@creatornader/agent-bridge 0.4.0 → 0.5.0

package/docs/deployment.md

@@ -119,6 +119,26 @@ Keep these authorities separate:
 | Archive operator | Portable PostgreSQL archive operations | Never |
 | Backup and restore | Native DR backup or restore | Never |
 
+The schema owner may be a true PostgreSQL superuser or a managed-provider
+administrator with `CREATEROLE` and the database privileges reported by the production
+preflight. `CREATEROLE` is sufficient for migrations. Native backup requires the
+schema owner to be a true superuser or hold `BYPASSRLS`. A restore target validates the
+intentionally suspended restored schema-owner shell through its superuser session. Migrations create internal
+roles with safe defaults and reject unsafe preexisting roles instead of trying to demote
+them. PostgreSQL 16 and newer may store the schema owner's effective admin, inherit,
+and set authority in two physical grant rows. A native DR restore may recreate it as one
+combined bootstrap-superuser grant. Agent Bridge validates both forms and their
+effective authority. The restricted runtime login must never receive either schema-owner
+authority or `BYPASSRLS`.
+
+Migration 021 creates a database-derived `NOLOGIN` backup-reader role. It receives
+`SELECT` on Agent Bridge tables and sequences and is granted only to the schema owner.
+This lets a managed schema owner retain `BYPASSRLS` while producing a complete native
+backup. Do not grant the reader to the runtime login, control members, archive members,
+or another external principal. Native backup and restore require this attestation.
+Gateway runtime readiness does not, so an owner-only backup fault cannot stop normal
+gateway traffic.
+
 Use the platform's secret manager or private mounted secret files. Do not put raw
 passwords, tokens, or complete database URLs in image layers, source control, command
 arguments, deployment logs, or shared client config. Rotate each authority on its own
@@ -127,6 +147,130 @@ schedule and after any suspected exposure.
 The runtime database password must contain at least 32 characters. The bootstrap job
 fails before role creation or alteration when the mounted value is shorter.
 
