@consiliency/agent-board-schema 1.10.0 → 1.22.0

package/migrations/20260826000100_agent_board_fleet_machine_reactivation.sql

@@ -0,0 +1,514 @@
+-- #146 operator machine reactivation — supersede-based un-revoke.
+--
+-- #141 (PR #145) correctly made machine revocation TERMINAL via re-register: a
+-- re-enrollment no longer clears lifecycle_state/revoked_at, because revocation
+-- authority lives in the append-only agent_board.fleet_revocation_events ledger that
+-- evaluate_fleet_sender_policy reads. The side effect (issue #146) is that there was
+-- NO authorized path to bring a legitimately-revoked machine back: setting
+-- lifecycle_state='active' alone does not restore authority, because the machine's
+-- revocation EVENT still exists and the policy denies on its mere presence.
+--
+-- Reactivation therefore has to SUPERSEDE the prior revocation event(s) for the machine
+-- rather than delete them (the ledger stays append-only). We stamp a supersession point
+-- on the machine row (reactivated_at) and teach the policy's MACHINE-revocation clause to
+-- ignore machine events that are at-or-before that point. A LATER revocation event
+-- (effective_at > reactivated_at) still denies, so a re-revocation after reactivation is
+-- honored; and reactivation supersedes ONLY the machine subject — a revoked trust_domain
+-- or a revoked sender agent stays denied (those clauses are unchanged).
+--
+-- MAINTAINER DECISION (locked): reactivation is OPERATOR-ONLY (service_role). An owner
+-- cannot self-reactivate — a revocation may be a deliberate security response, so undoing
+-- it is an operator action. reactivate_fleet_machine raises 42501 for any non-service_role
+-- caller (and is granted only to service_role — #118 discipline).
+--
+-- SCOPE: machine reactivation only. The fingerprint-SQUATTING reclaim (a never-owned
+-- fingerprint pre-registered by a squatter → ownership arbitration) is a DIFFERENT
+-- mechanism and remains open #146 work — NOT built here.
+
+-- (1) Supersession marker. Nullable: null means "never reactivated" (all prior machine
+-- events apply). Set to now() on each reactivation.
+alter table agent_board.fleet_machines
+  add column if not exists reactivated_at timestamptz;
+
+comment on column agent_board.fleet_machines.reactivated_at is
+  'Supersession point (#146): machine-revocation events with effective_at <= this are ignored by evaluate_fleet_sender_policy. Set by reactivate_fleet_machine; null means never reactivated.';
+
+-- (2) Operator-only reactivation RPC. Reconciles the machine row (active, revoked_at=null,
+-- reactivated_at=now()) so the supersession clause in the policy lets it send again. Does
+-- NOT write to the append-only ledger — supersession is by timestamp, not by a compensating
+-- event (there is no 'reactivation' subject_kind).
+create or replace function agent_board.reactivate_fleet_machine(
+  p_machine_id uuid,
+  p_reactivated_by_agent_id uuid default null,
+  p_reactivation_reason text default null
+)
+returns table(machine_id uuid, lifecycle_state text, reactivated_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_machine agent_board.fleet_machines%rowtype;
+  v_is_revoked boolean;
+begin
+  -- Operator-only: an owner cannot self-reactivate (revocation may be a security response).
+  if not agent_board._is_service_role() then
+    raise exception 'reactivate_fleet_machine is operator-only (service_role)' using errcode = '42501';
+  end if;
+
+  -- Provenance is required and must name a real agent (audit lands in metadata).
