@consiliency/agent-board-schema 1.68.0 → 1.74.0

package/tests/agent_board_session_identity_behavior_classes.test.sql

@@ -14,7 +14,7 @@ select * from _sid_behavior_fns f where f.body ~ agent_board_test.re(
   agent_board_test.write_frag('session_identities',agent_board_test.bare_ok(f.oid)) || '|'
   || agent_board_test.write_frag('session_id_aliases',agent_board_test.bare_ok(f.oid)));
 select is((select string_agg(proname,', ' order by proname) from _sid_behavior_writers),
-  '_revoke_agent_principal, _session_identity_agent_lineage, approve_identity_state, heartbeat_session_identity, link_session_alias, mint_delegated_child, mint_fleet_agent_session, readmit_session_identity, record_session_identity_state, renew_session_identity',
+  '_revoke_agent_principal, _session_identity_agent_lineage, approve_identity_state, heartbeat_session_identity, link_session_alias, mint_delegated_child, mint_fleet_agent_session, mint_fleet_agent_session_measured, readmit_session_identity, record_session_identity_state, renew_session_identity',
   'EC-SIDSCHEMA-5-protected-population: every catalog-derived identity/alias writer has a gate or a positively proved lifecycle exemption');
 create temp view _sid_behavior_unguarded as
 select w.* from _sid_behavior_writers w
@@ -66,7 +66,7 @@ select is((select string_agg(proname,', ' order by proname) from _sid_behavior_i
 select is((select coalesce(string_agg(c.root_name,', ' order by c.root_name),'')
   from agent_board_test.fn_call_closure() c
   where c.reached_oid='agent_board._mint_fleet_agent_session_legacy(uuid,text,uuid,uuid,integer)'::regprocedure
-    and c.root_oid<>c.reached_oid and c.root_name<>'mint_fleet_agent_session'),'',
+    and c.root_oid<>c.reached_oid and c.root_name<>'mint_fleet_agent_session'),'mint_fleet_agent_session_measured',
   'EC-SIDSCHEMA-4-issuer-wrapper-class: only the gated fleet session mint reaches the private legacy token issuer; a new bypass wrapper names itself');
 select ok(not has_function_privilege('service_role',
   'agent_board._mint_fleet_agent_session_legacy(uuid,text,uuid,uuid,integer)','EXECUTE')

package/tests/agent_board_session_identity_limits.test.sql

@@ -160,7 +160,7 @@ from pg_proc p where p.pronamespace = 'agent_board'::regnamespace
   and (agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('delegation_grants', 'grant_expires_at')
     or agent_board_test.stripped_body(p.oid) ~ agent_board_test.col_write_re('session_identities', 'holder_secret_hash'));
 select is((select string_agg(proname, ', ' order by proname) from _sid_activation_writers),
-  '_session_identity_agent_lineage, mint_delegated_child, mint_fleet_agent_session, readmit_session_identity, renew_delegated_grant',
+  '_session_identity_agent_lineage, mint_delegated_child, mint_fleet_agent_session, mint_fleet_agent_session_measured, readmit_session_identity, renew_delegated_grant',
   'EC-SIDSCHEMA-6-activation-population: every discovered expiry or holder writer has a positive activation path');
 -- An INSERT is conservatively a writer of defaulted columns too. This one
 -- writes a legacy/default-NULL identity, not a live holder or grant. Prove the

package/tests/agent_board_session_identity_measured_mint.test.sql

@@ -0,0 +1,342 @@
+-- SIDSERVER blocker fix (Consiliency/message-board#653 BLOCKs 1 and 2): the MEASURED mint
+-- agent_board.mint_fleet_agent_session_measured, and its parity with every gate of the
+-- seven-argument trusted mint_fleet_agent_session it is meant to replace for the relay. Allowed paths use lives_ok then a separate state
+-- check (AGENTS.md rule 3). Refusal probes that must COMMIT their recording are asserted
+-- with lives_ok (a raise would roll the freeze back), then by state.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(63);
+
+create temp table _mm_fixture(label text primary key, root_id uuid, agent_id uuid, key_id uuid);
+create temp table _mm_results(label text, session_id text, expires_at timestamptz, epoch bigint, secret text, refusal text);
+do $$
+declare v_label text; v_root uuid; v_agent uuid; v_key uuid; v_auth uuid; v_alias uuid; v_harness text;
+begin
+  foreach v_label in array array['codex', 'codex-b', 'claude', 'claude-lapse', 'legacy', 'recorded', 'unresolved',
+    'tomb', 'unproven', 'unclaimed', 'ancestor', 'replay'] loop
+    v_root := gen_random_uuid(); v_agent := gen_random_uuid(); v_key := gen_random_uuid();
+    v_harness := case when v_label like 'claude%' then 'claude' when v_label = 'legacy' then null else 'codex' end;
+    v_auth := public.ensure_github_user('mm-' || v_agent, 'mm-' || v_agent || '@example.test', 'mm-' || v_agent, 'MM');
+    insert into agent_board.agents(id, agent_type, handle, display_name, status)
+    values (v_root, 'agent', 'mm-root-' || v_root, 'MM root', 'active');
+    insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, parent_agent_id, root_agent_id)
+    values (v_agent, 'agent', 'mm-' || v_agent, 'MM', 'active', v_auth, v_root, v_root);
+    insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+    values (v_key, v_agent, 'primary', 1, public.test_pubkey(v_key::text), 'raw_ed25519_base64url', public.test_key_fingerprint(v_key::text), 'active', 'proven');
+    insert into agent_board.session_identities(agent_id, root_agent_id, depth) values (v_root, v_root, 0);
+    insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth, identity_kind, harness, approved_risky_digest, current_risky_digest)
+    values (v_agent, v_root, v_root, 1, case when v_label = 'legacy' then 'legacy' else 'session' end, v_harness, 'approved', 'approved');
+    if v_harness is not null then
+      insert into agent_board.session_id_aliases(identity_agent_id, root_agent_id, harness, session_id)
+      values (v_agent, v_root, v_harness, 'bound-' || v_label) returning id into v_alias;
+      update agent_board.session_identities set lease_alias_id = v_alias where agent_id = v_agent;
+    end if;
+    insert into _mm_fixture values (v_label, v_root, v_agent, v_key);
+  end loop;
+  update agent_board.session_identities set tombstoned_at = now(), tombstone_reason = 'revoked'
+   where agent_id = (select agent_id from _mm_fixture where label = 'tomb');
+  update agent_board.session_identities set resolution_state = 'frozen'
+   where agent_id = (select root_id from _mm_fixture where label = 'ancestor');
+end;
+$$;
+grant select on _mm_fixture to service_role;
+grant select, insert on _mm_results to service_role;
+
+-- INVOKER, so the real RPC runs as service_role. p_digest is the MEASURED risky digest.
