@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/migrations/20260829000100_agent_board_fleet_machine_reclaim.sql

@@ -0,0 +1,432 @@
+-- #146 operator squatting-reclaim — reassign a squatted machine + revoke squatter access.
+--
+-- machine_fingerprint is GLOBALLY unique. #141 (20260823000100) made register_fleet_machine
+-- raise 42501 on a cross-owner fingerprint conflict (ownership is immutable via re-register).
+-- That correctly stops post-registration hijacking, but it also means: if a SQUATTER registers
+-- a victim's fingerprint FIRST, the victim is locked out permanently — the only prior recovery
+-- was service_role table surgery. This migration adds the authorized reclaim path.
+--
+-- Ownership here is ARBITRATION, not self-service: deciding the rightful owner of a contested
+-- fingerprint requires out-of-band verification that only an OPERATOR can perform. So
+-- reclaim_fleet_machine is service_role-only and raises 42501 for any other caller — there is
+-- deliberately no owner-facing or victim-facing self-reclaim (that would just re-create the
+-- squatting race in the other direction).
+--
+-- Reclaim does three things atomically under a row lock:
+--   1. Reassigns owner_agent_id to the arbitrated new owner. This is the ONLY writer besides
+--      register_fleet_machine that changes owner_agent_id (see the comment at the UPDATE).
+--   2. Revokes the SQUATTER's access to THIS machine by flipping every ACTIVE
+--      fleet_machine_agents binding on it to 'revoked'. This is SCOPED to the machine — it is
+--      deliberately NOT revoke_fleet_subject('agent', ...), which is GLOBAL (it flips every one
+--      of that agent's bindings on every machine and writes a subject_kind='agent' ledger row
+--      that evaluate_fleet_sender_policy honors WITHOUT machine scope). A squatter can be an
+--      otherwise-legitimate fleet member; reclaiming one machine must not deny them everywhere.
+--      NOTE (divergence from the task suggestion, on correctness grounds): we do NOT write a
+--      fleet_revocation_events row per revoked binding. fleet_revocation_events has no
+--      binding/machine-agent subject_kind (the enum is trust_domain/machine/harness/repo_scope/
+--      agent/signing_key/credential), and every available subject_kind has a policy side effect
+--      that OVER-denies: 'agent' denies the squatter as a sender on ALL their machines;
+--      'machine' would deny the NEW owner too. For a binding, lifecycle_state IS the authority
+--      by design — BOTH readers that gate the squatter (_can_claim_resource and the policy's
+--      binding lookup) read fma.lifecycle_state='active' directly — so flipping it is the
+--      correct mechanism, not a shortcut around the ledger. The ledger-authority principle from
+--      #141/#146 governs machine/domain/agent subjects, not per-binding access. The reclaim
+--      audit (who/why/prior owner/revoked agents) is recorded on fleet_machines.metadata.
+--   3. Leaves the machine ACTIVE for the new owner. If the squatted machine had been revoked,
+--      reclaim sets lifecycle_state='active', clears revoked_at, and stamps reactivated_at=now()
+--      so any prior machine-revocation event is superseded (same supersession mechanism as
+--      reactivate_fleet_machine, #146) and evaluate_fleet_sender_policy lets the new owner use
+--      it. reclaim does NOT read machine-revocation events itself.
+--
+-- TRUST-DOMAIN KILL SWITCH (#150 panel MUST-FIX). A reclaimed machine still points at its
+-- original trust_domain_id, which the SQUATTER may still OWN. A trust-domain owner can
+-- revoke_fleet_subject('trust_domain', ...) on their own domain (the authenticated domain-owner
+-- path), and evaluate_fleet_sender_policy's trust_domain clause then denies EVERY machine in that
+-- domain — including the reclaimed one. So if reclaim leaves the machine in the squatter's domain,
+-- the squatter retains a kill switch: the new owner can send only until the squatter revokes the
+-- domain. To close it, reclaim takes an OPTIONAL p_new_trust_domain_id:
+--   * When PROVIDED, it is validated (exists, active, owned by the NEW owner) and the machine is
+--     MOVED into it, so the reclaimed machine sits in a domain the new owner controls — the
+--     squatter's domain revocation can no longer reach it.
