@consiliency/agent-board-schema 1.7.0 → 1.10.0

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.7.0",
+  "packageVersion": "1.10.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 76,
-  "aggregateSha256": "fca8d220460ac16309d9a2d76cfa6f9ccc395e1c52c90c7cbd4bd5f04bbc42dc",
+  "migrationCount": 79,
+  "aggregateSha256": "6e82ca1943a3848b3f7c871e97cdf82387194ac361e965111785e236a0e850fd",
   "migrations": [
     {
       "order": 0,
@@ -732,6 +732,33 @@
       "sourceRef": "message-board",
       "bytes": 9521,
       "sha256": "23c1b1545540232bbd94a47cdcbdf30e6294fd714c4d961a0a273a018d4c3398"
+    },
+    {
+      "order": 76,
+      "id": "20260726000100_agent_board_localauth_self_enroll",
+      "filename": "20260726000100_agent_board_localauth_self_enroll.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 7323,
+      "sha256": "38bcc86f0e6d4ad38bc76f5abe719456f5faa2ac5bd2ab24813c61d0160da664"
+    },
+    {
+      "order": 77,
+      "id": "20260727000100_agent_board_roomuiapi",
+      "filename": "20260727000100_agent_board_roomuiapi.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 5217,
+      "sha256": "9c938c40115aa25f464bbb9d177f9f85214fb84f7b37abe5ae9df5b6a2485141"
+    },
+    {
+      "order": 78,
+      "id": "20260728000100_agent_board_enroll_federated_human",
+      "filename": "20260728000100_agent_board_enroll_federated_human.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 15404,
+      "sha256": "5f300449c29ec05c2cd3c2cd7eca622ca41e8b32b8856c5bc0695b5750a196e7"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -37,9 +37,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG forward migrations (migrationCount = prior 75 + 1 = 76)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION forward migrations (migrationCount = prior 78 + 1 = 79)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(76);
+    expect(manifest.migrationCount).toBe(79);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -84,6 +84,17 @@ describe('manifest integrity', () => {
       // ROOMDELEG Lane A: owner-gated set_board_role_gate + creator-identity gate-bypass
       // fix on invite_board_member/resolve_board_request. schema stays 8.
       '20260725000100_agent_board_roomdeleg_role_gate.sql',
+      // LOCALAUTH: Portal-free standalone human self-enroll (self_enroll_human RPC +
+      // one-agent-per-real-auth-user backstop). schema stays 8.
+      '20260726000100_agent_board_localauth_self_enroll.sql',
+      // ROOMUIAPI: two read RPCs for the room console/CLI (owner/admin-gated
+      // list_board_pending_memberships + SECURITY INVOKER resolve_agent_handle).
+      // schema stays 8.
+      '20260727000100_agent_board_roomuiapi.sql',
+      // FEDSESSION: service_role no-PoP federated-HUMAN provisioning (enroll_federated_human)
+      // backing the /portal-session Option A self-signed access-token minter. Additive
+      // (adds a nullable mode column to enrollment_federation_audit); schema stays 8.
+      '20260728000100_agent_board_enroll_federated_human.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_enrollment_audit_content.test.sql

@@ -76,10 +76,13 @@ select is(
         -- ("X is an aggregate function"); restrict to callable functions +
         -- procedures (the RPC surface this invariant is about).
         and p.prokind in ('f', 'p')
-        and p.proname <> 'enroll_federated_identity'
+        -- The federation enroll RPCs WRITE the audit (enroll_federated_human added by
+        -- FEDSESSION, F-6); the invariant is that nothing on the send/session read path
+        -- touches it (asserted specifically in the next case).
+        and p.proname not in ('enroll_federated_identity', 'enroll_federated_human')
    ) d
    where lower(d.def) like '%enrollment_federation_audit%'),
-  0, 'no agent_board RPC other than enroll_federated_identity references enrollment_federation_audit');
+  0, 'no agent_board RPC other than the federation enroll RPCs references enrollment_federation_audit');
 select is(
   (select count(*)::int from (
      select pg_get_functiondef(p.oid) as def

package/tests/agent_board_fedsession.test.sql

@@ -0,0 +1,314 @@
+-- FEDSESSION pgTAP: enroll_federated_human() — service_role no-PoP federated-HUMAN
+-- provisioning (Option A minter substrate).