+create function pg_temp.mm(p_label text, p_result text, p_digest text, p_alias text, p_continuity text,
+  p_predecessor uuid default null, p_secret text default null, p_resolution text default 'resolved', p_recorded jsonb default '{}')
+returns void language plpgsql as $$
+declare v_fx record; v_issued record;
+begin
+  select * into v_fx from _mm_fixture where label = p_label;
+  select * into v_issued from agent_board.issue_signing_key_challenge(v_fx.agent_id, 'primary');
+  insert into _mm_results
+  select p_result, m.session_id, m.expires_at, m.identity_lease_epoch, m.holder_secret, m.refusal
+    from agent_board.mint_fleet_agent_session_measured(v_issued.challenge_id, split_part(v_issued.challenge, ':', 3), v_fx.key_id, v_fx.agent_id,
+      900, p_secret, p_alias, jsonb_build_object('resolution', p_resolution, 'risky_digest', p_digest, 'recorded', p_recorded),
+      p_continuity, p_predecessor) m;
+end;
+$$;
+-- A fixed challenge, so a second use can prove the inherited single-use gate.
+create temp table _mm_challenge(label text primary key, challenge_id uuid, nonce text);
+grant select, insert on _mm_challenge to service_role;
+create function pg_temp.mm_issue(p_label text) returns void language plpgsql as $$
+declare v_fx record; v_issued record;
+begin
+  select * into v_fx from _mm_fixture where label = p_label;
+  select * into v_issued from agent_board.issue_signing_key_challenge(v_fx.agent_id, 'primary');
+  insert into _mm_challenge values (p_label, v_issued.challenge_id, split_part(v_issued.challenge, ':', 3));
+end;
+$$;
+create function pg_temp.mm_fixed(p_label text, p_result text) returns void language plpgsql as $$
+declare v_fx record; v_ch record;
+begin
+  select * into v_fx from _mm_fixture where label = p_label;
+  select * into v_ch from _mm_challenge where label = p_label;
+  insert into _mm_results
+  select p_result, m.session_id, m.expires_at, m.identity_lease_epoch, m.holder_secret, m.refusal
+    from agent_board.mint_fleet_agent_session_measured(v_ch.challenge_id, v_ch.nonce, v_fx.key_id, v_fx.agent_id, 900, null,
+      'bound-' || p_label, '{"resolution":"resolved","risky_digest":"approved"}'::jsonb, 'same_alias', null) m;
+end;
+$$;
+grant execute on function pg_temp.mm_issue(text), pg_temp.mm_fixed(text, text) to service_role;
+grant execute on function pg_temp.mm(text, text, text, text, text, uuid, text, text, jsonb) to service_role;
+-- The trusted seven-argument form, for the legacy-key relay exemption's positive footprint.
+create function pg_temp.mm_trusted(p_label text, p_alias text)
+returns void language plpgsql as $$
+declare v_fx record; v_issued record;
+begin
+  select * into v_fx from _mm_fixture where label = p_label;
+  select * into v_issued from agent_board.issue_signing_key_challenge(v_fx.agent_id, 'primary');
+  perform * from agent_board.mint_fleet_agent_session(v_issued.challenge_id, split_part(v_issued.challenge, ':', 3), v_fx.key_id, v_fx.agent_id, 900, null, p_alias);
+end;
+$$;
+grant execute on function pg_temp.mm_trusted(text, text) to service_role;
+create function pg_temp.mm_refuse(p_call text)
+returns void language plpgsql as $$
+begin
+  execute p_call;
+  raise exception 'expected refusal but RPC succeeded' using errcode = 'P0001';
+end;
+$$;
+grant execute on function pg_temp.mm_refuse(text) to service_role;
+create function pg_temp.mm_state(p_label text)
+returns table(resolution_state text, current_risky_digest text, approved_risky_digest text, epoch bigint, holder boolean, recorded jsonb)
+language sql as $$
+  select si.resolution_state, si.current_risky_digest, si.approved_risky_digest, si.credential_epoch, si.holder_secret_hash is not null, si.recorded_fingerprint
+    from agent_board.session_identities si join _mm_fixture f on f.agent_id = si.agent_id where f.label = p_label;
+$$;
+grant execute on function pg_temp.mm_state(text) to service_role;
+-- Fixture clock: the runner's own role ages the lease (service_role has no UPDATE).
+create function pg_temp.mm_lapse(p_label text) returns void language sql security definer as $$
+  update agent_board.session_identities set last_heartbeat = now() - interval '181 seconds'
+   where agent_id = (select agent_id from _mm_fixture where label = p_label);
+$$;
+create function pg_temp.mm_alias_count(p_label text, p_session text) returns bigint language sql as $$
+  select count(*) from agent_board.session_id_aliases a join _mm_fixture f on f.agent_id = a.identity_agent_id
+   where f.label = p_label and a.session_id = p_session;
+$$;
+
+-- Catalog: the mint class, enumerated from pg_proc, never from a written list.