+--   * When NULL, the machine STAYS in its current (squatter-owned) domain and the squatter RETAINS
+--     the kill switch described above. This is an accepted, DOCUMENTED residual: reclaiming a whole
+--     squatted DOMAIN (and the case where the new owner has no domain to move into) is broader
+--     ownership arbitration filed as a separate follow-up, out of scope here. Operators reclaiming
+--     into a squatter-owned domain should pass p_new_trust_domain_id.
+--
+-- SCOPE / non-goals (matches the issue): reclaim reassigns the MACHINE (owner, and optionally the
+-- trust domain per above). It does NOT revoke the trust domain itself, and does NOT revoke the
+-- machine subject (the new owner keeps it active). Whole-domain squatting arbitration is a separate
+-- follow-up.
+--
+-- #150 codex red-team MUST-FIXes folded in here:
+--   * MUST-FIX 1 — revoke_fleet_subject TOCTOU: its machine-ownership check was unlocked, so a
+--     squatter's concurrent revoke('machine', M) could pass on the pre-reclaim snapshot and land
+--     its lifecycle UPDATE AFTER reclaim, nuking the just-handed-over machine. revoke_fleet_subject
+--     is recreated below to LOCK the owning fleet_machines row before the ownership check (a
+--     concurrent reclaim serializes it; a stale-owner revoke is then refused 42501). Pinned by the
+--     reclaim_revoke_race isolation spec.
+--   * MUST-FIX 2 — a squatter's ACTIVE machine CLAIM survived reclaim (claims key on the bare
+--     fingerprint and reclaim never touched agent_board.claims), so the new owner's acquire_claim
+--     raised 23505 until lease expiry. reclaim now releases the squatter's active machine claim(s)
+--     on the reclaimed fingerprint (step 2b).
+--
+-- #118 discipline: reclaim_fleet_machine (and the recreated revoke_fleet_subject) are SECURITY
+-- DEFINER — restate the revoke-from-public and the grant and the comment in this same migration.
+
+-- reactivate_fleet_machine (20260826000100) introduced fleet_machines.reactivated_at as the
+-- machine-revocation supersession point. reclaim also stamps it (step 3), so widen the column
+-- comment. (Additive: the supersession semantics are unchanged.)
+comment on column agent_board.fleet_machines.reactivated_at is
+  'Supersession point (#146): machine-revocation events with effective_at <= this are ignored by evaluate_fleet_sender_policy and v_fleet_machine_status. Set by reactivate_fleet_machine and reclaim_fleet_machine; null means never reactivated/reclaimed.';
+
+create or replace function agent_board.reclaim_fleet_machine(
+  p_machine_id uuid,
+  p_new_owner_agent_id uuid,
+  p_reclaimed_by_agent_id uuid,
+  p_reason text default null,
+  p_new_trust_domain_id uuid default null
+)
+returns table(machine_id uuid, owner_agent_id uuid, trust_domain_id uuid, lifecycle_state text, revoked_binding_count integer)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_machine agent_board.fleet_machines%rowtype;
+  v_prior_owner uuid;
+  v_prior_domain uuid;
+  v_revoked_count integer;
+  v_revoked_agents uuid[];
+  v_released_claims integer;
+begin
+  -- Operator-only: ownership arbitration for a contested fingerprint is not self-service.
+  if not agent_board._is_service_role() then
+    raise exception 'reclaim_fleet_machine is operator-only (service_role)' using errcode = '42501';
+  end if;
+
+  -- Provenance is required and must name a real agent (audit lands in metadata).
+  if p_reclaimed_by_agent_id is null then
+    raise exception 'p_reclaimed_by_agent_id is required' using errcode = '22023';
+  end if;
+  if not exists (
+    select 1 from agent_board.agents a where a.id = p_reclaimed_by_agent_id
+  ) then
+    raise exception 'p_reclaimed_by_agent_id is not a known agent' using errcode = '22023';
+  end if;
+
+  -- The arbitrated new owner must exist (validate before we revoke anything).