+--
+-- Proves: the 5-arg signature + service_role-only privs; one provision mints a kind=human
+-- SELF-owned agent (auth_user_id = owner_user_id = a synthetic uid) with a real auth.users
+-- row + NO signing key + a mode='fedsession' audit row; the verified email lives ONLY in
+-- auth.users.raw_user_meta_data (provenance-tagged, MERGED preserving slug) with just the
+-- boolean email_verified in agents.metadata (no '@' anywhere in agents.metadata);
+-- idempotency + L-4b (one agent per synthetic uid); current_agent_id() resolves the
+-- no-credential session to the agent; the IDLINK shared-uid invariant against
+-- enroll_federated_identity; and the provider/kind/subject/non-service rejection matrix.
+-- Runs as postgres (service_role-equivalent), mirroring
+-- agent_board_enroll_federated_identity.test.sql + agent_board_localauth.test.sql.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(36);
+
+-- ---------------------------------------------------------------------------
+-- Phase 0 (superuser): function metadata + privileges
+-- ---------------------------------------------------------------------------
+-- 1
+select has_function(
+  'agent_board', 'enroll_federated_human',
+  array['text','text','text','jsonb','text'],
+  'enroll_federated_human(text,text,text,jsonb,text) exists');
+-- 2
+select function_privs_are(
+  'agent_board', 'enroll_federated_human', array['text','text','text','jsonb','text'],
+  'service_role', array['EXECUTE'], 'service_role may EXECUTE enroll_federated_human');
+-- 3
+select function_privs_are(
+  'agent_board', 'enroll_federated_human', array['text','text','text','jsonb','text'],
+  'authenticated', array[]::text[], 'authenticated may NOT EXECUTE enroll_federated_human');
+-- 4
+select function_privs_are(
+  'agent_board', 'enroll_federated_human', array['text','text','text','jsonb','text'],
+  'anon', array[]::text[], 'anon may NOT EXECUTE enroll_federated_human');
+
+-- ---------------------------------------------------------------------------
+-- Fixtures + provision identity A (email_verified) and B (unverified)
+-- ---------------------------------------------------------------------------
+create temp table _f (
+  s text, iss text, aud text,
+  sub_a text, email_a text, sub_b text
+) on commit drop;
+grant all on table _f to authenticated, service_role;
+
+create temp table _r (
+  label text, agent_id uuid, auth_user_id uuid, owner_user_id uuid,
+  handle text, kind text, status text, created_at timestamptz
+) on commit drop;
+grant all on table _r to authenticated, service_role;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_iss text; v_agent uuid; v_auth uuid; v_owner uuid; v_handle text;
+  v_kind text; v_status text; v_created timestamptz;
+begin
+  v_iss := 'https://fed-hs-' || s || '.test';
+  insert into _f values (
+    s, v_iss, 'message-board',
+    'portal-user-' || s, 'alice-' || s || '@example.test', 'portal-user2-' || s);
+
+  -- Approved provider that permits BOTH agent + human (agent needed for the IDLINK case).
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values
+    (v_iss, 'message-board', true, true, '{board:send}', '{board:x}', '{agent,human}');
+
+  -- Provision A (verified email present in the claim).
+  select e.agent_id, e.auth_user_id, e.handle, e.kind, e.status, e.created_at
+    into v_agent, v_auth, v_handle, v_kind, v_status, v_created
+    from agent_board.enroll_federated_human(
+      v_iss, 'message-board', 'portal-user-' || s,
+      jsonb_build_object('sub', 'portal-user-' || s, 'email', 'alice-' || s || '@example.test',
+                         'email_verified', true, 'name', 'Alice ' || s),
+      'Alice ' || s) e;
+  select a.owner_user_id into v_owner from agent_board.agents a where a.id = v_agent;
+  insert into _r values ('A', v_agent, v_auth, v_owner, v_handle, v_kind, v_status, v_created);
+
+  -- Provision B (DIFFERENT identity, email_verified=false).