+## Fly.io reference hosting
+
+[`deploy/fly.toml`](../deploy/fly.toml) is the maintained Fly gateway contract. It has
+no app name, region, or release command. The operator chooses the account, app, region,
+PostgreSQL service, and public hostname. Fly terminates HTTPS and forwards to port
+8787. The service keeps at least one `shared-cpu-1x` machine with 512 MB running, checks
+`GET /readyz`, and gives the Node process 30 seconds after SIGTERM to close listeners
+and database pools.
+
+Run the repository check before any Fly action:
+
+```bash
+npm run preflight:fly -- --json
+```
+
+The local check verifies Node, the Dockerfile, and the static Fly contract. If the app
+already exists, add its name:
+
+```bash
+npm run preflight:fly -- --app <app> --json
+```
+
+With `--app`, the command invokes only read-only Fly commands. It observes the active
+account, app status, effective config, machines, and secret names. Its JSON includes
+names and check results but never environment-variable values. A passing local check
+does not prove that an external resource exists or that deployment is safe.
+
+The long-running Fly machine may receive only the restricted
+`AGENT_BRIDGE_RUNTIME_DATABASE_URL` database authority. Do not give it
+`AGENT_BRIDGE_DATABASE_URL`, `AGENT_BRIDGE_OPERATOR_DATABASE_URL`,
+`AGENT_BRIDGE_RUNTIME_PASSWORD`, a client bearer token, or a Supabase client key. The
+preflight rejects those names. Keep schema-owner, control-operator, archive, and DR
+authority in separate operator jobs.
+
+### Operator order and gates
+
+The following actions change external state and require an operator gate. The
+repository does not perform them:
+
+1. Create or select the Fly app and PostgreSQL authority. Keep PostgreSQL private.
+2. Run the read-only production database preflight before any backup or migration:
+
+   ```bash
+   AGENT_BRIDGE_DATABASE_URL="..." npm run preflight:postgres:production -- --json --require-ssl
+   ```
+
+   The command opens a read-only transaction and reports only nonsecret capability
+   and schema facts. `authority.roles` reports migration authority. `authority.native_dr`
+   reports whether the source schema owner is a true superuser or has `BYPASSRLS`. A
+   `CREATEROLE` role can pass the migration check while failing the native DR check.
+   The command also checks supported server majors, migration-ledger drift, derived-role
+   collisions, and the legacy import shape. The PostgreSQL 15 through 18 test matrix
+   separately applies the full migration plan as both a superuser and a
+   managed-provider-style `CREATEROLE` administrator. `--require-ssl` is required for a
+   public database endpoint. The preflight cannot prove that later DDL will succeed. For
+   a session pooler, it checks the client TLS socket because PostgreSQL reports the
+   pooler's separate database connection.
+3. Take and verify a native DR backup when upgrading an existing authority.
+4. Run `agent-bridge migrate` once in an isolated job with
+   `AGENT_BRIDGE_DATABASE_URL`. Drain old gateways first when the migration notes
+   require it.
+5. Run [`deploy/bootstrap-runtime.sql`](../deploy/bootstrap-runtime.sql) through a
+   separate trusted PostgreSQL session. Supply the schema-owner connection and the
+   runtime password to that job only. The bootstrap is transactional and changes an
+   existing login only when its attributes, ownership, and membership graph already
+   match the recorded runtime contract. It never adopts a restored `NOLOGIN` shell.
+6. Construct the restricted runtime URL, set only
+   `AGENT_BRIDGE_RUNTIME_DATABASE_URL` on the Fly app, and run the app-aware read-only
+   preflight.
+7. Deploy the immutable image with `fly deploy --config deploy/fly.toml --app <app>`.
+   Require `/readyz` before routing clients.
+8. Run authenticated capability and status probes, then publish, pull, claim, and
+   settle a disposable targeted delivery.
+9. Move clients only after the gateway proof passes. Preserve every source edge store
+   until its outbox is empty.
+
+App creation, database provisioning, secret writes, migration, bootstrap, deployment,
+traffic changes, and client cutover are all gated external actions. The preflight is
+read-only and cannot authorize any of them.
+
+### Fly rollback boundary
+
+Before migration, stop a failed deployment and keep the prior image and authority. A
+failed image rollout after a compatible migration can return traffic to the prior
+image only if that image accepts the current schema. Never assume that an older image
+can run against newer migrations.
+
+After clients publish through the new gateway, preserve both authorities and every
+edge database. Stop the cutover, drain queued outboxes, and reconcile authoritative
+messages before choosing one authority. If schema or data recovery is required,
+restore the verified native DR bundle into a fresh target and switch authority once.
+Do not run the source and restored database as active authorities at the same time.
+
+The manual `gateway production proof` GitHub Actions workflow runs this acceptance
+proof against an existing HTTPS gateway. GitHub restricts it to `main`, and every job
+uses the approval-protected `agent-bridge-production-proof` environment. Configure
+`PROOF_SENDER_TOKEN`, `PROOF_RECEIVER_TOKEN`, `PROOF_HOST_SALT`, and `FLY_API_TOKEN` as
+environment secrets. The sender and receiver credentials must bind the requested
+workspace to the dedicated `proof-sender` and `proof-receiver` principals. The
+sender credential needs `messages:write` and `messages:read`. The receiver needs
+`messages:read`, `deliveries:claim`, `deliveries:settle`, and `deliveries:read`.
+
+Run the workflow only when the Fly app has exactly one gateway machine. The cycle job
+restarts that machine and queries the Fly Machines API before and after. It fails
+unless the machine ID stays fixed, the runtime `instance_id` changes, the machine
+returns to `started`, and `/readyz` succeeds. This changes production compute and
+requires environment approval. It does not migrate the database or change secrets.
+
+The sender first uses an unreachable loopback origin to force a leased publication
+into its private SQLite outbox. It then synchronizes that row to the supplied gateway
+and repeats the publication with the same idempotency key. A separate host finds the
+exact message through `proof-receiver`, claims its delivery, and acknowledges it.
+After the Fly machine cycle, the verifier uses a fresh instance key, edge database,
+and cursor. It reads the immutable message and confirms that the prior delivery is
+still `acked`.
+
+Each phase writes an `agent-bridge-production-proof-v1` receipt. The runner rejects
+unknown fields at the phase boundary and checks every receipt before use. Receipts may
+record IDs, timestamps, principal and workspace labels, the gateway origin, boolean
+checks, and salted SHA-256 host evidence. They never record bearer values, database
+URLs, environment values, message content, lease tokens, cursor files, or edge
+databases. Download all four workflow artifacts for the operator record. A passing
+repository test still does not replace a completed external workflow run.
+
 ### Persistent data and backup
 