+  if p_new_owner_agent_id is null then
+    raise exception 'p_new_owner_agent_id is required' using errcode = '22023';
+  end if;
+  if not exists (
+    select 1 from agent_board.agents a where a.id = p_new_owner_agent_id
+  ) then
+    raise exception 'p_new_owner_agent_id is not a known agent' using errcode = '22023';
+  end if;
+
+  -- Kill-switch close (#150 panel): if a destination trust domain is given, it must be an ACTIVE
+  -- domain OWNED BY THE NEW OWNER — otherwise the move would either park the machine somewhere the
+  -- new owner cannot control or leave it in a domain a third party (e.g. the squatter) can revoke,
+  -- which is exactly the kill switch this parameter exists to close. Validated before any writes.
+  if p_new_trust_domain_id is not null and not exists (
+    select 1 from agent_board.fleet_trust_domains ftd
+     where ftd.id = p_new_trust_domain_id
+       and ftd.lifecycle_state = 'active'
+       and ftd.owner_agent_id = p_new_owner_agent_id
+  ) then
+    raise exception 'p_new_trust_domain_id must be an active trust domain owned by the new owner' using errcode = '42501';
+  end if;
+
+  -- Lock the machine row so this read-revoke-reassign serializes against a concurrent
+  -- register_fleet_machine / revoke_fleet_subject / reactivate_fleet_machine (each of which
+  -- also takes a row lock on fleet_machines). Without it a concurrent revoke or re-register
+  -- could interleave and be lost. (Reuses the reactivation race lesson, #146.)
+  select * into v_machine from agent_board.fleet_machines fm where fm.id = p_machine_id for update;
+  if v_machine.id is null then
+    raise exception 'fleet machine not found' using errcode = '22023';
+  end if;
+
+  v_prior_owner := v_machine.owner_agent_id;
+  v_prior_domain := v_machine.trust_domain_id;
+
+  -- (2) Revoke the squatter's access to THIS machine only: flip every currently-active binding
+  -- on it to 'revoked'. All bindings present at reclaim time were established under the prior
+  -- (squatter) owner; the new owner starts from a clean machine and creates their own bindings.
+  -- lifecycle_state is the binding's authority (read directly by _can_claim_resource and by
+  -- evaluate_fleet_sender_policy) so this is the complete access removal — see the header note
+  -- on why no fleet_revocation_events row is written per binding. revoked_at is set to satisfy
+  -- fleet_machine_agents_revoked_shape. Defensive (#150 codex): exclude the NEW owner, so an
+  -- operator reclaiming a machine on which the new owner already holds a binding does not revoke
+  -- the new owner's own access as a side effect.
+  with revoked as (
+    update agent_board.fleet_machine_agents fma
+       set lifecycle_state = 'revoked',
+           revoked_at = now(),
+           updated_at = now()
+     where fma.machine_id = p_machine_id
+       and fma.lifecycle_state = 'active'
+       and fma.agent_id <> p_new_owner_agent_id
+    returning fma.agent_id
+  )
+  select count(*)::integer, coalesce(array_agg(agent_id), '{}'::uuid[])
+    into v_revoked_count, v_revoked_agents
+    from revoked;
+
+  -- (2b) MUST-FIX 2 (#150 codex): release the squatter's ACTIVE machine claim(s) on the reclaimed
+  -- fingerprint. Machine claims key on the bare globally-unique fingerprint (claimgate/CLAIMKEY),
+  -- and reclaim reassigns ownership + revokes bindings but does NOT touch agent_board.claims — so a
+  -- squatter holding an active claim keeps the lock and the new owner's acquire_claim raises 23505
+  -- until lease expiry. Releasing it (status='released') frees the active-claim uniqueness slot so
+  -- the new owner can acquire immediately. Alias-aware match on the canonical key (same helper
+  -- acquire_claim's conflict check uses). The new owner's own claim (if any) is preserved.
+  with released as (
+    update agent_board.claims c
+       set status = 'released',
+           released_at = now(),
+           updated_at = now(),
+           metadata = coalesce(c.metadata, '{}'::jsonb)
+             || jsonb_build_object('released_by_reclaim', p_reclaimed_by_agent_id, 'released_at', now())
+     where c.resource_kind = 'machine'
+       and c.status = 'active'
+       and c.released_at is null
+       and c.agent_id <> p_new_owner_agent_id
+       and agent_board._canonical_claim_key(c.resource_kind, c.resource_key)
+             = agent_board._canonical_claim_key('machine', v_machine.machine_fingerprint)
+    returning c.id
+  )
+  select count(*)::integer into v_released_claims from released;
+
+  -- (1)+(3) Reassign ownership, optionally MOVE the trust domain (kill-switch close), and leave the
+  -- machine active for the new owner.
