_board.task_events ev join agent_board.tasks t on t.id=ev.task_id
+      join agent_board.threads th on th.id=t.thread_id join agent_board.delivery_recipients d on d.source_task_id=t.id
+      join agent_board.inbox_items i on i.delivery_recipient_id=d.id where ev.id=new.source_task_event_id
+        and th.board_id=(select board1 from xb_route)) then
+      raise exception 'XB signed task did not reach stamped inbox' using errcode='P0001';
+    end if;
+    raise exception 'XB signed task late failure' using errcode='P0001';
+  end if;
+  return new;
+end $body$;
+create trigger xb_fail_signed_evidence before insert on agent_board.signature_evidence for each row execute function pg_temp.xb_fail_signed_evidence();
+create temp table xb_route_before on commit drop as select
+  (select count(*) from agent_board.delivery_recipients where board_id=(select board1 from xb_route)) as deliveries,
+  (select count(*) from agent_board.inbox_items where board_id=(select board1 from xb_route)) as inbox,
+  (select count(*) from agent_board.signature_evidence where agent_id=(select actor from xb_route)) as evidence;
+select throws_ok($$select * from agent_board.post_board_message((select id from xb_route_thread where kind='fail_desc_post'),(select actor from xb_route),
+  (select slug1 from xb_route),'addressing_v1','XB fail descriptor post','body','comment','medium',null,'{}'::jsonb)$$,
+  'P0001','XB descriptor post late failure','XB descriptor post reaches its late failure');
+select ok((select board_id is null from agent_board.threads where id=(select id from xb_route_thread where kind='fail_desc_post'))
+  and not exists(select 1 from agent_board.messages where thread_id=(select id from xb_route_thread where kind='fail_desc_post'))
+  and (select deliveries=(select count(*) from agent_board.delivery_recipients where board_id=(select board1 from xb_route))
+    and inbox=(select count(*) from agent_board.inbox_items where board_id=(select board1 from xb_route))
+    and evidence=(select count(*) from agent_board.signature_evidence where agent_id=(select actor from xb_route)) from xb_route_before),
+  'XB descriptor post late failure rolls back stamp, message, delivery, inbox and evidence');
+select throws_ok($$select * from agent_board.create_tasking_delivery((select id from xb_route_thread where kind='fail_desc_task'),(select actor from xb_route),
+  'XB fail descriptor task',null,null::jsonb,(select slug1 from xb_route),'addressing_v1','medium','distributed',null,'{}'::jsonb)$$,
+  'P0001','XB descriptor task late failure','XB descriptor task reaches its late failure');
+select ok((select board_id is null from agent_board.threads where id=(select id from xb_route_thread where kind='fail_desc_task'))
+  and not exists(select 1 from agent_board.tasks where thread_id=(select id from xb_route_thread where kind='fail_desc_task'))
+  and not exists(select 1 from agent_board.task_events where thread_id=(select id from xb_route_thread where kind='fail_desc_task'))
+  and (select deliveries=(select count(*) from agent_board.delivery_recipients where board_id=(select board1 from xb_route))
+    and inbox=(select count(*) from agent_board.inbox_items where board_id=(select board1 from xb_route))
+    and evidence=(select count(*) from agent_board.signature_evidence where agent_id=(select actor from xb_route)) from xb_route_before),
+  'XB descriptor task late failure rolls back stamp, task, event, delivery, inbox and evidence');
+select throws_ok($$select * from agent_board.signed_post_board_message(jsonb_build_object('p_thread_id',(select id from xb_route_thread where kind='fail_signed_post'),
+  'p_author_agent_id',(select actor from xb_route),'p_board_id',(select board1 from xb_route),'p_subject','signed failure','p_body','XB fail signed post'),
+  jsonb_build_object('agent_id',(select actor from xb_route),'verification_status','warn','payload_digest','sha256:'||repeat('e',64),'enforcement_mode','warn'))$$,
+  'P0001','XB signed post late failure','XB signed post reaches its evidence failure');
+select ok((select board_id is null from agent_board.threads where id=(select id from xb_route_thread where kind='fail_signed_post'))
+  and not exists(select 1 from agent_board.messages where thread_id=(select id from xb_route_thread where kind='fail_signed_post'))
+  and (select deliveries=(select count(*) from agent_board.delivery_recipients where board_id=(select board1 from xb_route))
+    and inbox=(select count(*) from agent_board.inbox_items where board_id=(select board1 from xb_route))
+    and evidence=(select count(*) from agent_board.signature_evidence where agent_id=(select actor from xb_route)) from xb_route_before),
+  'XB signed post evidence failure rolls back stamp, message, delivery, inbox and evidence');
+select throws_ok($$select * from agent_board.signed_create_tasking_delivery(jsonb_build_object('p_thread_id',(select id from xb_route_thread where kind='fail_signed_task'),
+  'p_created_by_agent_id',(select actor from xb_route),'p_board_id',(select board1 from xb_route),'p_title','XB fail signed task'),
+  jsonb_build_object('agent_id',(select actor from xb_route),'verification_status','warn','payload_digest','sha256:'||repeat('f',64),'enforcement_mode','warn'))$$,
+  'P0001','XB signed task late failure','XB signed task reaches its evidence failure');
+select ok((select board_id is null from agent_board.threads where id=(select id from xb_route_thread where kind='fail_signed_task'))
+  and not exists(select 1 from agent_board.tasks where thread_id=(select id from xb_route_thread where kind='fail_signed_task'))
+  and not exists(select 1 from agent_board.task_events where thread_id=(select id from xb_route_thread where kind='fail_signed_task'))
+  and (select deliveries=(select count(*) from agent_board.delivery_recipients where board_id=(select board1 from xb_route))
+    and inbox=(select count(*) from agent_board.inbox_items where board_id=(select board1 from xb_route))
+    and evidence=(select count(*) from agent_board.signature_evidence where agent_id=(select actor from xb_route)) from xb_route_before),
+  'XB signed task evidence failure rolls back stamp, task, event, delivery, inbox and evidence');
+-- The fleet-policy preflight one-hop inserter uses external evidence, not a
+-- message/task/artifact parent. Exercise its real fleet branch and then prove
+-- that such evidence alone does not turn an empty thread into history.