 A database volume or managed PostgreSQL disk keeps runtime state. It does not protect

package/llms.txt

@@ -43,7 +43,7 @@ services can call the CLI or HTTPS API or embed the Node library without a host
 - `agent-bridge doctor`: active named checks; exits 0 ok, 2 degraded, 1 failed. Blocked outbox rows cannot be healthy.
 - agent-bridge pending
 - agent-bridge send, inbox, history, acknowledge
-- agent-bridge claim, extend, ack, nack, deliveries, delivery-events, cancel, requeue
+- agent-bridge claim [--message-id <uuid>], extend, ack, nack, deliveries, delivery-events, cancel, requeue
 - agent-bridge sync, watch, join, presence
 - agent-bridge clients install <runtime> --identity <principal>
 - agent-bridge clients inspect <runtime> --identity <principal> --instance <stable-key> --backend-config <absolute path>
@@ -131,6 +131,7 @@ one logical authority across restore but does not fence a live clone.
 
 Compatibility: post_context, get_context, ack_context.
 Reliable messaging: send, history, claim, extend, acknowledge, negative_acknowledge, heartbeat, presence, sync.
+Claim selects the next due delivery unless HTTP 2.1, MCP, or CLI supplies one messageId. The exact form atomically selects and maintains only that eligible recipient delivery. HTTP 2.0 rejects the additive field.
 Publisher delivery intent: `deliveryPolicy` mode `mailbox|leased` with `maxAttempts`, `retryBaseDelayMs`, `retryMaxDelayMs`, `retryJitterRatio`, and optional `notBefore`. MCP delivery controls: `list_deliveries`, `list_delivery_events`, `cancel_delivery`, `requeue_delivery`. Consumer `maxAttempts` and `retryPolicy` are validated but ignored for one compatibility release.
 
 Gateway MCP clients sync automatically and expose manual sync for bounded outbox replay and inbox cache refresh. Offline unacknowledged results are degraded candidates with unknown acknowledgement state, not proof that messages are unread or that no remote work exists.

package/openapi/agent-bridge-v2.openapi.json

@@ -4776,7 +4776,7 @@
     "/v2/deliveries/claim": {
       "post": {
         "operationId": "claim_delivery",
-        "summary": "Atomically claim the next targeted delivery.",
+        "summary": "Atomically claim the next targeted delivery, or one eligible message when requested.",
         "security": [
           {
             "bearerAuth": []
@@ -4810,6 +4810,10 @@
                   "leaseMs": {
                     "type": "number"
                   },
+                  "messageId": {
+                    "type": "string",
+                    "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+                  },
                   "maxAttempts": {
                     "type": "number"
                   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@creatornader/agent-bridge",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Durable, pull-first mailbox and work-delivery control plane for AI agents across runtimes, sessions, and machines.",
   "type": "module",
   "license": "Apache-2.0",
@@ -90,6 +90,10 @@
     "test:postgres:contract": "vitest run test/postgres_integration.test.ts --maxWorkers=1 --hookTimeout=60000",
     "test:postgres:preflight": "node scripts/postgres-preflight.mjs",
     "test:postgres:preflight:full": "node scripts/postgres-preflight.mjs --full",
+    "preflight:postgres:production": "npm run build --silent && node dist/postgres-production-preflight.js",
+    "preflight:fly": "node scripts/fly-production-preflight.mjs",
+    "proof:gateway:production": "node scripts/gateway-production-proof.mjs",
+    "test:gateway:production-proof": "vitest run test/gateway-production-proof.test.ts",
     "test:windows:contract": "vitest run test/private-path.test.ts test/windows-native-smoke.test.ts --maxWorkers=1 --testTimeout=180000 -t \"applies and verifies native Windows file and directory ACLs|recovers an (enrollment|client-operation) subsystem lock\" && vitest run test/client-maintenance.test.ts --maxWorkers=1 --testTimeout=180000",
     "typecheck": "tsc --noEmit",
     "contracts:generate": "npm run build --silent && npm run contracts:generate:built",

