@consiliency/agent-board-schema 1.68.0 → 1.74.0

package/tests/agent_board_addressing.test.sql

@@ -11,7 +11,8 @@ create temp table _addressing_fixture (
   reviewer uuid,
   human uuid,
   board_id uuid,
-  thread_id uuid
+  thread_id uuid,
+  board_thread_id uuid
 ) on commit drop;
 grant all on table _addressing_fixture to authenticated, service_role;
 
@@ -23,6 +24,7 @@ declare
   v_reviewer uuid := gen_random_uuid();
   v_human uuid := gen_random_uuid();
   v_thread uuid := gen_random_uuid();
+  v_board_thread uuid := gen_random_uuid();
   v_board uuid;
 begin
   insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, metadata)
@@ -35,15 +37,16 @@ begin
     (v_human, 'human', 'human', 'addressing-human-' || v_suffix, 'ADDRESSING Human', 'active', '{}'::jsonb);
 
   insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
-  values (v_thread, 'coordination', v_actor, 'ADDRESSING thread');
+  values (v_thread, 'coordination', v_actor, 'ADDRESSING thread'),
+         (v_board_thread, 'coordination', v_actor, 'ADDRESSING empty board thread');
 
   select board_id into v_board
     from agent_board.create_board(v_actor, 'addressing-board-' || v_suffix, 'ADDRESSING Board', 'addressing test board', '{}'::jsonb, 'open');
   perform agent_board.join_board(v_board, v_actor, 'joined', v_actor, '{}'::jsonb);
   perform agent_board.join_board(v_board, v_worker, 'subscribed', v_actor, '{}'::jsonb);
 
-  insert into _addressing_fixture(actor, worker, reviewer, human, board_id, thread_id)
-  values (v_actor, v_worker, v_reviewer, v_human, v_board, v_thread);
+  insert into _addressing_fixture(actor, worker, reviewer, human, board_id, thread_id, board_thread_id)
+  values (v_actor, v_worker, v_reviewer, v_human, v_board, v_thread, v_board_thread);
 end
 $$;
 
@@ -128,7 +131,7 @@ select lives_ok(
   $$
     select *
       from agent_board.post_board_message(
-        (select thread_id from _addressing_fixture),
+        (select board_thread_id from _addressing_fixture),
         (select actor from _addressing_fixture),
         (select slug from agent_board.boards where id = (select board_id from _addressing_fixture)),
         'addressing_v1',

package/tests/agent_board_claim_subject_gate.test.sql

@@ -661,13 +661,17 @@ select lives_ok(
 select set_config('request.jwt.claim.role', 'service_role', true);
 select set_config('request.jwt.claim.sub', '', true);
 
+-- #661 adds a read in post_message to preserve restricted-thread privacy. Pin
+-- both reviewed read-only bodies, not just their names: allowing the wrapper's
+-- name alone would admit a future access_mode write inside that volatile RPC.
+-- The reply suite separately executes inherit/restricted preservation cases.
 select is(
-  (select coalesce(string_agg(p.proname, ',' order by p.proname), '(none)')
+  (select coalesce(string_agg(p.proname || ':' || md5(agent_board_test.stripped_body(p.oid, true)), ',' order by p.proname), '(none)')
      from pg_proc p
     where p.pronamespace = 'agent_board'::regnamespace
       and lower(agent_board_test.stripped_body(p.oid, true)) ~ 'access_mode'),
-  '_agent_can_access_thread',
-  'catalog: the ONLY agent_board function that so much as mentions threads.access_mode is the predicate that READS it');
+  '_agent_can_access_thread:84a666a661c89a8338225155add8660f,post_message:0fa30de305331417b7bed464b7b89df4',
+  'catalog: every access_mode site matches its reviewed read-only definition; new sites and changed bodies name themselves');
 
 select is(
   (select coalesce(string_agg(distinct coalesce(g.rolname, 'PUBLIC') || ':' || a.privilege_type,

package/tests/agent_board_claimpolicy_race.test.sql

@@ -83,7 +83,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(45);
+select plan(47);
 