+select is((select string_agg(p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')', ' | ' order by p.proname)
+    from pg_proc p where p.pronamespace = 'agent_board'::regnamespace and p.proname in ('mint_fleet_agent_session', 'mint_fleet_agent_session_measured')),
+  'mint_fleet_agent_session(p_challenge_id uuid, p_nonce text, p_signing_key_id uuid, p_agent_id uuid, p_max_ttl_seconds integer, p_holder_secret text, p_session_id text)'
+  || ' | mint_fleet_agent_session_measured(p_challenge_id uuid, p_nonce text, p_signing_key_id uuid, p_agent_id uuid, p_max_ttl_seconds integer, p_holder_secret text, p_session_id text, p_fingerprint jsonb, p_continuity text, p_predecessor_agent_id uuid)',
+  'SIDSERVER-MM-CAT-01: exactly one trusted and one measured mint exist; any added overload names itself');
+select ok((select bool_and(p.prosecdef and p.proconfig @> array['search_path=agent_board, public']
+      and has_function_privilege('service_role', p.oid, 'EXECUTE')
+      and not has_function_privilege('anon', p.oid, 'EXECUTE') and not has_function_privilege('authenticated', p.oid, 'EXECUTE')
+      and not exists (select 1 from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) a where a.grantee = 0 and a.privilege_type = 'EXECUTE')
+      and obj_description(p.oid, 'pg_proc') is not null)
+    from pg_proc p where p.pronamespace = 'agent_board'::regnamespace and p.proname in ('mint_fleet_agent_session', 'mint_fleet_agent_session_measured')),
+  'SIDSERVER-MM-CAT-02: both mints are pinned-search_path definers, service_role-only (no PUBLIC/anon/authenticated) and commented');
+select is((select coalesce(string_agg(distinct c.root_name, ', ' order by c.root_name), '')
+    from agent_board_test.fn_call_closure() c join pg_proc p on p.oid = c.reached_oid
+   where p.pronamespace = 'agent_board'::regnamespace and p.proname in ('mint_fleet_agent_session', 'mint_fleet_agent_session_measured')
+     and c.root_oid <> c.reached_oid), '',
+  'SIDSERVER-MM-CAT-03: no SQL function calls either mint; the relay is the only caller class (repo side: check-sidserver-measured-mint-callers)');
+select ok(agent_board_test.stripped_body('agent_board.mint_fleet_agent_session_measured(uuid,text,uuid,uuid,integer,text,text,jsonb,text,uuid)'::regprocedure, true)
+    like '%_mint_fleet_agent_session_legacy(%',
+  'SIDSERVER-MM-CAT-04: the measured mint validates and consumes the challenge through the private legacy issuer');
+-- Gate parity, catalog half: every function the trusted form reaches (derived from pg_catalog,
+-- not listed here) is reached by the measured form, so no inherited gate can be dropped by
+-- omitting its call. The behavioural half is SIDSERVER-MM-GATE-* below.
+select is((select coalesce(string_agg(distinct t.reached_oid::regprocedure::text, ', '), '')
+    from agent_board_test.fn_call_closure() t
+   where t.root_oid = 'agent_board.mint_fleet_agent_session(uuid,text,uuid,uuid,integer,text,text)'::regprocedure
+     and t.reached_oid <> t.root_oid
+     and not exists (select 1 from agent_board_test.fn_call_closure() m
+       where m.root_oid = 'agent_board.mint_fleet_agent_session_measured(uuid,text,uuid,uuid,integer,text,text,jsonb,text,uuid)'::regprocedure
+         and m.reached_oid = t.reached_oid)), '',
+  'SIDSERVER-MM-PARITY-01: the measured mint reaches every function the trusted mint reaches');
+select ok((select count(distinct t.reached_oid) >= 5 from agent_board_test.fn_call_closure() t
+   where t.root_oid = 'agent_board.mint_fleet_agent_session(uuid,text,uuid,uuid,integer,text,text)'::regprocedure and t.reached_oid <> t.root_oid),
+  'SIDSERVER-MM-PARITY-01-nonvacuous: the trusted closure is populated (legacy issuer, ceiling, limits, lease, service-role gate)');
+
+set local role service_role;
+select set_config('request.jwt.claim.role', 'service_role', true);
+
+-- BLOCK 1 control: a first claim measuring the approved digest issues a token.
+select lives_ok($q$select pg_temp.mm('codex', 'first-a', 'approved', 'bound-codex', 'same_alias')$q$,
+  'SIDSERVER-MM-FP-control: a first claim measuring the approved digest enters the measured mint');
+select is((select (refusal is null and session_id is not null and epoch is not null and secret ~ '^[0-9a-f]{64}$') from _mm_results where label = 'first-a'),
+  true, 'SIDSERVER-MM-FP-control-state: the approved reading claims with a token, epoch and holder secret');
+select is((select row(resolution_state, current_risky_digest)::text from pg_temp.mm_state('codex')), '(active,approved)',
+  'SIDSERVER-MM-FP-control-recorded: the approved reading is recorded and stays active');
+
+-- BLOCK 1: a live holder re-minting with a CHANGED measured digest is refused AND frozen.
+select lives_ok(format($q$select pg_temp.mm('codex', 'remint-b', 'changed-b', 'bound-codex', 'same_alias', null, %L)$q$,
+    (select secret from _mm_results where label = 'first-a')),
+  'SIDSERVER-MM-FP-remint-returns: a changed re-mint RETURNS its refusal so the freeze commits');
+select is((select row(refusal, session_id, epoch, secret)::text from _mm_results where label = 'remint-b'),
+  '(identity_fingerprint_unapproved,,,)', 'SIDSERVER-MM-FP-remint-refused: a changed re-mint gets no session, epoch or holder secret');
+select is((select row(resolution_state, current_risky_digest, approved_risky_digest)::text from pg_temp.mm_state('codex')),
+  '(frozen,changed-b,approved)', 'SIDSERVER-MM-FP-remint-frozen: the measured digest B is recorded and the identity frozen');
+select is((select count(*) from agent_board.nonfleet_sessions s join _mm_fixture f on f.agent_id = s.agent_id
+    where f.label = 'codex' and s.revoked_at is null and s.session_id <> (select session_id from _mm_results where label = 'first-a')), 0::bigint,
+  'SIDSERVER-MM-FP-remint-session-revoked: the refused mint leaves no unrevoked session row');
+select is((select count(*) from agent_board.agent_signing_key_challenges c join _mm_fixture f on f.agent_id = c.agent_id
+    where f.label = 'codex' and c.consumed_at is null), 0::bigint,
+  'SIDSERVER-MM-FP-remint-challenge-consumed: the refused proof is single-use');
+select lives_ok(format($q$select pg_temp.mm('codex', 'after-freeze-a', 'approved', 'bound-codex', 'same_alias', null, %L)$q$,
+    (select secret from _mm_results where label = 'first-a')),
+  'SIDSERVER-MM-FP-sticky-returns: an approved reading after the freeze still enters the measured mint');
+select is((select refusal from _mm_results where label = 'after-freeze-a'), 'identity_fingerprint_unapproved',
+  'SIDSERVER-MM-FP-sticky: the freeze is sticky; restoring the reading does not unfreeze');
+
+-- BLOCK 1: a FIRST claim measuring digest B is refused and frozen, never claimed.