package/schemas/agent-bridge-v2.capabilities.json

@@ -747,7 +747,7 @@
     },
     {
       "id": "claim_delivery",
-      "summary": "Atomically claim the next targeted delivery.",
+      "summary": "Atomically claim the next targeted delivery, or one eligible message when requested.",
       "mcp": {
         "name": "claim"
       },
@@ -759,6 +759,7 @@
         "command": "claim",
         "options": [
           "lease-ms",
+          "message-id",
           "max-attempts"
         ],
         "outputSchema": {

package/schemas/agent-bridge-v2.mcp.json

@@ -633,13 +633,17 @@
     },
     {
       "name": "claim",
-      "description": "Atomically claim the next targeted delivery.",
+      "description": "Atomically claim the next targeted delivery, or one eligible message when requested.",
       "inputSchema": {
         "type": "object",
         "properties": {
           "leaseMs": {
             "type": "number"
           },
+          "messageId": {
+            "type": "string",
+            "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+          },
           "maxAttempts": {
             "type": "number"
           }

package/schemas/agent-bridge-v2.schema.json

@@ -2446,6 +2446,10 @@
         "leaseMs": {
           "type": "number"
         },
+        "messageId": {
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
         "maxAttempts": {
           "type": "number"
         }

package/sql/migrations/007_runtime_role.sql

@@ -12,10 +12,14 @@ begin
       role_name
     );
   end if;
-  execute format(
-    'alter role %I nologin nosuperuser nocreatedb nocreaterole noreplication nobypassrls',
-    role_name
-  );
+  if exists (
+    select 1 from pg_roles where rolname=role_name and (
+      rolcanlogin or not rolinherit or rolsuper or rolcreatedb or rolcreaterole
+      or rolreplication or rolbypassrls or rolconnlimit<>-1
+    )
+  ) then
+    raise exception 'Agent Bridge runtime role has unsafe attributes';
+  end if;
   execute format('revoke all on schema agent_bridge from %I', role_name);
   execute format('revoke all on all tables in schema agent_bridge from %I', role_name);
   execute format('revoke all on all sequences in schema agent_bridge from %I', role_name);