+  if p_reactivated_by_agent_id is null then
+    raise exception 'p_reactivated_by_agent_id is required' using errcode = '22023';
+  end if;
+  if not exists (
+    select 1 from agent_board.agents a where a.id = p_reactivated_by_agent_id
+  ) then
+    raise exception 'p_reactivated_by_agent_id is not a known agent' using errcode = '22023';
+  end if;
+
+  -- MUST-FIX 3 (#146 panel, concurrency): lock the machine row so this whole
+  -- read-decide-write serializes against a concurrent revoke_fleet_subject (whose
+  -- fleet_machines UPDATE also takes a row lock). Without the lock the still-revoked
+  -- re-check below could act on a stale snapshot and the unconditional UPDATE could
+  -- silently overwrite a revoke that committed mid-operation. With it, a revoke and a
+  -- reactivate on the same machine serialize deterministically (last-writer-wins is
+  -- coherent) and a revoke cannot be dropped.
+  select * into v_machine from agent_board.fleet_machines fm where fm.id = p_machine_id for update;
+  if v_machine.id is null then
+    raise exception 'fleet machine not found' using errcode = '22023';
+  end if;
+
+  -- Must currently be revoked (re-checked UNDER the row lock): lifecycle_state='revoked'
+  -- OR a machine-revocation event newer than the last supersession point. Otherwise there
+  -- is nothing to reactivate.
+  v_is_revoked := v_machine.lifecycle_state = 'revoked'
+    or exists (
+      select 1
+        from agent_board.fleet_revocation_events fre
+       where fre.subject_kind = 'machine'
+         and fre.subject_id = v_machine.id
+         and fre.effective_at > coalesce(v_machine.reactivated_at, '-infinity'::timestamptz)
+    );
+
+  if not v_is_revoked then
+    raise exception 'fleet machine is not revoked; nothing to reactivate' using errcode = '22023';
+  end if;
+
+  update agent_board.fleet_machines fm
+     set lifecycle_state = 'active',
+         revoked_at = null,
+         reactivated_at = now(),
+         metadata = coalesce(fm.metadata, '{}'::jsonb)
+           || jsonb_build_object(
+                'reactivated_by', p_reactivated_by_agent_id,
+                'reactivation_reason', nullif(trim(coalesce(p_reactivation_reason, '')), ''),
+                'reactivated_at', now()
+              )
+           || jsonb_build_object('redacted', true, 'metadata-safe', true),
+         updated_at = now()
+   where fm.id = p_machine_id
+  returning * into v_machine;
+
+  return query select v_machine.id, v_machine.lifecycle_state, v_machine.reactivated_at;
+end;
+$$;
+
+-- (3) Policy: reproduce evaluate_fleet_sender_policy VERBATIM except the MACHINE clause of
+-- the revocation existence check, which now honors reactivated_at. The trust_domain and
+-- agent clauses are UNCHANGED — reactivating a machine must NOT un-revoke its domain or the
+-- sender agent. The lifecycle_state='revoked' guard is kept (reactivate sets it active).
+create or replace function agent_board.evaluate_fleet_sender_policy(
+  p_sender_agent_id uuid,
+  p_recipient_agent_id uuid,
+  p_sender_machine_id uuid default null,
+  p_recipient_board_id uuid default null,
+  p_operation text default 'send_direct_message',
+  p_signature_evidence_id uuid default null,
+  p_direct_rpc_compatibility boolean default false
+)
+returns table(
+  allowed boolean,
+  actionable boolean,
+  denial_class text,
+  receive_policy_id uuid,
+  trust_domain_id uuid,
+  trust_set_id uuid,
+  requires_signature boolean,
+  evaluated_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_machine agent_board.fleet_machines%rowtype;
+  v_binding agent_board.fleet_machine_agents%rowtype;
+  v_policy agent_board.fleet_receive_policies%rowtype;
+  v_trust_set agent_board.fleet_trust_sets%rowtype;
+  v_signature agent_board.signature_evidence%rowtype;
+  v_actor_agent_id uuid;
+  v_action text;
+  v_denial text;
+begin
+  if not agent_board._is_service_role() then