 -- ---------------------------------------------------------------------------
 -- Fixture: one board, one thread on it, one thread with NO board (the constitutive-'inherit'
@@ -1570,8 +1570,9 @@ select is(
   'acquire_claim=lock-first, renew_claim=lock-first, set_board_claim_policy=lock-first',
   'CPR-3 ORDER: in each decider the board lock precedes the policy decision in source order — the population is a restatement of CPR-2''s catalog-derived set with a per-function decision marker, so a FOURTH decider fails CPR-2 before this list can go stale; the behavioural half is claimpolicy_acquire_revert_race.spec');
 
--- CPR-4. acquire_claim takes TWO advisory locks. Board first, always: it is the only function that
--- takes the actor-scoped quota lock, so one consistent order here is the whole cycle argument.
+-- CPR-4. acquire_claim takes the board and quota advisory locks in that order. The
+-- broader two-hashtext census also includes unrelated actor-scoped namespaces,
+-- including heartbeat; its namespace and closure are checked positively below.
 -- CPR-4 REMOVED (#405 completeness review). It read acquire_claim alone; CPR-4a derives the same
 -- ordering over every function taking the actor-scoped quota lock and so strictly contains it.
 -- Confirmed by mutation before removal: inverting acquire_claim's two locks trips CPR-4a (it tripped
@@ -1612,9 +1613,26 @@ select is(
                   when board_pos < quota_pos    then 'board-then-agent'
                   else 'AGENT-THEN-BOARD' end), ', ' order by proname), '<none>')
      from q),
-  'acquire_claim=board-then-agent, upsert_delegation_policy=no-board-lock',
+  'acquire_claim=board-then-agent, heartbeat=no-board-lock, upsert_delegation_policy=no-board-lock',
   'CPR-4a ORDER (schema-wide): every function taking the actor-scoped quota lock either never takes the board lock or takes the board lock FIRST — the universal half of CPR-4, derived from the catalog rather than asserted about one function');
 
+-- The two-argument advisory census includes heartbeat's independent actor namespace.
+-- Check the literal namespace and call closure rather than filtering it out by name.
+select ok(
+  (select position('agent_board.heartbeat_thread' in agent_board_test.stripped_body(p.oid, true))>0
+       and position('claimgate_ownerless_quota' in agent_board_test.stripped_body(p.oid, true))=0
+       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.write_re('presence')
+       and not (agent_board_test.stripped_body(p.oid) ~ agent_board_test.write_re('claims'))
+     from pg_proc p where p.oid='agent_board.heartbeat(uuid,uuid,text,text,interval,jsonb)'::regprocedure),
+  'CPR-4b heartbeat uses its own actor namespace and writes presence rather than claims');
+select is(
+  (select string_agg(c.reached_oid::regprocedure::text, ', ' order by c.reached_oid::regprocedure::text)
+     from agent_board_test.fn_call_closure() c
+    where c.root_oid='agent_board.heartbeat(uuid,uuid,text,text,interval,jsonb)'::regprocedure
+      and c.reached_oid in ('agent_board._claimgate_lock_board_policy(uuid)'::regprocedure,
+                            'agent_board.acquire_claim(uuid,text,text,timestamptz,uuid,uuid,jsonb)'::regprocedure)),
+  null::text, 'CPR-4c heartbeat closure does not reach board-policy lock or claim acquisition');
+
 -- CPR-5. THE EXEMPTION, ASSERTED POSITIVELY. `v_ownerless_claim_quota` resolves board policy at
 -- query time (#393's OQ-29) and is deliberately NOT serialised. The claim that makes that safe is
 -- "it cannot produce a lease", and this asserts exactly that rather than asserting it is absent
@@ -1725,7 +1743,7 @@ select is(
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.stmt_re('update', 'threads')),
-  '_next_thread_message_sequence, _upsert_delivery_recipient',
+  '_associate_empty_thread, _next_thread_message_sequence',
   'CPR-11 BOARD IMMUTABILITY: these are the functions that UPDATE agent_board.threads, qualified or not — a third has to be decided against this premise rather than inheriting it');
 