+select lives_ok($q$select pg_temp.mm('codex-b', 'first-b', 'changed-b', 'bound-codex-b', 'same_alias')$q$,
+  'SIDSERVER-MM-FP-first-returns: a changed first claim RETURNS its refusal so the freeze commits');
+select is((select row(refusal, session_id, secret)::text from _mm_results where label = 'first-b'),
+  '(identity_fingerprint_unapproved,,)', 'SIDSERVER-MM-FP-first-refused: a changed first claim gets no session or holder secret');
+select is((select row(resolution_state, current_risky_digest, holder)::text from pg_temp.mm_state('codex-b')),
+  '(frozen,changed-b,f)', 'SIDSERVER-MM-FP-first-frozen: digest B is recorded, frozen, and the lease is never claimed');
+
+-- Unresolved never approves; recorded-only changes do not freeze.
+-- The digest equals the approved one, so only the resolution term can freeze this reading.
+select lives_ok($q$select pg_temp.mm('unresolved', 'unresolved', 'approved', 'bound-unresolved', 'same_alias', null, null, 'unresolved')$q$,
+  'SIDSERVER-MM-FP-unresolved-returns: an unresolved reading enters and returns');
+select is((select row(r.refusal, s.resolution_state)::text from _mm_results r, pg_temp.mm_state('unresolved') s where r.label = 'unresolved'),
+  '(identity_fingerprint_unapproved,frozen)', 'SIDSERVER-MM-FP-unresolved: an unresolved reading freezes and refuses');
+select lives_ok($q$select pg_temp.mm('recorded', 'recorded', 'approved', 'bound-recorded', 'same_alias', null, null, 'resolved', '{"model":"m2"}')$q$,
+  'SIDSERVER-MM-FP-recorded-only-control: a recorded-only change enters the measured mint');
+select is((select row(r.refusal is null, s.resolution_state, s.recorded ->> 'model')::text from _mm_results r, pg_temp.mm_state('recorded') s where r.label = 'recorded'),
+  '(t,active,m2)', 'SIDSERVER-MM-FP-recorded-only: a recorded-only change is stored without freezing and still claims');
+
+-- Measurement shape is mandatory on the measured form.
+select throws_ok($q$select pg_temp.mm_refuse('select * from agent_board.mint_fleet_agent_session_measured(gen_random_uuid(), ''n'', gen_random_uuid(), gen_random_uuid(), 900, null, ''s'', null::jsonb, ''same_alias'', null)')$q$,
+  '22023', 'invalid identity fingerprint reading', 'SIDSERVER-MM-FP-reading-required: the measured form refuses a missing reading');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''legacy'', ''legacy'', ''approved'', ''x'', ''same_alias'')')$q$,
+  '22023', 'measured mint requires a session identity', 'SIDSERVER-MM-FP-legacy-refused: a legacy identity cannot enter the measured form');
+
+-- BLOCK 2: lapsed Claude reclaim through an UNFAMILIAR alias.
+select lives_ok($q$select pg_temp.mm('claude', 'claude-first', 'approved', 'bound-claude', 'same_alias')$q$,
+  'SIDSERVER-MM-CONT-control-first: the Claude initial reserved alias claims through the measured form');
+select pg_temp.mm_lapse('claude');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''claude'', ''x'', ''approved'', ''unseen-same'', ''same_alias'')')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-same-alias: a lapsed Claude same_alias claim cannot bind an unseen id');
+select is(pg_temp.mm_alias_count('claude', 'unseen-same'), 0::bigint, 'SIDSERVER-MM-CONT-same-alias-no-row: no alias row is written');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''claude'', ''x'', ''approved'', ''unseen-new'', ''new'')')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-new: a lapsed Claude "new" claim cannot bind an unseen id');
+select is(pg_temp.mm_alias_count('claude', 'unseen-new'), 0::bigint, 'SIDSERVER-MM-CONT-new-no-row: no alias row is written');
+select is((select epoch from pg_temp.mm_state('claude')), (select epoch from _mm_results where label = 'claude-first'),
+  'SIDSERVER-MM-CONT-epoch-unchanged: refused unfamiliar-alias claims never rotate the epoch');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'unseen-other', 'preserved_uuids', %L)$r$,
+    (select agent_id from _mm_fixture where label = 'codex'))),
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-predecessor-other: preserved UUIDs naming another identity are refused');
+select is(pg_temp.mm_alias_count('claude', 'unseen-other'), 0::bigint, 'SIDSERVER-MM-CONT-predecessor-other-no-row: no alias row is written');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'bound-claude', 'same_alias', %L)$r$,
+    (select agent_id from _mm_fixture where label = 'claude'))),
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-predecessor-without-preserved: only preserved UUIDs may name a predecessor');
+reset role;
+insert into agent_board.session_id_aliases(identity_agent_id, root_agent_id, harness, session_id)
+select root_id, root_id, 'claude', 'taken-claude' from _mm_fixture where label = 'claude';
+set local role service_role;
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'taken-claude', 'preserved_uuids', %L)$r$,
+    (select agent_id from _mm_fixture where label = 'claude'))),
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-GATE-alias-collision: an id already bound under the same root and harness is never rebound');
+select lives_ok(format($q$select pg_temp.mm('claude', 'claude-resumed', 'approved', 'resumed-claude', 'preserved_uuids', %L)$q$,
+    (select agent_id from _mm_fixture where label = 'claude')),
+  'SIDSERVER-MM-CONT-preserved: measured preserved-UUID continuity of this identity reclaims through a new id');
+select is((select row(r.refusal is null, r.secret ~ '^[0-9a-f]{64}$', r.epoch - (select epoch from _mm_results where label = 'claude-first'),
+    pg_temp.mm_alias_count('claude', 'resumed-claude'))::text from _mm_results r where r.label = 'claude-resumed'),
+  '(t,t,1,1)', 'SIDSERVER-MM-CONT-preserved-state: the resumed id is bound, a new holder issued and the epoch fenced');
+
+-- Own-alias reclaim and the live-lease refusal are unchanged.