+  select e.agent_id, e.auth_user_id, e.handle, e.kind, e.status, e.created_at
+    into v_agent, v_auth, v_handle, v_kind, v_status, v_created
+    from agent_board.enroll_federated_human(
+      v_iss, 'message-board', 'portal-user2-' || s,
+      jsonb_build_object('sub', 'portal-user2-' || s, 'email', 'bob-' || s || '@example.test',
+                         'email_verified', false),
+      null) e;
+  select a.owner_user_id into v_owner from agent_board.agents a where a.id = v_agent;
+  insert into _r values ('B', v_agent, v_auth, v_owner, v_handle, v_kind, v_status, v_created);
+end
+$$;
+
+-- One provision mints a kind=human, self-owned, active agent -----------------------------
+-- 5
+select is((select count(*)::int from _r where label = 'A'), 1, 'provision A returned exactly one row');
+-- 6
+select is((select kind from _r where label = 'A'), 'human', 'agent A kind = human');
+-- 7
+select is(
+  (select a.agent_type from agent_board.agents a where a.id = (select agent_id from _r where label='A')),
+  'human', 'agent A agent_type = human');
+-- 8
+select is((select status from _r where label = 'A'), 'active', 'agent A status = active');
+-- 9
+select is(
+  (select auth_user_id from _r where label='A'),
+  (select owner_user_id from _r where label='A'),
+  'agent A is self-owned (auth_user_id = owner_user_id = the synthetic uid)');
+-- 10
+select is(
+  (select count(*)::int from auth.users u where u.id = (select auth_user_id from _r where label='A')),
+  1, 'the synthetic auth.users row for agent A exists');
+-- 11
+select is(
+  (select handle from _r where label='A'),
+  'fed-human-' || substr(
+    encode(extensions.digest(convert_to((select iss from _f) || '|' || (select sub_a from _f), 'UTF8'), 'sha256'), 'hex'),
+    1, 32),
+  'handle = fed-human-<sha256(issuer|subject)[:32]> (byte-identical to enroll_federated_identity)');
+
+-- metadata carries the federation snapshot, boolean-only email, no PII --------------------
+-- 12
+select is(
+  (select a.metadata->'federation'->>'issuer' from agent_board.agents a where a.id=(select agent_id from _r where label='A')),
+  (select iss from _f), 'metadata.federation.issuer round-trips');
+-- 13
+select is(
+  (select a.metadata->'federation'->>'subject' from agent_board.agents a where a.id=(select agent_id from _r where label='A')),
+  (select sub_a from _f), 'metadata.federation.subject round-trips');
+-- 14
+select is(
+  (select a.metadata->'federation'->>'mode' from agent_board.agents a where a.id=(select agent_id from _r where label='A')),
+  'fedsession', 'metadata.federation.mode = fedsession');
+-- 15
+select is(
+  (select a.metadata->'federation'->>'email_verified' from agent_board.agents a where a.id=(select agent_id from _r where label='A')),
+  'true', 'verified identity -> metadata.federation.email_verified = true');
+-- 16
+select ok(
+  (select a.metadata::text not like '%@%' from agent_board.agents a where a.id=(select agent_id from _r where label='A')),
+  'agent A metadata carries NO plaintext email/@ (PII stays out of fleet-readable metadata)');
+
+-- verified email + slug live (merged) in auth.users.raw_user_meta_data --------------------
+-- 17
+select is(
+  (select u.raw_user_meta_data->>'fedsession_email' from auth.users u where u.id=(select auth_user_id from _r where label='A')),
+  (select email_a from _f), 'verified email is stored in auth.users.raw_user_meta_data');
+-- 18
+select is(
+  (select u.raw_user_meta_data->>'fedsession_email_provenance' from auth.users u where u.id=(select auth_user_id from _r where label='A')),
+  'portal-claim-unverified', 'stored email is tagged provenance=portal-claim-unverified (F-12)');
+-- 19 (F-4 merge preserved _ensure_agent_auth_user's slug)
+select is(
+  (select u.raw_user_meta_data->>'slug' from auth.users u where u.id=(select auth_user_id from _r where label='A')),
+  (select handle from _r where label='A'),
+  'raw_user_meta_data merge preserved the _ensure_agent_auth_user slug (no overwrite)');
+
+-- NO signing key; audit row written ------------------------------------------------------