+  -- owner_agent_id CHANGE: reclaim_fleet_machine is the ONLY writer besides register_fleet_machine
+  -- (INSERT) that assigns owner_agent_id. It is operator-only and is the arbitration escape hatch
+  -- for a squatted fingerprint that #141 otherwise locks permanently.
+  -- trust_domain_id: moved to p_new_trust_domain_id when provided (validated above); coalesce keeps
+  -- the current domain when NULL (documented retained kill switch — see header).
+  -- reactivated_at=now() supersedes any prior machine-revocation event so a squatted-then-revoked
+  -- machine is usable by the new owner (same mechanism as reactivate_fleet_machine).
+  -- AUDIT (#150 panel SHOULD-FIX): APPEND a record to metadata.reclaim_history rather than
+  -- overwriting flat keys, so repeated reclaims do not clobber prior audit.
+  update agent_board.fleet_machines fm
+     set owner_agent_id = p_new_owner_agent_id,
+         trust_domain_id = coalesce(p_new_trust_domain_id, fm.trust_domain_id),
+         lifecycle_state = 'active',
+         revoked_at = null,
+         reactivated_at = now(),
+         metadata = coalesce(fm.metadata, '{}'::jsonb)
+           || jsonb_build_object(
+                'reclaim_history',
+                coalesce(fm.metadata -> 'reclaim_history', '[]'::jsonb)
+                  || jsonb_build_array(jsonb_build_object(
+                       'reclaimed_by', p_reclaimed_by_agent_id,
+                       'reclaim_reason', nullif(trim(coalesce(p_reason, '')), ''),
+                       'prior_owner', v_prior_owner,
+                       'prior_trust_domain_id', v_prior_domain,
+                       'new_trust_domain_id', coalesce(p_new_trust_domain_id, v_prior_domain),
+                       'domain_moved', p_new_trust_domain_id is not null,
+                       'reclaimed_at', now(),
+                       'revoked_bindings', to_jsonb(v_revoked_agents),
+                       'released_claims', v_released_claims
+                     ))
+              )
+           || jsonb_build_object('redacted', true, 'metadata-safe', true),
+         updated_at = now()
+   where fm.id = p_machine_id
+  returning * into v_machine;
+
+  return query select v_machine.id, v_machine.owner_agent_id, v_machine.trust_domain_id, v_machine.lifecycle_state, v_revoked_count;
+end;
+$$;
+
+-- #118 discipline: a SECURITY DEFINER function grants EXECUTE to PUBLIC on create. Restate the
+-- revokes/grant and the comment. Operator-only ⇒ granted to service_role ALONE (not authenticated).
+revoke all on function agent_board.reclaim_fleet_machine(uuid, uuid, uuid, text, uuid) from public, anon, authenticated;
+grant execute on function agent_board.reclaim_fleet_machine(uuid, uuid, uuid, text, uuid) to service_role;
+
+comment on function agent_board.reclaim_fleet_machine(uuid, uuid, uuid, text, uuid) is
+  'Operator-only (#146): reclaims a squatted fleet machine (a globally-unique fingerprint pre-registered by someone other than its rightful owner, which #141 otherwise locks permanently). Reassigns owner_agent_id to the arbitrated new owner (the only writer besides register_fleet_machine that changes ownership), revokes every active fleet_machine_agents binding on THIS machine so the squatter loses access (machine-scoped, NOT a global revoke_fleet_subject(''agent'')), and leaves the machine active for the new owner (stamps reactivated_at to supersede any prior machine-revocation event). Optional p_new_trust_domain_id (#150 kill-switch close): when given, validated (active + owned by the new owner) and the machine is MOVED into it so the squatter''s domain-revocation can no longer deny it; when NULL the machine stays in its current domain and the squatter RETAINS a trust-domain kill switch (documented residual; whole-domain squatting arbitration is a separate follow-up). service_role only (raises 42501 otherwise); never revokes the trust domain or the machine subject. Also releases the squatter''s active machine claim(s) on the reclaimed fingerprint so the new owner can acquire immediately (#150). Reclaim audit is APPENDED to fleet_machines.metadata.reclaim_history (repeated reclaims do not clobber prior records).';
+
+-- ============================================================================================
+-- #150 MUST-FIX 1 (codex): revoke_fleet_subject TOCTOU vs reclaim_fleet_machine.