+select pg_temp.mm_lapse('claude');
+select lives_ok($q$select pg_temp.mm('claude', 'claude-own', 'approved', 'bound-claude', 'same_alias')$q$,
+  'SIDSERVER-MM-CONT-own-alias: a lapsed holder reclaims through its own bound alias');
+select is((select r.epoch - (select epoch from _mm_results where label = 'claude-resumed') from _mm_results r where r.label = 'claude-own'), 1::bigint,
+  'SIDSERVER-MM-CONT-own-alias-epoch: own-alias reclaim fences the prior holder');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''claude'', ''x'', ''approved'', ''bound-claude'', ''same_alias'')')$q$,
+  '42501', 'duplicate_live_session', 'SIDSERVER-MM-CONT-live-duplicate: the identical live session is still refused');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''claude'', ''x'', ''approved'', ''resumed-claude'', ''same_alias'')')$q$,
+  '42501', 'identity_lease_live', 'SIDSERVER-MM-CONT-live-lease: another id cannot take a live lease');
+
+-- Codex never binds a new alias, whatever it measures ('recorded' is a claimed Codex identity).
+select pg_temp.mm_lapse('recorded');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''recorded'', ''x'', ''approved'', ''unseen-codex'', ''same_alias'')')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-codex-same-alias: a lapsed Codex identity cannot bind an unseen id');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('recorded', 'x', 'approved', 'unseen-codex', 'preserved_uuids', %L)$r$,
+    (select agent_id from _mm_fixture where label = 'recorded'))),
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-CONT-codex-preserved: a lapsed Codex identity cannot bind an unseen id even claiming preserved UUIDs');
+select is(pg_temp.mm_alias_count('recorded', 'unseen-codex'), 0::bigint, 'SIDSERVER-MM-CONT-codex-no-row: no Codex alias row is written');
+
+-- Behavioural half of gate parity: one refusal per gate of the trusted form, entered through the
+-- measured mint with every other gate satisfied.
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''tomb'', ''x'', ''approved'', ''bound-tomb'', ''same_alias'')')$q$,
+  '42501', 'identity_tombstoned', 'SIDSERVER-MM-GATE-tombstoned: a tombstoned identity is refused');
+-- The challenge is issued while the key is still active and proven (issuance refuses an inactive
+-- key); the key then loses its proof before the mint, so only the mint's own gate can refuse it.
+select pg_temp.mm_issue('unproven');
+reset role;
+update agent_board.agent_signing_keys set status = 'revoked', revoked_at = now(), proof_state = 'unproven'
+ where id = (select key_id from _mm_fixture where label = 'unproven');
+set local role service_role;
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_fixed(''unproven'', ''x'')')$q$,
+  '42501', 'key_unproven: session key requires proof', 'SIDSERVER-MM-GATE-key-unproven: an unproven session key is refused before the challenge is used');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm(''unclaimed'', ''x'', ''approved'', ''not-reserved'', ''same_alias'')')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-GATE-first-claim-alias: a first claim must use the reserved alias');
+select lives_ok($q$select pg_temp.mm('ancestor', 'ancestor', 'approved', 'bound-ancestor', 'same_alias')$q$,
+  'SIDSERVER-MM-GATE-frozen-ancestor-returns: a frozen ancestor refusal is returned, not raised');
+select is((select row(r.refusal, r.secret, s.resolution_state)::text from _mm_results r, pg_temp.mm_state('ancestor') s where r.label = 'ancestor'),
+  '(identity_fingerprint_unapproved,,active)', 'SIDSERVER-MM-GATE-frozen-ancestor: a frozen ancestor refuses an approved child without freezing it');
+select pg_temp.mm_issue('replay');
+select lives_ok($q$select pg_temp.mm_fixed('replay', 'replay-first')$q$, 'SIDSERVER-MM-GATE-replay-control: the fixed challenge mints once');
+reset role;
+select pg_temp.mm_lapse('replay');
+set local role service_role;
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_fixed(''replay'', ''replay-again'')')$q$,
+  '23505', null, 'SIDSERVER-MM-GATE-nonce-replay: the inherited challenge gate refuses a second use');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'resumed-claude', 'same_alias', null, %L)$r$,
+    repeat('0', 64))),
+  '42501', 'identity_lease_not_held', 'SIDSERVER-MM-GATE-holder-mismatch: a live lease with the wrong holder secret is refused');
+
+-- Claimant-chosen holder secret (#653 re-panel BLOCK B): a claim stores the presented secret, so
+-- a claimant whose response was lost refreshes its own live lease by re-presenting it, while any
+-- other claimant of the identical session id is still refused.
+select pg_temp.mm_lapse('claude');
+select lives_ok(format($q$select pg_temp.mm('claude', 'claimant-claim', 'approved', 'bound-claude', 'same_alias', null, %L)$q$, repeat('a', 64)),
+  'SIDSERVER-MM-CLAIMANT-claim-control: a lapsed holder reclaims presenting its own secret');
+select lives_ok(format($q$select pg_temp.mm('claude', 'claimant-retry', 'approved', 'bound-claude', 'same_alias', null, %L)$q$, repeat('a', 64)),
+  'SIDSERVER-MM-CLAIMANT-lost-response: re-presenting the claimed secret after a lost response is not refused');
+select is((select row(c.secret = repeat('a', 64), r.refusal is null, r.secret is null, r.epoch = c.epoch)::text
+    from _mm_results c, _mm_results r where c.label = 'claimant-claim' and r.label = 'claimant-retry'),
+  '(t,t,t,t)', 'SIDSERVER-MM-CLAIMANT-stored: the claim stored the presented secret and the retry refreshed it at the same epoch');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, format($r$select pg_temp.mm('claude', 'x', 'approved', 'bound-claude', 'same_alias', null, %L)$r$,
+    repeat('b', 64))),
+  '42501', 'duplicate_live_session', 'SIDSERVER-MM-CLAIMANT-other: another claimant of the identical live session id is refused whatever it presents');
+select throws_ok(format($q$select pg_temp.mm_refuse(%L)$q$, $r$select pg_temp.mm('claude', 'x', 'approved', 'bound-claude', 'same_alias', null, 'not-a-secret')$r$),
+  '22023', 'invalid holder secret', 'SIDSERVER-MM-CLAIMANT-malformed: a presented secret that is not 64 lower hex is refused before it could be stored');
+
+-- Positive footprint of the legacy-key relay exemption (deps.ts five-key call): the trusted
+-- form WITHOUT a session id can never claim a session identity.