+-- 20
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys k where k.agent_id=(select agent_id from _r where label='A')),
+  0, 'agent A holds NO agent_signing_keys row (humans hold no key)');
+-- 21
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit e
+     where e.agent_id=(select agent_id from _r where label='A') and e.mode='fedsession'),
+  1, 'provision A wrote exactly one mode=fedsession audit row');
+
+-- Identity B: unverified boolean + PII guard ---------------------------------------------
+-- 22
+select is(
+  (select a.metadata->'federation'->>'email_verified' from agent_board.agents a where a.id=(select agent_id from _r where label='B')),
+  'false', 'unverified identity -> metadata.federation.email_verified = false');
+-- 23
+select ok(
+  (select a.metadata::text not like '%@%' from agent_board.agents a where a.id=(select agent_id from _r where label='B')),
+  'agent B metadata carries NO plaintext email/@');
+
+-- Idempotency + L-4b ---------------------------------------------------------------------
+-- 24
+select is(
+  (select e.agent_id from agent_board.enroll_federated_human(
+     (select iss from _f), 'message-board', (select sub_a from _f),
+     jsonb_build_object('sub', (select sub_a from _f), 'email_verified', true), 'Alice again') e),
+  (select agent_id from _r where label='A'),
+  're-provision of the same (issuer,sub) is idempotent (same agent_id)');
+-- 25
+select is(
+  (select count(*)::int from agent_board.agents a where a.auth_user_id=(select auth_user_id from _r where label='A')),
+  1, 'still exactly one agent on the synthetic uid (L-4b)');
+-- 26
+select is(
+  (select count(*)::int from agent_board.agents a
+     where a.owner_user_id=(select auth_user_id from _r where label='A') and a.kind <> 'human'),
+  0, 'no non-human agent was ever created on this owner uid (kind is structural)');
+
+-- IDLINK: enroll_federated_identity for the SAME (issuer,sub) shares the owner uid --------
+create temp table _idlink (owner uuid) on commit drop;
+do $$
+declare
+  f record;
+  v_pub text; v_fp text; v_agent uuid;
+begin
+  select * into f from _f;
+  -- A deterministic canonical 32-byte raw key + its raw-byte fingerprint (same construction
+  -- as the enroll_federated_identity B1 harness).
+  v_pub := rtrim(translate(encode(extensions.digest(convert_to('idlink-'||f.s,'UTF8'),'sha256'),'base64'),'+/','-_'),'=');
+  v_fp := 'sha256:' || rtrim(translate(encode(extensions.digest(decode(translate(v_pub,'-_','+/')||'=','base64'),'sha256'),'base64'),'+/','-_'),'=');
+  select e.agent_id into v_agent
+    from agent_board.enroll_federated_identity(
+      f.iss, 'message-board', f.sub_a, jsonb_build_object('sub', f.sub_a),
+      'idlink-'||f.s, v_pub, 'raw_ed25519_base64url', v_fp,
+      true, null, 'agent', '{board:send}', '{}') e;
+  insert into _idlink select a.owner_user_id from agent_board.agents a where a.id = v_agent;
+end
+$$;
+-- 27
+select is(
+  (select owner from _idlink),
+  (select auth_user_id from _r where label='A'),
+  'IDLINK: enroll_federated_identity for the same (issuer,sub) shares the fed-human owner uid');
+
+-- current_agent_id() resolves the no-credential session to the fed-human agent -----------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select auth_user_id::text from _r where label='A'), true);
+-- 28
+select is(
+  agent_board.current_agent_id(),
+  (select agent_id from _r where label='A'),
+  'current_agent_id() (no agent_credential_id claim) resolves to the fed-human agent');
+-- 29 (non-service caller: authenticated lacks EXECUTE -> 42501)
+select throws_ok(
+  $$ select agent_board.enroll_federated_human('https://x.test','message-board','portal-x','{}'::jsonb,null) $$,
+  '42501', null, 'a non-service (authenticated) caller is rejected with 42501');
+reset role;
+-- Clear BOTH request.jwt GUCs: reset role alone leaves request.jwt.claim.role set (it
+-- persists as is_local), so auth.role() would stay 'authenticated' and _is_service_role()
+-- would wrongly reject the following superuser calls (they must run as service_role-equiv).