+-- Reproduced VERBATIM from 20260826000100 EXCEPT the added row-lock block below. The machine,
+-- harness and repo_scope authz branches derive ownership from fleet_machines.owner_agent_id and
+-- previously read it WITHOUT a lock, so a squatter's revoke('machine', M) could pass its ownership
+-- check on the pre-reclaim snapshot and have its lifecycle UPDATE apply AFTER a concurrent reclaim
+-- reassigned the machine — nuking the machine the operator just handed to the new owner. We now
+-- LOCK the owning fleet_machines row FIRST (before the authz re-read and before the event write,
+-- matching reclaim's lock-first order → the two serialize deadlock-free on the same row). #118
+-- grants/comment restated.
+-- ============================================================================================
+create or replace function agent_board.revoke_fleet_subject(
+  p_subject_kind text,
+  p_subject_id uuid,
+  p_revoked_by_agent_id uuid,
+  p_revocation_reason text,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(revocation_event_id uuid, subject_kind text, effective_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_event agent_board.fleet_revocation_events%rowtype;
+  v_actor_agent_id uuid;
+begin
+  if p_subject_kind not in ('trust_domain', 'machine', 'harness', 'repo_scope', 'agent', 'signing_key', 'credential') then
+    raise exception 'unsupported fleet revocation subject' using errcode = '22023';
+  end if;
+
+  -- #150 MUST-FIX 1: lock the owning fleet_machines row for machine-derived kinds BEFORE the
+  -- unlocked ownership check below, so a concurrent reclaim_fleet_machine (which holds `for update`
+  -- on that row) serializes this call and the authz re-read sees committed ownership. Placed ahead
+  -- of the event write; reclaim also locks this row first, so acquisition order matches (no cycle).
+  if p_subject_kind in ('machine', 'harness', 'repo_scope') then
+    declare
+      v_lock_machine_id uuid;
+    begin
+      v_lock_machine_id := case
+        when p_subject_kind = 'machine' then p_subject_id
+        when p_subject_kind = 'harness' then (
+          select fhr.machine_id from agent_board.fleet_harness_registrations fhr where fhr.id = p_subject_id)
+        when p_subject_kind = 'repo_scope' then (
+          select fhr.machine_id
+            from agent_board.fleet_repo_scopes frs
+            join agent_board.fleet_harness_registrations fhr on fhr.id = frs.harness_registration_id
+           where frs.id = p_subject_id)
+      end;
+      if v_lock_machine_id is not null then
+        perform 1 from agent_board.fleet_machines fm where fm.id = v_lock_machine_id for update;
+      end if;
+    end;
+  end if;
+
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_revoked_by_agent_id, 'p_revoked_by_agent_id');
+
+  if not agent_board._is_service_role() then
+    if p_subject_kind = 'trust_domain' and not exists (
+      select 1 from agent_board.fleet_trust_domains ftd
+       where ftd.id = p_subject_id and ftd.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'trust domain is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'machine' and not exists (
+      select 1 from agent_board.fleet_machines fm
+       where fm.id = p_subject_id and fm.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'machine is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'harness' and not exists (
+      select 1
+        from agent_board.fleet_harness_registrations fhr
+        join agent_board.fleet_machines fm on fm.id = fhr.machine_id
+       where fhr.id = p_subject_id and fm.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'harness is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'repo_scope' and not exists (
+      select 1
+        from agent_board.fleet_repo_scopes frs
+        join agent_board.fleet_harness_registrations fhr on fhr.id = frs.harness_registration_id
+        join agent_board.fleet_machines fm on fm.id = fhr.machine_id
+       where frs.id = p_subject_id and fm.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'repo scope is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'agent' and p_subject_id <> v_actor_agent_id then
+      raise exception 'agent revocation must target current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'signing_key' and not exists (
+      select 1 from agent_board.agent_signing_keys ask
+       where ask.id = p_subject_id and ask.agent_id = v_actor_agent_id
+    ) then
+      raise exception 'signing key is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'credential' and not exists (