+    v_actor_agent_id := agent_board.current_agent_id();
+    if v_actor_agent_id is null
+       or (v_actor_agent_id <> p_sender_agent_id and v_actor_agent_id <> p_recipient_agent_id) then
+      raise exception 'fleet policy evaluation must involve current_agent_id()' using errcode = '42501';
+    end if;
+  end if;
+
+  select fma.*
+    into v_binding
+    from agent_board.fleet_machine_agents fma
+    join agent_board.fleet_machines fm on fm.id = fma.machine_id
+   where fma.agent_id = p_sender_agent_id
+     and fma.lifecycle_state = 'active'
+     and fm.lifecycle_state = 'active'
+     and (p_sender_machine_id is null or fma.machine_id = p_sender_machine_id)
+   order by fma.updated_at desc
+   limit 1;
+
+  if v_binding.id is not null then
+    select * into v_machine from agent_board.fleet_machines where id = v_binding.machine_id;
+  elsif p_sender_machine_id is not null then
+    select * into v_machine from agent_board.fleet_machines where id = p_sender_machine_id;
+  end if;
+
+  if v_machine.id is null then
+    return query select false, false, 'domain_denied'::text, null::uuid, null::uuid, null::uuid, false, now();
+    return;
+  end if;
+
+  if v_machine.lifecycle_state = 'revoked'
+     or exists (
+       select 1 from agent_board.fleet_revocation_events fre
+        where (fre.subject_kind = 'machine' and fre.subject_id = v_machine.id
+               and fre.effective_at > coalesce(v_machine.reactivated_at, '-infinity'::timestamptz))
+           or (fre.subject_kind = 'trust_domain' and fre.subject_id = v_machine.trust_domain_id)
+           or (fre.subject_kind = 'agent' and fre.subject_id = p_sender_agent_id)
+     ) then
+    return query select false, false, 'machine_revoked'::text, null::uuid, v_machine.trust_domain_id, null::uuid, false, now();
+    return;
+  end if;
+
+  select frp.*
+    into v_policy
+    from agent_board.fleet_receive_policies frp
+   where frp.lifecycle_state = 'active'
+     and (frp.recipient_agent_id is null or frp.recipient_agent_id = p_recipient_agent_id)
+     and (frp.board_id is null or frp.board_id = p_recipient_board_id)
+     and (frp.trust_domain_id is null or frp.trust_domain_id = v_machine.trust_domain_id)
+   order by
+     case when frp.board_id is not null then 0 else 1 end,
+     case when frp.trust_domain_id is not null then 0 else 1 end,
+     frp.updated_at desc
+   limit 1;
+
+  if v_policy.id is null then
+    return query select false, false, 'recipient_policy_denied'::text, null::uuid, v_machine.trust_domain_id, null::uuid, false, now();
+    return;
+  end if;
+
+  if v_policy.require_signed_sender then
+    if p_signature_evidence_id is null then
+      return query select false, false, 'signature_required'::text, v_policy.id, v_machine.trust_domain_id, null::uuid, true, now();
+      return;
+    end if;
+
+    select * into v_signature from agent_board.signature_evidence where id = p_signature_evidence_id;
+    if v_signature.id is null or v_signature.agent_id <> p_sender_agent_id then
+      return query select false, false, 'signature_required'::text, v_policy.id, v_machine.trust_domain_id, null::uuid, true, now();
+      return;
+    end if;
+
+    if v_signature.failure_class = 'key_revoked'
+       or exists (
+         select 1
+           from agent_board.fleet_revocation_events fre
+          where fre.subject_kind = 'signing_key'
+            and fre.subject_id = v_signature.signing_key_id
+       )
+       or exists (
+         select 1
+           from agent_board.agent_signing_keys ask
+          where ask.id = v_signature.signing_key_id
+            and ask.status in ('revoked', 'compromised')
+       ) then
+      return query select false, false, 'key_revoked'::text, v_policy.id, v_machine.trust_domain_id, null::uuid, true, now();
+      return;
+    end if;
+
+    if v_signature.verification_status not in ('verified', 'warn', 'observed') then