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- Provider / kind / subject rejection matrix (superuser) ---------------------------------
+-- 30 unknown (issuer, audience)
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human('https://nope-%s.test','message-board',%L,%L::jsonb,null)$q$,
+     s, sub_a, jsonb_build_object('sub', sub_a)::text) from _f),
+  '42501', null, 'unknown (issuer,audience) is rejected');
+-- 31 null verified subject
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human(%L,'message-board',NULL,%L::jsonb,null)$q$,
+     iss, jsonb_build_object('x', 1)::text) from _f),
+  '22023', null, 'a null verified subject is rejected');
+-- 32 subject contains a '|' (F-11 preimage-injection guard)
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human(%L,'message-board',%L,%L::jsonb,null)$q$,
+     iss, 'portal|evil', jsonb_build_object('sub','portal|evil')::text) from _f),
+  '22023', null, 'a subject containing a pipe separator is rejected (F-11)');
+-- 32b subject is email-shaped ('@') (F-11 PII backstop; subject is stored fleet-readable)
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human(%L,'message-board',%L,%L::jsonb,null)$q$,
+     iss, 'evil@example.test', jsonb_build_object('sub','evil@example.test')::text) from _f),
+  '22023', null, 'an email-shaped (@) subject is rejected before it reaches fleet-readable metadata (F-11)');
+
+-- provider present but NOT policy_approved -> 42501
+do $$
+declare s2 text := replace(substr(gen_random_uuid()::text,1,8),'-','');
+begin
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://fed-unapproved-'||s2||'.test','message-board', true, false, '{}','{}','{human}');
+  insert into _f(s,iss,aud,sub_a,email_a,sub_b)
+    values ('U'||s2, 'https://fed-unapproved-'||s2||'.test','message-board','portal-u-'||s2,null,null);
+end $$;
+-- 33
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human(%L,'message-board',%L,%L::jsonb,null)$q$,
+     iss, sub_a, jsonb_build_object('sub', sub_a)::text) from _f where s like 'U%'),
+  '42501', null, 'an un-approved (policy_approved=false) provider is rejected');
+
+-- provider approved but allowed_agent_kinds EXCLUDES human (non-empty {agent}) -> 42501
+do $$
+declare s3 text := replace(substr(gen_random_uuid()::text,1,8),'-','');
+begin
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+  values ('https://fed-nohuman-'||s3||'.test','message-board', true, true, '{}','{}','{agent}');
+  insert into _f(s,iss,aud,sub_a,email_a,sub_b)
+    values ('N'||s3, 'https://fed-nohuman-'||s3||'.test','message-board','portal-n-'||s3,null,null);
+end $$;
+-- 34
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human(%L,'message-board',%L,%L::jsonb,null)$q$,
+     iss, sub_a, jsonb_build_object('sub', sub_a)::text) from _f where s like 'N%'),
+  '42501', null, 'a non-empty allowed_agent_kinds that excludes human is rejected');
+
+-- Non-active identity cannot re-provision (no self-reactivation; F-13 lever) --------------
+update agent_board.agents set status='suspended', updated_at=now()
+  where id = (select agent_id from _r where label='A');
+-- 35
+select throws_ok(
+  (select format($q$select agent_board.enroll_federated_human(%L,'message-board',%L,%L::jsonb,null)$q$,
+     iss, sub_a, jsonb_build_object('sub', sub_a)::text) from _f where sub_a like 'portal-user-%'),
+  '42501', null, 'a suspended (non-active) fed-human cannot re-provision a session (42501)');
+
+select finish();
+
+rollback;

package/tests/agent_board_localauth.test.sql

@@ -0,0 +1,171 @@
+-- LOCALAUTH pgTAP: self_enroll_human() — Portal-free human self-enrollment.