package/sql/migrations/013_row_isolation.sql

@@ -17,11 +17,73 @@ begin
         role_name
       );
     end if;
-    execute format(
-      'alter role %I nologin nosuperuser nocreatedb nocreaterole noreplication nobypassrls',
-      role_name
-    );
-    execute format('grant %I to %I with admin option',role_name,current_user);
+    if exists (
+      select 1 from pg_roles where rolname=role_name and (
+        rolcanlogin or not rolinherit or rolsuper or rolcreatedb or rolcreaterole
+        or rolreplication or rolbypassrls or rolconnlimit<>-1
+      )
+    ) then
+      raise exception 'Agent Bridge row-isolation role % has unsafe attributes',role_name;
+    end if;
+    if current_setting('server_version_num')::integer>=160000 then
+      if not exists (
+        select 1 from pg_catalog.pg_auth_members membership
+        join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+        join pg_catalog.pg_roles member on member.oid=membership.member
+        where granted.rolname=role_name and member.rolname=current_user
+          and membership.admin_option
+      ) then
+        execute format(
+          'grant %I to %I with admin true,inherit true,set true',role_name,current_user
+        );
+      elsif not exists (
+        select 1 from pg_catalog.pg_auth_members membership
+        join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+        join pg_catalog.pg_roles member on member.oid=membership.member
+        where granted.rolname=role_name and member.rolname=current_user
+          and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+          and coalesce((to_jsonb(membership)->>'set_option')::boolean,true)
+      ) then
+        execute format('grant %I to %I with inherit true,set true',role_name,current_user);
+      end if;
+    elsif not exists (
+      select 1 from pg_catalog.pg_auth_members membership
+      join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+      join pg_catalog.pg_roles member on member.oid=membership.member
+      where granted.rolname=role_name and member.rolname=current_user
+        and membership.admin_option
+    ) then
+      execute format('grant %I to %I with admin option',role_name,current_user);
+    end if;
+    if not exists (
+      select 1 from pg_catalog.pg_auth_members membership
+      join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+      join pg_catalog.pg_roles member on member.oid=membership.member
+      where granted.rolname=role_name and member.rolname=current_user
+        and membership.admin_option
+    ) or not exists (
+      select 1 from pg_catalog.pg_auth_members membership
+      join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+      join pg_catalog.pg_roles member on member.oid=membership.member
+      where granted.rolname=role_name and member.rolname=current_user
+        and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+        and coalesce((to_jsonb(membership)->>'set_option')::boolean,true)
+    ) or exists (
+      select 1 from pg_catalog.pg_auth_members membership
+      join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+      join pg_catalog.pg_roles member on member.oid=membership.member
+      where granted.rolname=role_name and member.rolname=current_user
+        and not (
+          (membership.grantor=10 and membership.admin_option
+            and not coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+            and not coalesce((to_jsonb(membership)->>'set_option')::boolean,true))
+          or (membership.grantor=member.oid
+            and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+            and coalesce((to_jsonb(membership)->>'set_option')::boolean,true))
+        )
+    ) then
+      raise exception 'Agent Bridge row-isolation role % has unsafe owner authority',role_name;
+    end if;
   end loop;
 end
 $roles$;
@@ -292,7 +354,8 @@ declare
   event_writer text := 'agent_bridge_event_writer_' || suffix;
   table_name text;
 begin
-  execute format('grant usage on schema agent_bridge to %I',data_owner);
+  execute format('grant usage,create on schema agent_bridge to %I,%I,%I',
+    data_owner,context_reader,event_writer);
   foreach table_name in array array[
     'messages','receipts','deliveries','delivery_events','agent_instances'
   ] loop
@@ -301,9 +364,9 @@ begin
   execute format('alter function agent_bridge.current_request_workspace() owner to %I',context_reader);
   execute format('alter function agent_bridge.current_request_principal() owner to %I',context_reader);
   execute format('alter function agent_bridge.record_delivery_event() owner to %I',event_writer);
-  execute format('grant usage on schema agent_bridge to %I',context_reader);
+  execute format('revoke create on schema agent_bridge from %I,%I,%I',
+    data_owner,context_reader,event_writer);
   execute format('grant select on agent_bridge.request_authorities to %I',context_reader);
-  execute format('grant usage on schema agent_bridge to %I',event_writer);
   execute format('grant insert on agent_bridge.delivery_events to %I',event_writer);
   execute format('grant usage on sequence agent_bridge.delivery_events_sequence_seq to %I',event_writer);
 end