+      return query select false, false, 'signature_required'::text, v_policy.id, v_machine.trust_domain_id, null::uuid, true, now();
+      return;
+    end if;
+  end if;
+
+  select fts.*
+    into v_trust_set
+    from agent_board.fleet_trust_sets fts
+   where fts.receive_policy_id = v_policy.id
+     and fts.lifecycle_state = 'active'
+     and (
+       fts.trust_domain_id = v_machine.trust_domain_id
+       or fts.machine_id = v_machine.id
+       or fts.agent_id = p_sender_agent_id
+       or (v_binding.repo_scope_id is not null and fts.repo_scope_id = v_binding.repo_scope_id)
+       or exists (
+         select 1
+           from agent_board.fleet_repo_scopes frs
+          where frs.id = v_binding.repo_scope_id
+            and fts.harness_registration_id = frs.harness_registration_id
+       )
+     )
+   order by
+     case fts.effect
+       when 'deny' then 0
+       when 'quarantine' then 1
+       when 'non_actionable' then 2
+       else 3
+     end,
+     fts.updated_at desc
+   limit 1;
+
+  v_action := coalesce(v_trust_set.effect, v_policy.default_action);
+  v_denial := case
+    when v_action = 'deny' and v_trust_set.id is not null then 'sender_denied'
+    when v_action = 'deny' then 'recipient_policy_denied'
+    when v_action = 'quarantine' then 'quarantined'
+    else null
+  end;
+
+  return query
+  select
+    v_action in ('allow', 'non_actionable'),
+    v_action = 'allow',
+    v_denial,
+    v_policy.id,
+    v_machine.trust_domain_id,
+    v_trust_set.id,
+    v_policy.require_signed_sender,
+    now();
+end;
+$$;
+
+-- #118 discipline: recreating a SECURITY DEFINER function grants EXECUTE to PUBLIC by
+-- default. Restate the revokes/grants and the comments in this same migration.
+revoke all on function agent_board.reactivate_fleet_machine(uuid, uuid, text) from public, anon, authenticated;
+grant execute on function agent_board.reactivate_fleet_machine(uuid, uuid, text) to service_role;
+
+revoke all on function agent_board.evaluate_fleet_sender_policy(uuid, uuid, uuid, uuid, text, uuid, boolean) from public, anon;
+grant execute on function agent_board.evaluate_fleet_sender_policy(uuid, uuid, uuid, uuid, text, uuid, boolean) to authenticated, service_role;
+
+comment on function agent_board.reactivate_fleet_machine(uuid, uuid, text) is
+  'Operator-only (#146): brings a revoked fleet machine back to active by stamping reactivated_at (supersession point) and clearing revoked_at, so evaluate_fleet_sender_policy ignores machine-revocation events at-or-before that point. service_role only (raises 42501 otherwise); never un-revokes the machine''s trust_domain or sender agent; does not write the append-only fleet_revocation_events ledger.';
+
+comment on function agent_board.evaluate_fleet_sender_policy(uuid, uuid, uuid, uuid, text, uuid, boolean) is
+  'Fleet sender-policy evaluation. Machine-revocation clause honors fleet_machines.reactivated_at (#146): machine events at-or-before the supersession point are ignored; trust_domain and agent revocation clauses are unaffected by machine reactivation.';
+
+-- (4) MUST-FIX 1 (#146 panel): keep the append-only ledger AUTHORITATIVE across
+-- re-revocation. revoke_fleet_subject keeps ONE event row per (subject_kind, subject_id)
+-- and its UPDATE branch previously refreshed reason/metadata but NOT effective_at, so a
+-- revoke AFTER a reactivation left effective_at BEFORE reactivated_at — the machine
+-- supersession clause then read the (real) re-revocation as "not revoked", leaving only the
+-- mutable lifecycle_state guard to deny. That inverts #141's principle (authority in the
+-- ledger, not the row). Reproduced VERBATIM except the UPDATE branch now also sets
+-- `effective_at = now()`, so a re-revocation advances the event past reactivated_at and both
+-- the ledger-derived clause and the lifecycle guard deny (2-of-2 depth). #118 grants/comment
+-- restated.