+select lives_ok($q$select pg_temp.mm('claude-lapse', 'cl-first', 'approved', 'bound-claude-lapse', 'same_alias')$q$,
+  'SIDSERVER-MM-EXEMPT-control: a Claude fixture claims before its lease lapses');
+select pg_temp.mm_lapse('claude-lapse');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_trusted(''claude-lapse'', null)')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-EXEMPT-legacy-key-lapsed: the trusted form without a session id refuses a lapsed session identity');
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_trusted(''codex-b'', null)')$q$,
+  '42501', 'identity_fingerprint_unapproved', 'SIDSERVER-MM-EXEMPT-legacy-key-frozen: the trusted form refuses the identity frozen by a measured mint');
+reset role;
+update agent_board.session_identities set resolution_state = 'active', current_risky_digest = 'approved'
+ where agent_id = (select agent_id from _mm_fixture where label = 'unresolved');
+set local role service_role;
+select throws_ok($q$select pg_temp.mm_refuse('select pg_temp.mm_trusted(''unresolved'', null)')$q$,
+  '42501', 'identity_continuity_refused', 'SIDSERVER-MM-EXEMPT-legacy-key-unclaimed: the trusted form without a session id refuses an unclaimed session identity');
+-- And a direct non-service caller is refused by both overloads.
+reset role;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+set local role authenticated;
+select throws_ok($q$select * from agent_board.mint_fleet_agent_session_measured(gen_random_uuid(), 'n', gen_random_uuid(), gen_random_uuid(), 900, null, 's', '{"resolution":"resolved","risky_digest":"approved"}'::jsonb, 'same_alias', null)$q$,
+  '42501', null, 'SIDSERVER-MM-CAT-05: authenticated cannot execute the measured mint');
+reset role;
+-- Inherited service-role gate, entered by a caller that CAN execute it (the owner) without the
+-- service_role claim, so the grant cannot mask the in-body gate.
+select throws_ok($q$select pg_temp.mm_refuse('select * from agent_board.mint_fleet_agent_session_measured(gen_random_uuid(), ''n'', gen_random_uuid(), gen_random_uuid(), 900, null, ''s'', ''{"resolution":"resolved","risky_digest":"approved"}''::jsonb, ''same_alias'', null)')$q$,
+  '42501', 'session mint is service_role-only', 'SIDSERVER-MM-GATE-service-role: a non-service claim is refused in the body, not only by the grant');
+
+select * from finish();
+rollback;

package/tests/agent_board_session_identity_predicate_isolation.test.sql

@@ -0,0 +1,146 @@
+-- SIDSERVER SL-5 acceptance-audit closure (plan amendment 2026-11-01, decision 2): RPC-level predicate isolation for
+-- the matrix rows `mismatch-renewed` (row 17) and `ancestor-digest-bypassed` (row 42). Every allow path is lives_ok
+-- followed by a separate state check. Where another guard would mask a predicate, the assertion isolates it with
+-- every other gate satisfied. renew_session_identity calls renew_delegated_grant, and that function repeats the
+-- refusal, so these assertions pin the function that RAISED as well as the SQLSTATE and message. States the public
+-- writers cannot produce (active but drifted, active with a null approval) are constructed inside this rolled-back
+-- transaction, only to isolate a predicate. They are never an approved test parent.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to authenticated, service_role;
+select plan(21);
+create temp table _sid_iso_root(root_id uuid, root_auth uuid);
+create temp table _sid_iso_children(label text primary key, agent_id uuid, key_id uuid, expires_at timestamptz);
+create temp table _sid_iso_tokens(label text, expires_at timestamptz, epoch bigint);
+create temp table _sid_iso_results(label text primary key, value boolean);
+do $$
+declare v_root uuid := gen_random_uuid(); v_auth uuid;
+begin
+  v_auth := public.ensure_github_user('sid-iso-' || v_root, 'sid-iso-' || v_root || '@example.test', 'sid-iso-' || v_root, 'Isolation root');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_root, 'agent', 'sid-iso-' || v_root, 'Isolation root', 'active', v_auth, v_auth);
+  insert into agent_board.session_identities(agent_id, root_agent_id, depth, current_risky_digest, approved_risky_digest)
+  values (v_root, v_root, 0, 'approved', 'approved');
+  insert into _sid_iso_root values (v_root, v_auth);
+end;
+$$;
+grant select on _sid_iso_root, _sid_iso_children to authenticated, service_role;
+grant insert on _sid_iso_children, _sid_iso_tokens, _sid_iso_results to service_role;
+create function pg_temp.sid_iso_mint(p_label text, p_parent text default null)
+returns void language plpgsql as $$
+declare v_parent uuid;
+begin
+  v_parent := coalesce((select agent_id from _sid_iso_children where label = p_parent), (select root_id from _sid_iso_root));
+  insert into _sid_iso_children
+  select p_label, m.child_agent_id, m.signing_key_id, m.grant_expires_at
+  from agent_board.mint_delegated_child(v_parent, 'sid-iso-' || p_label || '-' || substr(v_parent::text, 1, 8), '[]',
+    public.test_pubkey(p_label || v_parent), interval '30 days', false, 'claude', 'iso-' || p_label,
+    case when p_parent is not null then '0' end, '[]', '{"resolution":"resolved","risky_digest":"approved"}'::jsonb) m;
+end;
+$$;
+create function pg_temp.sid_iso_token(p_label text)
+returns void language plpgsql as $$
+declare v_child record; v_challenge record;
+begin
+  select * into v_child from _sid_iso_children where label = p_label;
+  select * into v_challenge from agent_board.issue_signing_key_challenge(v_child.agent_id, 'delegated-ephemeral');
+  insert into _sid_iso_tokens
+  select p_label, m.expires_at, m.identity_lease_epoch from agent_board.mint_fleet_agent_session(
+    v_challenge.challenge_id, split_part(v_challenge.challenge, ':', 3), v_child.key_id, v_child.agent_id, 900, null, 'iso-' || p_label) m;
+end;
+$$;
+-- Never raises: returns '<sqlstate>|<message>|<name of the function that raised>' for a refusal, or 'no refusal'.