package/sql/migrations/014_owner_control_plane.sql

@@ -18,11 +18,73 @@ begin
         role_name
       );
     end if;
-    execute format(
-      'alter role %I nologin nosuperuser nocreatedb nocreaterole noreplication nobypassrls',
-      role_name
-    );
-    execute format('grant %I to %I with admin option',role_name,current_user);
+    if exists (
+      select 1 from pg_roles where rolname=role_name and (
+        rolcanlogin or not rolinherit or rolsuper or rolcreatedb or rolcreaterole
+        or rolreplication or rolbypassrls or rolconnlimit<>-1
+      )
+    ) then
+      raise exception 'Agent Bridge control role % has unsafe attributes',role_name;
+    end if;
+    if current_setting('server_version_num')::integer>=160000 then
+      if not exists (
+        select 1 from pg_catalog.pg_auth_members membership
+        join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+        join pg_catalog.pg_roles member on member.oid=membership.member
+        where granted.rolname=role_name and member.rolname=current_user
+          and membership.admin_option
+      ) then
+        execute format(
+          'grant %I to %I with admin true,inherit true,set true',role_name,current_user
+        );
+      elsif not exists (
+        select 1 from pg_catalog.pg_auth_members membership
+        join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+        join pg_catalog.pg_roles member on member.oid=membership.member
+        where granted.rolname=role_name and member.rolname=current_user
+          and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+          and coalesce((to_jsonb(membership)->>'set_option')::boolean,true)
+      ) then
+        execute format('grant %I to %I with inherit true,set true',role_name,current_user);
+      end if;
+    elsif not exists (
+      select 1 from pg_catalog.pg_auth_members membership
+      join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+      join pg_catalog.pg_roles member on member.oid=membership.member
+      where granted.rolname=role_name and member.rolname=current_user
+        and membership.admin_option
+    ) then
+      execute format('grant %I to %I with admin option',role_name,current_user);
+    end if;
+    if not exists (
+      select 1 from pg_catalog.pg_auth_members membership
+      join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+      join pg_catalog.pg_roles member on member.oid=membership.member
+      where granted.rolname=role_name and member.rolname=current_user
+        and membership.admin_option
+    ) or not exists (
+      select 1 from pg_catalog.pg_auth_members membership
+      join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+      join pg_catalog.pg_roles member on member.oid=membership.member
+      where granted.rolname=role_name and member.rolname=current_user
+        and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+        and coalesce((to_jsonb(membership)->>'set_option')::boolean,true)
+    ) or exists (
+      select 1 from pg_catalog.pg_auth_members membership
+      join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+      join pg_catalog.pg_roles member on member.oid=membership.member
+      where granted.rolname=role_name and member.rolname=current_user
+        and not (
+          (membership.grantor=10 and membership.admin_option
+            and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+              =coalesce((to_jsonb(membership)->>'set_option')::boolean,true))
+          or (membership.grantor=member.oid
+            and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+            and coalesce((to_jsonb(membership)->>'set_option')::boolean,true))
+        )
+    ) then
+      raise exception 'Agent Bridge control role % has unsafe owner authority',role_name;
+    end if;
   end loop;
 end
 $roles$;
@@ -144,27 +206,38 @@ begin
     where event.member_role=session_user and event.control_role in ('operator','auditor')
     order by event.control_role,event.sequence desc
   ), direct_membership as (
-    select granted.rolname control_role,membership.admin_option,
-      coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true) inherit_option,
-      coalesce((to_jsonb(membership)->>'set_option')::boolean,true) set_option,
-      grantor.rolname grantor_role
+    select granted.rolname control_role,
+      bool_or(membership.admin_option) admin_option,
+      bool_or(coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)) inherit_option,
+      bool_or(coalesce((to_jsonb(membership)->>'set_option')::boolean,true)) set_option,
+      bool_and(case when member.rolname=schema_owner then
+        (membership.grantor=10 and membership.admin_option
+          and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+            =coalesce((to_jsonb(membership)->>'set_option')::boolean,true))
+        or (membership.grantor=member.oid
+          and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+          and coalesce((to_jsonb(membership)->>'set_option')::boolean,true))
+      else membership.grantor=(select oid from pg_catalog.pg_roles where rolname=schema_owner)
+        and not membership.admin_option
+        and coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true)
+        and coalesce((to_jsonb(membership)->>'set_option')::boolean,true) end) grants_valid
     from pg_catalog.pg_auth_members membership
     join pg_catalog.pg_roles granted on granted.oid=membership.roleid
     join pg_catalog.pg_roles member on member.oid=membership.member
-    join pg_catalog.pg_roles grantor on grantor.oid=membership.grantor
     where member.rolname=session_user and granted.rolname in (operator_role,auditor_role)
+    group by granted.rolname
   )
   select
     coalesce(bool_or(membership.control_role=operator_role
       and membership.inherit_option and membership.set_option
-      and membership.grantor_role=schema_owner and (
+      and membership.grants_valid and (
         (session_user=schema_owner and membership.admin_option)
         or (latest.control_role='operator' and latest.action='register'
           and not membership.admin_option)
       )),false),
     coalesce(bool_or(membership.control_role=auditor_role
       and membership.inherit_option and membership.set_option
-      and membership.grantor_role=schema_owner and (
+      and membership.grants_valid and (
         (session_user=schema_owner and membership.admin_option)
         or (latest.control_role='auditor' and latest.action='register'