 -- CPR-12. THE POPULATION IS A STATEMENT TEST, NOT A SPELLING LIST. It matched `board_id =` after an
@@ -1750,7 +1768,9 @@ select is(
             (case when agent_board_test.stripped_body(p.oid, true)
                        ~ agent_board_test.re(agent_board_test.col_assign_frag('threads', 'board_id', agent_board_test.bare_ok(p.oid))
                                              || '\s*' || agent_board_test.ident_re('p_board_id') || agent_board_test.same_stmt()
-                                             || '\m' || agent_board_test.ci_re('where') || '\s+' || agent_board_test.col_ref_frag('board_id')
+                                             || '\m' || agent_board_test.ci_re('where') || '\s+' || agent_board_test.col_ref_frag('id')
+                                             || '\s*=\s*' || agent_board_test.ident_re('p_thread_id')
+                                             || '\s+' || agent_board_test.ci_re('and') || '\s+' || agent_board_test.col_ref_frag('board_id')
                                              || '\s+' || agent_board_test.ci_re('is null') || '\M')
                   then 'first-board-wins' else 'UNGUARDED' end) || ']', ', ' order by p.proname), '<none>')
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
@@ -1758,7 +1778,7 @@ select is(
       and n.nspname !~ '^pg_'
       and p.prolang <> (select oid from pg_language where lanname = 'internal')
       and agent_board_test.stripped_body(p.oid, true) ~ agent_board_test.col_write_re('threads', 'board_id')),
-  '_upsert_delivery_recipient[first-board-wins]',
+  '_associate_empty_thread[first-board-wins]',
   'CPR-12 BOARD IMMUTABILITY: the sole writer of threads.board_id stamps only where it is null (OBSGATE first-board-wins), so a board can be gained but never moved');
 
 -- CPR-13. And no session can do it directly.
@@ -1979,17 +1999,25 @@ select is(
          or body ~ agent_board_test.row_lock_re('claims')
    ), class_rels as (
      -- every relation in agent_board, from pg_class: a write to ANY of them is the verb.
-     select array_agg(c.relname order by c.relname) as rels
+     select array_agg(c.relname order by c.relname) as rels,
+            array_agg(c.relname order by c.relname) filter (where c.relname <> 'threads') as other_rels
        from pg_class c join pg_namespace n on n.oid = c.relnamespace
       where n.nspname = 'agent_board' and c.relkind in ('r', 'p', 'v', 'm', 'f')
    )
    select coalesce(string_agg(m.oid::regprocedure::text || '[' ||
-            (case when m.body ~ agent_board_test.writes_any_re((select rels from class_rels))
+            (case when m.oid = 'agent_board._associate_empty_thread(uuid,uuid)'::regprocedure
+                        and m.body ~ agent_board_test.stmt_re('update','threads')
+                        and not (m.body ~ agent_board_test.writes_any_re((select other_rels from class_rels)))
+                        and not (m.body ~ agent_board_test.write_re('claims'))
+                        and not (m.body ~ agent_board_test.row_lock_re('claims'))
+                        and not (m.body ~ agent_board_test.re('\mexecute\M'))
+                  then 'claims-reader-thread-stamp'
+                  when m.body ~ agent_board_test.writes_any_re((select rels from class_rels))
                   then 'HAS-WRITE-VERB' else 'no-write-verb' end) || ']', ', ' order by m.oid::regprocedure::text), '<none>')
      from mentioners m
     where m.oid not in (select oid from censused)),
-  '_agent_can_access_thread(uuid,uuid)[no-write-verb], _claimgate_active_ownerless_claims(uuid)[no-write-verb], _claimgate_promotion_blockers(text)[no-write-verb]',
-  'CPR-14b LOCK ORDER (census complement): every function mentioning claims that CPR-14a did NOT census is a pure reader — so a claims writer using a shape no arm matches fails HERE instead of vanishing from both assertions');
+  '_agent_can_access_thread(uuid,uuid)[no-write-verb], _associate_empty_thread(uuid,uuid)[claims-reader-thread-stamp], _claimgate_active_ownerless_claims(uuid)[no-write-verb], _claimgate_promotion_blockers(text)[no-write-verb]',
+  'CPR-14b LOCK ORDER (census complement): claims mentioners outside the writer census are readers, except the OID-bounded history reader that writes threads only');
 