+create function pg_temp.sid_iso_refusal(p_call text)
+returns text language plpgsql as $$
+declare v_state text; v_message text; v_context text;
+begin
+  execute p_call;
+  return 'no refusal';
+exception when others then
+  get stacked diagnostics v_state = returned_sqlstate, v_message = message_text, v_context = pg_exception_context;
+  return v_state || '|' || v_message || '|'
+    || coalesce(substring(split_part(v_context, E'\n', 1) from 'function (?:[a-z_]+\.)?([a-z_]+)\('), 'unknown');
+end;
+$$;
+grant execute on function pg_temp.sid_iso_mint(text, text), pg_temp.sid_iso_token(text), pg_temp.sid_iso_refusal(text) to service_role, authenticated;
+select set_config('request.jwt.claim.role', 'service_role', true);
+set local role service_role;
+select lives_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sid_iso_root), 'root_minted', '[]', 200, interval '30 days', true)$q$,
+  'SIDSERVER-FP-03/isolation-policy-control: operator configures the root delegation policy');
+select lives_ok($q$select pg_temp.sid_iso_mint('parent'); select pg_temp.sid_iso_mint('target', 'parent')$q$,
+  'SIDSERVER-FP-03/isolation-mint-control: approved parent and target session children enter the real issuer');
+reset role;
+select is((select count(*) from _sid_iso_children), 2::bigint, 'SIDSERVER-FP-03/isolation-mint-state: both principals exist');
+select is((select array[approved_risky_digest, current_risky_digest, resolution_state] from agent_board.session_identities
+  where agent_id = (select agent_id from _sid_iso_children where label = 'parent')), array['approved', 'approved', 'active'],
+  'SIDSERVER-FP-03/isolation-parent-state: the parent is approved, unchanged and active');
+set local role service_role;
+select lives_ok($q$select pg_temp.sid_iso_token('parent')$q$,
+  'SIDSERVER-FP-03/isolation-token-control: real challenge and key gates claim the parent lease');
+reset role;
+select is((select count(*) from _sid_iso_tokens where label = 'parent'), 1::bigint, 'SIDSERVER-FP-03/isolation-token-state: the parent holds an epoch-fenced lease');
+select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where id = (select agent_id from _sid_iso_children where label = 'parent')), true);
+select set_config('request.jwt.claim.identity_lease_epoch', (select epoch::text from _sid_iso_tokens where label = 'parent'), true);
+update agent_board.delegation_grants set grant_expires_at = now() + interval '1 hour' where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select lives_ok($q$select agent_board.renew_session_identity((select agent_id from _sid_iso_children where label = 'parent'), 'approved')$q$,
+  'SIDSERVER-FP-03/isolation-renew-control: the approved live holder renews through renew_session_identity');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent')), now() + interval '7 days',
+  'SIDSERVER-FP-03/isolation-renew-state: that renewal extends the grant to the seven-day ceiling');
+update agent_board.delegation_grants set grant_expires_at = now() + interval '1 hour' where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select lives_ok($q$select agent_board.renew_delegated_grant((select agent_id from _sid_iso_children where label = 'parent'), interval '2 hours')$q$,
+  'SIDSERVER-FP-03/isolation-delegated-control: the approved live holder renews through renew_delegated_grant');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent')), now() + interval '2 hours',
+  'SIDSERVER-FP-03/isolation-delegated-state: that renewal extends the grant by the requested interval');
+
+-- Row 17, renew_session_identity/current-vs-approved: active, approved = supplied, current drifted.
+update agent_board.session_identities set current_risky_digest = 'changed' where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select is(pg_temp.sid_iso_refusal($q$select agent_board.renew_session_identity((select agent_id from _sid_iso_children where label = 'parent'), 'approved')$q$),
+  '42501|identity_fingerprint_unapproved|renew_session_identity',
+  'SIDSERVER-FP-03/mismatch/renew_session_identity/current-vs-approved: renew_session_identity itself refuses a drifted current reading before the delegated grant gate');
+reset role;
+-- Row 17, renew_session_identity/approved-null and renew_delegated_grant/approved-null: active, no approval, no reading.
+update agent_board.session_identities set current_risky_digest = null, approved_risky_digest = null where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+select is((select array[coalesce(approved_risky_digest, '<null>'), coalesce(current_risky_digest, '<null>'), resolution_state] from agent_board.session_identities
+  where agent_id = (select agent_id from _sid_iso_children where label = 'parent')), array['<null>', '<null>', 'active'],
+  'SIDSERVER-FP-03/isolation-null-state: the constructed identity is active with neither approval nor reading');
+set local role service_role;
+select is(pg_temp.sid_iso_refusal($q$select agent_board.renew_session_identity((select agent_id from _sid_iso_children where label = 'parent'), null)$q$),
+  '42501|identity_fingerprint_unapproved|renew_session_identity',
+  'SIDSERVER-FP-03/mismatch/renew_session_identity/approved-null: renew_session_identity itself refuses an identity without an approval before the delegated grant gate');
+select is(pg_temp.sid_iso_refusal($q$select agent_board.renew_delegated_grant((select agent_id from _sid_iso_children where label = 'parent'), interval '3 hours')$q$),
+  '42501|identity_fingerprint_unapproved|renew_delegated_grant',
+  'SIDSERVER-FP-03/mismatch/renew_delegated_grant/approved-null: renew_delegated_grant refuses a session identity without an approval');
+reset role;
+select is((select grant_expires_at from agent_board.delegation_grants where child_agent_id = (select agent_id from _sid_iso_children where label = 'parent')), now() + interval '2 hours',
+  'SIDSERVER-FP-03/isolation-null-no-renewal: neither refused renewal extended the grant');
+update agent_board.session_identities set current_risky_digest = 'approved', approved_risky_digest = 'approved' where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+
+-- Row 42: _session_identity_ancestor_actor with the parent as the verified current actor and the target's reading approved.