           and not membership.admin_option)
@@ -937,15 +1010,15 @@ language sql stable set search_path = '' set timezone = 'UTC' as $$
     from pg_catalog.pg_roles role where role.rolname in (select role_name from control_roles)
     union all
     select 'membership',granted.rolname||'->'||member.rolname,
-      grantor.rolname||':'||membership.admin_option::text||':'||
-        coalesce(to_jsonb(membership)->>'inherit_option','')||':'||
-        coalesce(to_jsonb(membership)->>'set_option','')
+      bool_or(membership.admin_option)::text||':'||
+        bool_or(coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true))::text||':'||
+        bool_or(coalesce((to_jsonb(membership)->>'set_option')::boolean,true))::text
     from pg_catalog.pg_auth_members membership
     join pg_catalog.pg_roles granted on granted.oid=membership.roleid
     join pg_catalog.pg_roles member on member.oid=membership.member
-    join pg_catalog.pg_roles grantor on grantor.oid=membership.grantor
     where member.rolname in (select role_name from control_roles)
       or granted.rolname=(select owner_role from names)
+    group by granted.rolname,member.rolname
     union all
     select 'schema',namespace.nspname,pg_catalog.pg_get_userbyid(namespace.nspowner)
     from pg_catalog.pg_namespace namespace where namespace.nspname='agent_bridge'
@@ -1106,27 +1179,42 @@ returns boolean language sql stable security definer set search_path = '' as $$
   ), active_registry as (
     select member_role,control_role from latest_registry where action='register'
   ), expected_memberships as (
-    select names.owner_role granted_role,names.schema_owner member_role,true admin_option
+    select names.owner_role granted_role,names.schema_owner member_role,
+      true admin_option,true inherit_option,true set_option
       from names
-    union all select names.operator_role,names.schema_owner,true from names
-    union all select names.auditor_role,names.schema_owner,true from names
+    union all select names.operator_role,names.schema_owner,true,true,true from names
+    union all select names.auditor_role,names.schema_owner,true,true,true from names
     union all
     select case registry.control_role when 'operator' then names.operator_role
-      else names.auditor_role end,registry.member_role,false
+      else names.auditor_role end,registry.member_role,false,true,true
     from active_registry registry cross join names
-  ), actual_memberships as (
+  ), raw_memberships as (
     select granted.rolname::name granted_role,member.rolname::name member_role,
       membership.admin_option,
       coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true) inherit_option,
       coalesce((to_jsonb(membership)->>'set_option')::boolean,true) set_option,
-      grantor.rolname::name grantor_role
+      membership.grantor,member.oid member_oid
     from pg_catalog.pg_auth_members membership
     join pg_catalog.pg_roles granted on granted.oid=membership.roleid
     join pg_catalog.pg_roles member on member.oid=membership.member
-    join pg_catalog.pg_roles grantor on grantor.oid=membership.grantor
     where granted.rolname in (
       (select owner_role from names),(select operator_role from names),(select auditor_role from names)
     )
+  ), actual_memberships as (
+    select membership.granted_role,membership.member_role,
+      bool_or(membership.admin_option) admin_option,
+      bool_or(membership.inherit_option) inherit_option,
+      bool_or(membership.set_option) set_option,
+      bool_and(case when membership.member_role=names.schema_owner then
+        (membership.grantor=10 and membership.admin_option
+          and membership.inherit_option=membership.set_option)
+        or (membership.grantor=membership.member_oid
+          and membership.inherit_option and membership.set_option)
+      else membership.grantor=(select oid from pg_catalog.pg_roles where rolname=names.schema_owner)
+        and not membership.admin_option
+        and membership.inherit_option and membership.set_option end) grants_valid
+    from raw_memberships membership cross join names
+    group by membership.granted_role,membership.member_role
   ), authority_closure as (
     select control_role.granted_role,candidate.rolname::name member_role
     from names
@@ -1145,16 +1233,14 @@ returns boolean language sql stable security definer set search_path = '' as $$
     ) from agent_bridge.owner_control_attestations attestation
       where attestation.name='owner-control-v1')
     and not exists (
-      (select granted_role,member_role,admin_option from actual_memberships
-       except select granted_role,member_role,admin_option from expected_memberships)
+      (select granted_role,member_role,admin_option,inherit_option,set_option from actual_memberships
+       except select granted_role,member_role,admin_option,inherit_option,set_option from expected_memberships)
       union all
-      (select granted_role,member_role,admin_option from expected_memberships
-       except select granted_role,member_role,admin_option from actual_memberships)
+      (select granted_role,member_role,admin_option,inherit_option,set_option from expected_memberships
+       except select granted_role,member_role,admin_option,inherit_option,set_option from actual_memberships)
     )
     and not exists (
-      select 1 from actual_memberships membership,names
-      where not membership.inherit_option or not membership.set_option
-        or membership.grantor_role<>names.schema_owner
+      select 1 from actual_memberships membership where not membership.grants_valid
     )
     and not exists (
       select 1 from active_registry registry
@@ -1216,6 +1302,7 @@ declare
   membership_record record;
   relation_record record;
 begin
+  execute format('grant usage,create on schema agent_bridge to %I',owner_role);
   execute format('alter table agent_bridge.control_requests owner to %I',owner_role);
   execute format('alter table agent_bridge.control_events owner to %I',owner_role);
   execute format('alter table agent_bridge.owner_control_attestations owner to %I',owner_role);
@@ -1230,6 +1317,7 @@ begin
     'control_revoke_credential(uuid,uuid,text)','owner_control_catalog_definition()',
     'owner_control_plane_ready()'
   ] loop execute format('alter function agent_bridge.%s owner to %I',role_name,owner_role); end loop;
+  execute format('revoke create on schema agent_bridge from %I',owner_role);
 