 -- ---------------------------------------------------------------------------
 -- CPR-3a/3b/3c. THE PREMISE EVERYTHING ELSE RESTS ON, WHICH NOTHING PINNED.

package/tests/agent_board_delegate_role_class.test.sql

@@ -16,7 +16,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(43);
+select plan(49);
 
 -- ===========================================================================
 -- 1. The role itself
@@ -381,12 +381,12 @@ select is(
                         and p.prosrc ~* '(operator-designated|target-authored|board-authored)')),
   '_board_membership_events_provenance_guard:guards it, _emit_membership_event:derives it, _membership_consent_kind:reads it in case and filter, _membership_consent_present:reads it in case and filter, _redeem_unbounded_invite_for_agent:never a delegate target, _upsert_board_membership_state:emits only through the emitter, bootstrap_board_owner_memberships:never a delegate target, create_board:never a delegate target, list_my_board_requests:not callable by a delegate, resolve_board_request:admits only through the sink (D15)',
   'every reader of the provenance vocabulary has a positive disposition for principal-authored');
--- 31 -- post_message is the only function that inserts into messages (the attribution mark is complete)
+-- 31 -- _insert_thread_message is the only function that inserts into messages (the attribution mark is complete)
 select is(
   (select string_agg(f.name, ',' order by f.name) from _fn f
     where agent_board_test.stripped_body(f.oid) ~ agent_board_test.stmt_re('insert into', 'messages')),
-  'post_message',
-  'post_message is the only writer of messages, so its delegate mark covers every message');
+  '_insert_thread_message',
+  '_insert_thread_message is the only writer of messages, so its delegate mark covers every message');
 -- 32 -- the delegate fact is written only by the exchange's first-use insert
 select is(
   (select string_agg(f.name, ',' order by f.name) from _fn f
@@ -627,33 +627,52 @@ select is(
   '0/0/0/0',
   'D14: a boardless message it AUTHORED, a boardless delivery and inbox item ADDRESSED to it, and its own presence: invisible');
 
--- 38, 39 -- CROSS-BOARD POST: a message delivered only to BN, in a thread stamped BA
+-- The BA thread cannot be reused for BN. A distinct empty thread carries the
+-- intended BN-only visibility witness without promoting the BA thread's history.
 select pg_temp.authn(pg_temp.u('K.auth'));
-select pg_temp.put('XB', (select message_id::text from agent_board.post_board_message(pg_temp.u('TA'), pg_temp.u('K'), pg_temp.u('BN'), 's', 'cross-board to BN')));
+select throws_ok($$select * from agent_board.post_board_message(pg_temp.u('TA'), pg_temp.u('K'), pg_temp.u('BN'), 's', 'cross-board to BN')$$,
+  '42501', 'thread belongs to a different board', 'D14 cross-board mismatch refuses at the boundary');
+with created as (
+  insert into agent_board.threads(thread_type, created_by_agent_id, subject)
+  values ('coordination', pg_temp.u('K'), 'empty BN thread') returning id
+) select pg_temp.put('TBN', id::text) from created;
+select lives_ok($$select pg_temp.put('XB', (select message_id::text from agent_board.post_board_message(pg_temp.u('TBN'), pg_temp.u('K'), pg_temp.u('BN'), 's', 'board BN')))$$,
+  'D14 separate empty BN thread accepts a board post');
+select ok(pg_temp.v('XB') is not null and exists (select 1 from agent_board.messages where id=pg_temp.u('XB')),
+  'D14 BN post result identifies a stored message');
 select is(
   (select board_id::text from agent_board.threads where id = pg_temp.u('TA')) || ' ' ||
   pg_temp.as_d_val(format($$ select count(*) from agent_board.messages where id = %L $$, pg_temp.v('XB'))),
   pg_temp.v('BA') || ' 0',
-  'D14 cross-board post: in a thread stamped BA, a message delivered only to BN is invisible to a delegate on BA');
+  'D14 BN post: BA remains stamped and a BN message is invisible to a delegate on BA');
 select is(
   pg_temp.as_d_val(format($$ select count(*) from agent_board.messages where id = %L $$, pg_temp.v('MA'))),
   '1',
   'D14 cross-board post, paired: the BA post in the same thread is visible');
 