+create temp table xb_external_evidence_fixture(actor uuid,thread_id uuid) on commit drop;
+select lives_ok($q$
+do $fleet$
+declare a uuid:=gen_random_uuid(); t uuid:=gen_random_uuid(); d uuid:=gen_random_uuid(); m uuid:=gen_random_uuid();
+  suffix text:=replace(gen_random_uuid()::text,'-','');
+begin
+  insert into agent_board.agents(id,agent_type,handle,display_name,status) values(a,'agent','xb-external-'||suffix,'XB external actor','active');
+  insert into agent_board.board_memberships(board_id,agent_id,membership_state,created_by_agent_id,role)
+    values((select board1 from xb_route),a,'joined',(select actor from xb_route),'member');
+  insert into agent_board.threads(id,thread_type,created_by_agent_id,subject) values(t,'coordination',a,'XB external evidence');
+  insert into agent_board.fleet_trust_domains(id,slug,display_name,domain_kind,owner_agent_id,lifecycle_state)
+    values(d,'xb-external-'||suffix,'XB external domain','tailnet',a,'active');
+  insert into agent_board.fleet_machines(id,trust_domain_id,owner_agent_id,machine_label,machine_fingerprint,lifecycle_state)
+    values(m,d,a,'XB external machine','sha256:'||suffix,'active');
+  insert into agent_board.fleet_machine_agents(machine_id,agent_id,lifecycle_state) values(m,a,'active');
+  insert into xb_external_evidence_fixture values(a,t);
+end $fleet$;
+$q$, 'XB external-evidence fleet fixture is created');
+select lives_ok($$select * from agent_board.evaluate_signed_write_fleet_policy('send_direct_message',
+  jsonb_build_object('p_recipient_agent_id',(select r1 from xb_route)),
+  jsonb_build_object('agent_id',(select actor from xb_external_evidence_fixture),'verification_status','warn',
+    'payload_digest','sha256:'||repeat('9',64),'enforcement_mode','warn'))$$,
+  'XB fleet policy writes external preflight evidence');
+select ok(exists(select 1 from agent_board.signature_evidence e where e.agent_id=(select actor from xb_external_evidence_fixture)
+  and e.operation='send_direct_message' and e.source_kind='external' and e.external_evidence_ref is not null
+  and e.source_message_id is null and e.source_task_event_id is null and e.source_artifact_id is null and e.source_delivery_recipient_id is null),
+  'XB fleet preflight evidence has no message, task-event, artifact or delivery parent');
+select lives_ok($$select * from agent_board.post_board_message((select thread_id from xb_external_evidence_fixture),
+  (select actor from xb_external_evidence_fixture),(select board1 from xb_route),'external evidence','body')$$,
+  'XB external preflight evidence permits empty-thread association');
+select is((select board_id from agent_board.threads where id=(select thread_id from xb_external_evidence_fixture)),
+  (select board1 from xb_route),'XB external-evidence control actually stamps the board');
+select lives_ok($$select * from agent_board.signed_create_tasking_delivery(jsonb_build_object(
+  'p_thread_id',(select id from xb_route_thread where kind='signed_task_positive'),
+  'p_created_by_agent_id',(select actor from xb_route),'p_board_id',(select board1 from xb_route),'p_title','XB routed signed task'),
+  jsonb_build_object('agent_id',(select actor from xb_route),'verification_status','warn',
+    'payload_digest','sha256:'||repeat('8',64),'enforcement_mode','warn'))$$,
+  'XB signed task with evidence succeeds');
+select ok(exists(select 1 from agent_board.tasks t join agent_board.task_events ev on ev.task_id=t.id
+  join agent_board.signature_evidence e on e.source_task_event_id=ev.id join agent_board.threads th on th.id=t.thread_id
+  where t.thread_id=(select id from xb_route_thread where kind='signed_task_positive') and t.title='XB routed signed task'
+    and th.board_id=(select board1 from xb_route) and e.agent_id=(select actor from xb_route)
+    and e.operation='create_tasking_delivery'),
+  'XB signed task evidence retains its actual task-event parent');
+-- The two delivery upserts have ON CONFLICT update branches.  Retry against
+-- an existing row while presenting a different valid source to the inbox
+-- updater; the persisted canonical parent must remain the original one.