+set local role service_role;
+select lives_ok($q$insert into _sid_iso_results select 'ancestor-control', agent_board._session_identity_ancestor_actor((select agent_id from _sid_iso_children where label = 'target'))$q$,
+  'SIDSERVER-APPROVE-01/ancestor-digest/isolation-control: the predicate is evaluated for the approved live parent');
+reset role;
+select is((select value from _sid_iso_results where label = 'ancestor-control'), true,
+  'SIDSERVER-APPROVE-01/ancestor-digest/isolation-state: the approved live parent is the target''s ancestor approver');
+update agent_board.session_identities set current_risky_digest = 'drifted' where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select lives_ok($q$insert into _sid_iso_results select 'ancestor-current', agent_board._session_identity_ancestor_actor((select agent_id from _sid_iso_children where label = 'target'))$q$,
+  'SIDSERVER-APPROVE-01/ancestor-digest/current-control: the predicate is evaluated for an active parent whose reading drifted');
+reset role;
+select is((select value from _sid_iso_results where label = 'ancestor-current'), false,
+  'SIDSERVER-APPROVE-01/ancestor-digest/current: an active parent whose own current reading drifted from its approval cannot approve the target');
+update agent_board.session_identities set current_risky_digest = null, approved_risky_digest = null where agent_id = (select agent_id from _sid_iso_children where label = 'parent');
+set local role service_role;
+select lives_ok($q$insert into _sid_iso_results select 'ancestor-null', agent_board._session_identity_ancestor_actor((select agent_id from _sid_iso_children where label = 'target'))$q$,
+  'SIDSERVER-APPROVE-01/ancestor-digest/non-null-control: the predicate is evaluated for an active parent without any approval');
+reset role;
+select is((select value from _sid_iso_results where label = 'ancestor-null'), false,
+  'SIDSERVER-APPROVE-01/ancestor-digest/non-null: an active parent without any approval cannot approve the target');
+select * from finish();
+rollback;

package/tests/agent_board_sidserver_authority.test.sql

@@ -0,0 +1,69 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+begin;
+grant usage on schema extensions to service_role;
+select plan(12);
+create temp table _sidserver_authority(root_id uuid, board_id uuid, absent_board_id uuid, suffix text);
+create temp table _sidserver_children(label text primary key, agent_id uuid);
+do $$
+declare r uuid := gen_random_uuid(); b uuid := gen_random_uuid(); other_b uuid := gen_random_uuid(); a uuid;
+begin
+  a := public.ensure_github_user('sidserver-authority-'||r, 'sidserver-authority-'||r||'@example.test', 'sidserver-authority-'||r, 'SIDSERVER parent');
+  insert into agent_board.agents(id,agent_type,handle,display_name,status,auth_user_id)
+    values(r,'agent','sidserver-authority-'||r,'SIDSERVER parent','active',a);
+  insert into agent_board.session_identities(agent_id,root_agent_id,depth,current_risky_digest,approved_risky_digest)
+    values(r,r,0,repeat('a',64),repeat('a',64));
+  insert into agent_board.boards(id,slug,name,created_by_agent_id)
+    values(b,'sidserver-authority-'||b,'SIDSERVER room',r), (other_b,'sidserver-authority-'||other_b,'SIDSERVER absent room',r);
+  insert into agent_board.board_memberships(board_id,agent_id,role,membership_state) values(b,r,'member','joined');
+  insert into _sidserver_authority values(r,b,other_b,substr(r::text,1,8));
+end;
+$$;
+grant select on _sidserver_authority, _sidserver_children to service_role;
+grant insert on _sidserver_children to service_role;
+create function pg_temp.sidserver_child(p_label text,p_scopes jsonb,p_role text default null,p_absent boolean default false)
+returns void language plpgsql as $$
+declare r uuid; b uuid; s text; rooms jsonb := '[]';
+begin
+  select root_id,case when p_absent then absent_board_id else board_id end,suffix into r,b,s from _sidserver_authority;
+  if p_role is not null then rooms := jsonb_build_array(jsonb_build_object('board_id',b,'role',p_role)); end if;
+  insert into _sidserver_children select p_label,m.child_agent_id
+    from agent_board.mint_delegated_child(r,'sidserver-'||p_label||'-'||s,p_scopes,public.test_pubkey(s||p_label),interval '1 hour',false,
+      'codex','sidserver-'||p_label,null,rooms,jsonb_build_object('resolution','resolved','risky_digest',repeat('a',64),'recorded','{}'::jsonb),null) m;
+end;
+$$;
+grant execute on function pg_temp.sidserver_child(text,jsonb,text,boolean) to service_role;
+select set_config('request.jwt.claim.role','service_role',true);
+set local role service_role;
+select lives_ok($q$select agent_board.upsert_delegation_policy((select root_id from _sidserver_authority),'root_minted','["read"]',200,interval '1 hour',true)$q$,
+  'SIDSERVER-authority-policy-control: actual parent scope policy is configured');
+select lives_ok($q$select pg_temp.sidserver_child('allowed','["read"]','observer')$q$,
+  'SIDSERVER-authority-room-control: a narrower explicit room enters the real mint');
+reset role;
+select is((select bm.role from agent_board.board_memberships bm join _sidserver_children c on c.agent_id=bm.agent_id where c.label='allowed'), 'observer',
+  'SIDSERVER-ID-01/explicit-policy: the only requested room retains its narrower role');
+set local role service_role;
+select lives_ok($q$select pg_temp.sidserver_child('empty','["read"]')$q$,
+  'SIDSERVER-authority-empty-control: empty explicit rooms enter the real mint');
+reset role;
+select is((select count(*) from agent_board.board_memberships bm join _sidserver_children c on c.agent_id=bm.agent_id where c.label='empty'),0::bigint,
+  'SIDSERVER-ID-01/no-room-fallback: empty policy creates no parent membership copy');
+set local role service_role;
+select throws_ok($q$select pg_temp.sidserver_child('wider-role','["read"]','admin')$q$,'42501','room_authority_exceeded',
+  'SIDSERVER-ID-01/parent-authority-role: a child cannot outrank its parent');
+select throws_ok($q$select pg_temp.sidserver_child('absent-room','["read"]','observer',true)$q$,'42501','room_authority_exceeded',
+  'SIDSERVER-ID-01/parent-authority-room: a child cannot acquire a room its parent lacks');
+select throws_ok($q$select pg_temp.sidserver_child('wider-scope','["read","write"]')$q$,'42501',
+  'scope_exceeded: requested scopes are not a subset of the root allowed_scopes',
+  'SIDSERVER-ID-01/parent-scopes: a child cannot widen parent scopes');
+select lives_ok($q$select pg_temp.sidserver_child('after-refusal','["read"]','observer')$q$,
+  'SIDSERVER-authority-after-refusal-control: refusal does not stop an otherwise valid child');
+reset role;
+select is((select count(*) from _sidserver_children where label in ('wider-role','absent-room','wider-scope')),0::bigint,
+  'SIDSERVER-authority-refusal-state: rejected mints create no child');
+select is((select g.granted_scopes from agent_board.delegation_grants g join _sidserver_children c on c.agent_id=g.child_agent_id where c.label='allowed'),'["read"]'::jsonb,
+  'SIDSERVER-authority-granted-scope-control: allowed grant retains exact read scope');
+select is((select count(*) from agent_board.board_memberships bm join _sidserver_children c on c.agent_id=bm.agent_id where bm.board_id=(select absent_board_id from _sidserver_authority)),0::bigint,
+  'SIDSERVER-authority-absent-room-state: no child membership escapes the parent room set');
+select finish();
+rollback;