--- 40 -- REUSED DM THREAD: boardless DMs in a thread later stamped BA by a board post
+-- A private DM cannot be promoted to a board; the paired board visibility
+-- control uses a separate empty thread and leaves the original DM intact.
 do $$
-declare v_thread uuid;
+declare v_thread uuid; v_board_thread uuid;
 begin
   perform pg_temp.authn(pg_temp.u('K.auth'));
   select thread_id into v_thread from agent_board.create_or_find_thread(pg_temp.u('K'), 'dm then board', 'zrows-dm');
   perform agent_board.send_direct_message(v_thread, pg_temp.u('K'), pg_temp.u('K2'), 's', 'the dm before');
   perform pg_temp.put('DMT', v_thread::text);
-  perform agent_board.post_board_message(v_thread, pg_temp.u('K'), pg_temp.u('BA'), 's', 'the board post after');
+  insert into agent_board.threads(thread_type, created_by_agent_id, subject)
+  values ('coordination', pg_temp.u('K'), 'empty BA thread') returning id into v_board_thread;
+  perform pg_temp.put('BPT', v_board_thread::text);
 end $$;
-select is(
-  pg_temp.as_d_val(format($$ select string_agg(body, ',' order by body) from agent_board.messages where thread_id = %L $$, pg_temp.v('DMT'))),
+select throws_ok($$select * from agent_board.post_board_message(pg_temp.u('DMT'), pg_temp.u('K'), pg_temp.u('BA'), 's', 'the board post after')$$,
+  '42501', 'thread has private history', 'D14 private DM cannot be promoted to a board');
+select is((select board_id from agent_board.threads where id=pg_temp.u('DMT')), null::uuid,
+  'D14 refused private DM remains unstamped');
+select lives_ok($$select * from agent_board.post_board_message(pg_temp.u('BPT'), pg_temp.u('K'), pg_temp.u('BA'), 's', 'the board post after')$$,
+  'D14 separate empty BA thread accepts its board post');
+select is(
+  pg_temp.as_d_val(format($$ select string_agg(body, ',' order by body) from agent_board.messages where thread_id = %L $$, pg_temp.v('BPT'))),
   'the board post after',
-  'D14 reused DM thread: the boardless DM in a thread later stamped BA is invisible; the board post is visible');
+  'D14 board post on separate BA thread is visible');
 
 -- 41 -- A CO-MEMBER'S INBOX: K2's per-recipient item on BA is invisible; v_agent_inbox shows
 -- only the delegate's own rows or feed-visible ones, and shows some
@@ -674,8 +693,7 @@ select is(
 -- ids the delegate SEES with the row ids the contract's predicates ADMIT, computed here as
 -- the table owner from the rule itself. The fixture above holds every case the contract
 -- names: active, never-member, removed and left boards; boardless rows addressed to and
--- authored by the delegate; a task assigned to it off-board; a cross-board post; a DM thread
--- later stamped by a board post; and a co-member's non-feed inbox row. A relation with no
+-- authored by the delegate; a task assigned to it off-board; a refused cross-board post; a private DM and separate board post; and a co-member's non-feed inbox row. A relation with no
 -- reference rule here is reported UNMAPPED and fails.
 create function pg_temp.oracle(p_rel text, p_d uuid) returns text language plpgsql as $$
 declare q text; v text;