+select lives_ok($$select agent_board._upsert_inbox_item(d.id,(select r1 from xb_route),null,'direct','message',
+  (select id from agent_board.messages where thread_id=(select id from xb_route_thread where kind='alternate')),null,null,
+  'XB inbox retry','retry','medium',true,false,'{}'::jsonb,'{}'::jsonb)
+  from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  where m.thread_id=(select id from xb_route_thread where kind='direct') and d.recipient_agent_id=(select r1 from xb_route)$$,
+  'XB existing inbox update succeeds with a different offered source');
+select ok(exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  join agent_board.inbox_items i on i.delivery_recipient_id=d.id and i.source_message_id=m.id
+  where m.thread_id=(select id from xb_route_thread where kind='direct') and d.recipient_agent_id=(select r1 from xb_route)
+    and i.subject='XB inbox retry'), 'XB existing inbox update retains the original message anchor');
+select lives_ok($$select agent_board._upsert_delivery_recipient('direct',(select r1 from xb_route),'message',m.id,null,null,null,null,
+  '{"retry":true}'::jsonb) from agent_board.messages m where m.thread_id=(select id from xb_route_thread where kind='direct')$$,
+  'XB existing delivery metadata update succeeds');
+select ok(exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  where m.thread_id=(select id from xb_route_thread where kind='direct') and d.recipient_agent_id=(select r1 from xb_route)
+    and d.board_id is null and d.metadata->>'retry'='true'),
+  'XB existing delivery metadata update retains original source and private scope');
+-- Signed wrappers also expose descriptor branches; they must retain the same
+-- resolved targets, private scope and source-linked evidence.
+select lives_ok($$select * from agent_board.signed_send_multicast_message(jsonb_build_object(
+  'p_thread_id',(select id from xb_route_thread where kind='signed_multi_desc'),'p_author_agent_id',(select actor from xb_route),
+  'p_recipient_descriptors',jsonb_build_array(jsonb_build_object('kind','agent_id','agentId',(select r1::text from xb_route))),
+  'p_addressing_mode','addressing_v1','p_subject','signed descriptor multi','p_body','signed descriptor multi body'),
+  jsonb_build_object('agent_id',(select actor from xb_route),'verification_status','warn','payload_digest','sha256:'||repeat('6',64),'enforcement_mode','warn'))$$,
+  'XB signed descriptor multicast succeeds');
+select ok(exists(select 1 from agent_board.messages m join agent_board.delivery_recipients d on d.source_message_id=m.id
+  join agent_board.signature_evidence e on e.source_message_id=m.id where m.thread_id=(select id from xb_route_thread where kind='signed_multi_desc')
+    and d.recipient_agent_id=(select r1 from xb_route) and d.board_id is null and e.agent_id=(select actor from xb_route)
+    and e.operation='send_multicast_message'), 'XB signed descriptor multicast retains recipient, privacy and evidence');
+select lives_ok($$select * from agent_board.signed_create_tasking_delivery(jsonb_build_object(
+  'p_thread_id',(select id from xb_route_thread where kind='signed_task_desc'),'p_created_by_agent_id',(select actor from xb_route),
+  'p_title','XB signed descriptor task','p_board_slug',(select slug1 from xb_route),
+  'p_recipient_descriptors',jsonb_build_array(jsonb_build_object('kind','agent_id','agentId',(select r1::text from xb_route))),
+  'p_addressing_mode','addressing_v1'),
+  jsonb_build_object('agent_id',(select actor from xb_route),'verification_status','warn','payload_digest','sha256:'||repeat('7',64),'enforcement_mode','warn'))$$,
+  'XB signed descriptor board task succeeds');
+select ok(exists(select 1 from agent_board.tasks t join agent_board.threads th on th.id=t.thread_id
+  join agent_board.delivery_recipients d on d.source_task_id=t.id join agent_board.task_events ev on ev.task_id=t.id
+  join agent_board.signature_evidence e on e.source_task_event_id=ev.id where t.thread_id=(select id from xb_route_thread where kind='signed_task_desc')
+    and th.board_id=(select board1 from xb_route) and d.recipient_agent_id=(select r1 from xb_route) and d.board_id is null
+    and e.agent_id=(select actor from xb_route) and e.operation='create_tasking_delivery'),
+  'XB signed descriptor task retains board, private recipient and evidence');
+select * from finish();
+rollback;