+--
+-- Harness mirrors agent_board_authbound_boundary.test.sql: seed auth.users via
+-- public.ensure_github_user, fake an authenticated caller with
+--   set local role authenticated + set_config('request.jwt.claim.sub', <uid>),
+-- so auth.uid() = sub. reset role -> superuser (auth.uid() null / service_role).
+--
+-- CRITICAL harness notes:
+--  * L-7: `reset role` does NOT null auth.uid(); request.jwt.claim.sub is set
+--    is_local=true and PERSISTS. Cases 12/13 explicitly clear the sub GUC before
+--    asserting 42501, else the RPC finds the prior uid's agent (vacuous pass).
+--  * L-8: ensure_github_user sets email_confirmed_at = now() unconditionally, so
+--    the unverified case nulls it first.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(17);
+
+-- ---------------------------------------------------------------------------
+-- Phase 0 (superuser): function metadata + seed
+-- ---------------------------------------------------------------------------
+
+-- 1
+select has_function('agent_board', 'self_enroll_human', array['text'], 'self_enroll_human(text) exists');
+-- 2
+select function_privs_are('agent_board', 'self_enroll_human', array['text'], 'authenticated', array['EXECUTE'],
+  'authenticated may EXECUTE self_enroll_human');
+-- 3
+select function_privs_are('agent_board', 'self_enroll_human', array['text'], 'anon', array[]::text[],
+  'anon may NOT EXECUTE self_enroll_human');
+
+create temp table _lfix (
+  user_a uuid,
+  user_b uuid,
+  user_c uuid,
+  agent_a uuid,
+  agent_a2 uuid
+) on commit drop;
+grant all on table _lfix to authenticated, service_role;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_a uuid;
+  v_b uuid;
+  v_c uuid;
+begin
+  -- verified user (email_confirmed_at defaults to now())
+  v_a := public.ensure_github_user(
+    'localauth-a-' || v_suffix,
+    'localauth-a-' || v_suffix || '@example.test',
+    'localauth-a-' || v_suffix,
+    'LOCALAUTH A ' || v_suffix);
+
+  -- unverified user: L-8 — null out the unconditionally-set email_confirmed_at
+  v_b := public.ensure_github_user(
+    'localauth-b-' || v_suffix,
+    'localauth-b-' || v_suffix || '@example.test',
+    'localauth-b-' || v_suffix,
+    'LOCALAUTH B ' || v_suffix);
+  update auth.users set email_confirmed_at = null where id = v_b;
+
+  -- user with a pre-existing SUSPENDED human agent (no self-reactivation case)
+  v_c := public.ensure_github_user(
+    'localauth-c-' || v_suffix,
+    'localauth-c-' || v_suffix || '@example.test',
+    'localauth-c-' || v_suffix,
+    'LOCALAUTH C ' || v_suffix);
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('human', 'human', 'localauth-suspended-' || v_suffix, 'Suspended Human', 'suspended', v_c, v_c);
+
+  insert into _lfix(user_a, user_b, user_c) values (v_a, v_b, v_c);
+end
+$$;
+
+-- ---------------------------------------------------------------------------
+-- Phase 1 (authenticated as user_a): enroll + auth-context assertions
+-- ---------------------------------------------------------------------------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select user_a::text from _lfix), true);
+
+do $$
+declare
+  v_first uuid;
+  v_second uuid;
+begin
+  select s.agent_id into v_first from agent_board.self_enroll_human('Alice') s;
+  -- idempotent second call for the same uid returns the SAME agent
+  select s.agent_id into v_second from agent_board.self_enroll_human('Alice Again') s;
+  update _lfix set agent_a = v_first, agent_a2 = v_second;
+end
+$$;
+
+-- 4 (part 1 of case 8): current_agent_id() resolves to the freshly-enrolled agent
+select is(agent_board.current_agent_id(), (select agent_a from _lfix),
+  'current_agent_id() (no agent_credential_id claim) resolves to the self-enrolled agent');
+-- 5 (case 9): idempotent — second enroll returned the same agent_id