+create or replace function agent_board.revoke_fleet_subject(
+  p_subject_kind text,
+  p_subject_id uuid,
+  p_revoked_by_agent_id uuid,
+  p_revocation_reason text,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(revocation_event_id uuid, subject_kind text, effective_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_event agent_board.fleet_revocation_events%rowtype;
+  v_actor_agent_id uuid;
+begin
+  if p_subject_kind not in ('trust_domain', 'machine', 'harness', 'repo_scope', 'agent', 'signing_key', 'credential') then
+    raise exception 'unsupported fleet revocation subject' using errcode = '22023';
+  end if;
+
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_revoked_by_agent_id, 'p_revoked_by_agent_id');
+
+  if not agent_board._is_service_role() then
+    if p_subject_kind = 'trust_domain' and not exists (
+      select 1 from agent_board.fleet_trust_domains ftd
+       where ftd.id = p_subject_id and ftd.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'trust domain is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'machine' and not exists (
+      select 1 from agent_board.fleet_machines fm
+       where fm.id = p_subject_id and fm.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'machine is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'harness' and not exists (
+      select 1
+        from agent_board.fleet_harness_registrations fhr
+        join agent_board.fleet_machines fm on fm.id = fhr.machine_id
+       where fhr.id = p_subject_id and fm.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'harness is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'repo_scope' and not exists (
+      select 1
+        from agent_board.fleet_repo_scopes frs
+        join agent_board.fleet_harness_registrations fhr on fhr.id = frs.harness_registration_id
+        join agent_board.fleet_machines fm on fm.id = fhr.machine_id
+       where frs.id = p_subject_id and fm.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'repo scope is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'agent' and p_subject_id <> v_actor_agent_id then
+      raise exception 'agent revocation must target current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'signing_key' and not exists (
+      select 1 from agent_board.agent_signing_keys ask
+       where ask.id = p_subject_id and ask.agent_id = v_actor_agent_id
+    ) then
+      raise exception 'signing key is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'credential' and not exists (
+      select 1 from agent_board.agent_credentials ac
+       where ac.id = p_subject_id and ac.agent_id = v_actor_agent_id
+    ) then
+      raise exception 'credential is not owned by current_agent_id()' using errcode = '42501';
+    end if;
+  end if;
+
+  select *
+    into v_event
+    from agent_board.fleet_revocation_events fre
+   where fre.subject_kind = p_subject_kind
+     and fre.subject_id = p_subject_id
+   limit 1;
+
+  if v_event.id is null then
+    insert into agent_board.fleet_revocation_events(
+      subject_kind,
+      subject_id,
+      trust_domain_id,
+      machine_id,
+      harness_registration_id,
+      repo_scope_id,
+      agent_id,
+      signing_key_id,
+      revoked_by_agent_id,
+      revocation_reason,
+      metadata
+    )
+    values (
+      p_subject_kind,
+      p_subject_id,
+      case when p_subject_kind = 'trust_domain' then p_subject_id end,
+      case when p_subject_kind = 'machine' then p_subject_id end,
+      case when p_subject_kind = 'harness' then p_subject_id end,
+      case when p_subject_kind = 'repo_scope' then p_subject_id end,
+      case when p_subject_kind = 'agent' then p_subject_id end,
+      case when p_subject_kind = 'signing_key' then p_subject_id end,
+      p_revoked_by_agent_id,
+      trim(coalesce(p_revocation_reason, 'operator revocation')),
+      coalesce(p_metadata, '{}'::jsonb) || jsonb_build_object('redacted', true, 'metadata-safe', true)
+    )
+    returning * into v_event;
+  else
+    update agent_board.fleet_revocation_events fre
+       set effective_at = now(),
+           revoked_by_agent_id = p_revoked_by_agent_id,