   for membership_record in
     select granted.rolname granted_name,member.rolname member_name
@@ -1287,7 +1375,7 @@ begin
   execute format('grant usage on schema agent_bridge to %I,%I,%I',owner_role,operator_role,auditor_role);
   execute format('grant select,insert,update(request_id) on agent_bridge.control_requests to %I',owner_role);
   execute format('grant insert on agent_bridge.control_events to %I',owner_role);
-  execute format('grant select on agent_bridge.owner_control_attestations to %I',owner_role);
+  execute format('grant select,insert on agent_bridge.owner_control_attestations to %I',owner_role);
   execute format('grant select,insert on agent_bridge.control_membership_events to %I',owner_role);
   execute format('grant usage on sequence agent_bridge.control_events_sequence_seq to %I',owner_role);
   execute format('grant usage on sequence agent_bridge.control_membership_events_sequence_seq to %I',owner_role);
@@ -1306,6 +1394,7 @@ begin
   execute format('grant execute on function agent_bridge.control_revoke_credential(uuid,uuid,text) to %I',operator_role);
   execute format('grant execute on function agent_bridge.control_credential_inventory(text,timestamp with time zone,uuid,integer) to %I,%I',operator_role,auditor_role);
   execute format('grant execute on function agent_bridge.owner_control_plane_ready() to %I',runtime_role);
+  execute format('grant execute on function agent_bridge.owner_control_plane_ready() to %I',current_user);
   execute format('revoke execute on function agent_bridge.replace_credential(uuid,character,text[],text,text,timestamp with time zone,timestamp with time zone,text,uuid) from %I,%I,%I',operator_role,auditor_role,runtime_role);
   execute format('revoke execute on function agent_bridge.revoke_credential(uuid,text,text,uuid) from %I,%I,%I',operator_role,auditor_role,runtime_role);
   foreach role_name in array array['anon','authenticated'] loop
@@ -1632,8 +1721,12 @@ begin
 end
 $preflight$;
 
+select set_config(
+  'role','agent_bridge_control_owner_'||substr(md5(current_database()),1,16),false
+);
 insert into agent_bridge.owner_control_attestations(name,catalog_definition)
 values('owner-control-v1',agent_bridge.owner_control_catalog_definition());
+reset role;
 
 insert into agent_bridge.schema_migrations(version,name,checksum)
 values(14,'owner_control_plane','__AGENT_BRIDGE_MIGRATION_CHECKSUM__');