+select is((select agent_a2 from _lfix), (select agent_a from _lfix),
+  'second self_enroll_human for the same uid is idempotent (same agent_id)');
+
+-- ---------------------------------------------------------------------------
+-- Phase 2 (authenticated as user_b): enroll unverified user
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select user_b::text from _lfix), true);
+select agent_board.self_enroll_human(null);
+
+-- ---------------------------------------------------------------------------
+-- Phase 3 (superuser): row-shape assertions without RLS in the way
+-- ---------------------------------------------------------------------------
+reset role;
+
+-- 6/7/8 (case 4): the enrolled row is a human bound to the uid
+select is((select kind::text from agent_board.agents where id = (select agent_a from _lfix)),
+  'human', 'self-enrolled agent kind = human');
+select is((select agent_type from agent_board.agents where id = (select agent_a from _lfix)),
+  'human', 'self-enrolled agent agent_type = human');
+select is((select auth_user_id from agent_board.agents where id = (select agent_a from _lfix)),
+  (select user_a from _lfix), 'self-enrolled agent auth_user_id = auth.uid()');
+-- 9 (case 5): self-owned
+select is((select owner_user_id from agent_board.agents where id = (select agent_a from _lfix)),
+  (select user_a from _lfix), 'self-enrolled agent owner_user_id = auth.uid() (self-owned)');
+-- 10 (case 6): active
+select is((select status from agent_board.agents where id = (select agent_a from _lfix)),
+  'active', 'self-enrolled agent status = active');
+-- 11 (case 7): verified user -> email_verified BOOLEAN true (never a plaintext email)
+select is((select metadata->'localauth'->>'email_verified' from agent_board.agents where id = (select agent_a from _lfix)),
+  'true', 'verified user -> metadata.localauth.email_verified = true');
+-- 12 (case 10): exactly one active row for the uid
+select is((select count(*) from agent_board.agents where auth_user_id = (select user_a from _lfix) and status = 'active'),
+  1::bigint, 'exactly one active agent per uid');
+-- 13 (case 11): unverified user -> email_verified BOOLEAN false
+select is((select metadata->'localauth'->>'email_verified' from agent_board.agents where auth_user_id = (select user_b from _lfix)),
+  'false', 'unverified user -> metadata.localauth.email_verified = false');
+-- 14 (case 15 / L-4b): the DB backstop unique index exists
+select ok(exists(
+  select 1 from pg_indexes
+   where schemaname = 'agent_board'
+     and indexname = 'idx_agent_board_agents_auth_user_id_unique'),
+  'L-4b one-agent-per-real-auth-user backstop index exists');
+
+-- ---------------------------------------------------------------------------
+-- Phase 4: fail-closed cases
+-- ---------------------------------------------------------------------------
+
+-- 15 (case 12): authenticated role but NO subject (L-7: clear the sub GUC) -> 42501
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', '', true);
+select throws_ok($$ select agent_board.self_enroll_human(null) $$, '42501',
+  null, 'unauthenticated (no auth.uid()) is rejected with 42501');
+
+-- 16 (case 13): service-role / superuser (reset role) + cleared sub -> 42501
+reset role;
+select set_config('request.jwt.claim.sub', '', true);
+select throws_ok($$ select agent_board.self_enroll_human(null) $$, '42501',
+  null, 'service-role / superuser (auth.uid() null) is rejected with 42501');
+
+-- 17 (case 14): a pre-existing non-active identity cannot self-reactivate -> 42501
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select user_c::text from _lfix), true);
+select throws_ok($$ select agent_board.self_enroll_human(null) $$, '42501',
+  null, 'a suspended (non-active) identity cannot self-reactivate (42501)');
+
+select finish();
+
+rollback;