+           revocation_reason = trim(coalesce(p_revocation_reason, 'operator revocation')),
+           metadata = coalesce(p_metadata, '{}'::jsonb) || jsonb_build_object('redacted', true, 'metadata-safe', true)
+     where fre.id = v_event.id
+    returning * into v_event;
+  end if;
+
+  if p_subject_kind = 'trust_domain' then
+    update agent_board.fleet_trust_domains
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'machine' then
+    update agent_board.fleet_machines
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'harness' then
+    update agent_board.fleet_harness_registrations
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'repo_scope' then
+    update agent_board.fleet_repo_scopes
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'agent' then
+    update agent_board.fleet_machine_agents
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where agent_id = p_subject_id;
+  elsif p_subject_kind = 'signing_key' then
+    update agent_board.agent_signing_keys
+       set status = case when status = 'compromised' then status else 'revoked' end,
+           proof_state = 'revoked',
+           revoked_at = coalesce(revoked_at, v_event.effective_at),
+           revoked_by_agent_id = p_revoked_by_agent_id,
+           revocation_reason = trim(coalesce(p_revocation_reason, 'operator revocation')),
+           updated_at = now()
+     where id = p_subject_id;
+  end if;
+
+  return query select v_event.id, v_event.subject_kind, v_event.effective_at;
+end;
+$$;
+
+revoke all on function agent_board.revoke_fleet_subject(text, uuid, uuid, text, jsonb) from public, anon;
+grant execute on function agent_board.revoke_fleet_subject(text, uuid, uuid, text, jsonb) to authenticated, service_role;
+
+comment on function agent_board.revoke_fleet_subject(text, uuid, uuid, text, jsonb) is
+  'Records a fleet revocation into the append-only fleet_revocation_events ledger (one row per subject) and flips the subject''s lifecycle to revoked. Re-revoking a subject advances the event''s effective_at to now() (#146), so a revocation after a reactivation supersedes the reactivation''s reactivated_at and stays authoritative in the ledger.';
+
+-- (5) MUST-FIX 2 (#146 panel): the read model must agree with the policy. v_fleet_machine_status
+-- reported machine_revoked from bare event-existence, so a reactivated machine showed
+-- machine_revoked=true forever while the policy let it send — contradictory state visible to
+-- owners/operators. Apply the SAME supersession predicate the policy uses. Recreated with its
+-- grants restated.
+create or replace view agent_board.v_fleet_machine_status
+with (security_invoker = true)
+as
+select
+  fm.id as machine_id,
+  fm.trust_domain_id,
+  ftd.slug as trust_domain_slug,
+  ftd.domain_kind,
+  fm.owner_agent_id,
+  fm.machine_label,
+  fm.machine_fingerprint,
+  fm.lifecycle_state as machine_lifecycle_state,
+  fm.enrollment_source,
+  fm.enrolled_at,
+  fm.revoked_at,
+  (
+    fm.lifecycle_state = 'revoked'
+    or exists (
+      select 1
+        from agent_board.fleet_revocation_events fre
+       where fre.subject_kind = 'machine'
+         and fre.subject_id = fm.id
+         and fre.effective_at > coalesce(fm.reactivated_at, '-infinity'::timestamptz)
+    )
+  ) as machine_revoked,
+  coalesce(active_agents.active_agent_count, 0)::bigint as active_agent_count,
+  active_agents.latest_agent_binding_updated_at
+from agent_board.fleet_machines fm
+join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+left join lateral (
+  select
+    count(*) filter (where fma.lifecycle_state = 'active') as active_agent_count,
+    max(fma.updated_at) as latest_agent_binding_updated_at
+    from agent_board.fleet_machine_agents fma
+   where fma.machine_id = fm.id
+) active_agents on true;
+
+grant select on agent_board.v_fleet_machine_status to authenticated, service_role;
+
+comment on view agent_board.v_fleet_machine_status is
+  'Machine status read model. machine_revoked honors fleet_machines.reactivated_at (#146): a machine reactivated after its revocation reports machine_revoked=false, agreeing with evaluate_fleet_sender_policy.';