+      select 1 from agent_board.agent_credentials ac
+       where ac.id = p_subject_id and ac.agent_id = v_actor_agent_id
+    ) then
+      raise exception 'credential is not owned by current_agent_id()' using errcode = '42501';
+    end if;
+  end if;
+
+  select *
+    into v_event
+    from agent_board.fleet_revocation_events fre
+   where fre.subject_kind = p_subject_kind
+     and fre.subject_id = p_subject_id
+   limit 1;
+
+  if v_event.id is null then
+    insert into agent_board.fleet_revocation_events(
+      subject_kind,
+      subject_id,
+      trust_domain_id,
+      machine_id,
+      harness_registration_id,
+      repo_scope_id,
+      agent_id,
+      signing_key_id,
+      revoked_by_agent_id,
+      revocation_reason,
+      metadata
+    )
+    values (
+      p_subject_kind,
+      p_subject_id,
+      case when p_subject_kind = 'trust_domain' then p_subject_id end,
+      case when p_subject_kind = 'machine' then p_subject_id end,
+      case when p_subject_kind = 'harness' then p_subject_id end,
+      case when p_subject_kind = 'repo_scope' then p_subject_id end,
+      case when p_subject_kind = 'agent' then p_subject_id end,
+      case when p_subject_kind = 'signing_key' then p_subject_id end,
+      p_revoked_by_agent_id,
+      trim(coalesce(p_revocation_reason, 'operator revocation')),
+      coalesce(p_metadata, '{}'::jsonb) || jsonb_build_object('redacted', true, 'metadata-safe', true)
+    )
+    returning * into v_event;
+  else
+    update agent_board.fleet_revocation_events fre
+       set effective_at = now(),
+           revoked_by_agent_id = p_revoked_by_agent_id,
+           revocation_reason = trim(coalesce(p_revocation_reason, 'operator revocation')),
+           metadata = coalesce(p_metadata, '{}'::jsonb) || jsonb_build_object('redacted', true, 'metadata-safe', true)
+     where fre.id = v_event.id
+    returning * into v_event;
+  end if;
+
+  if p_subject_kind = 'trust_domain' then
+    update agent_board.fleet_trust_domains
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'machine' then
+    update agent_board.fleet_machines
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'harness' then
+    update agent_board.fleet_harness_registrations
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'repo_scope' then
+    update agent_board.fleet_repo_scopes
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'agent' then
+    update agent_board.fleet_machine_agents
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where agent_id = p_subject_id;
+  elsif p_subject_kind = 'signing_key' then
+    update agent_board.agent_signing_keys
+       set status = case when status = 'compromised' then status else 'revoked' end,
+           proof_state = 'revoked',
+           revoked_at = coalesce(revoked_at, v_event.effective_at),
+           revoked_by_agent_id = p_revoked_by_agent_id,
+           revocation_reason = trim(coalesce(p_revocation_reason, 'operator revocation')),
+           updated_at = now()
+     where id = p_subject_id;
+  end if;
+
+  return query select v_event.id, v_event.subject_kind, v_event.effective_at;
+end;
+$$;
+
+revoke all on function agent_board.revoke_fleet_subject(text, uuid, uuid, text, jsonb) from public, anon;
+grant execute on function agent_board.revoke_fleet_subject(text, uuid, uuid, text, jsonb) to authenticated, service_role;
+
+comment on function agent_board.revoke_fleet_subject(text, uuid, uuid, text, jsonb) is
+  'Records a fleet revocation into the append-only fleet_revocation_events ledger (one row per subject) and flips the subject''s lifecycle to revoked. Re-revoking a subject advances the event''s effective_at to now() (#146). For machine-derived subject kinds (machine/harness/repo_scope) it locks the owning fleet_machines row before the ownership check (#150), so a concurrent reclaim_fleet_machine serializes and a stale-owner revoke is refused (42501) rather than nuking a just-reclaimed machine.';

package/migrations/20260830000100_agent_board_delegation_sole_writer.sql

@@ -0,0 +1,41 @@
+-- =============================================================================
+-- DELEGSOLEWRITER (#152) — make upsert_delegation_policy the SOLE writer of
+-- agent_board.delegation_policies by revoking service_role's direct INSERT/UPDATE.
+-- =============================================================================
+-- Defense-in-depth follow-up to #142 (20260828000100, operator caps are a durable
+-- ceiling). #142 stores the operator's hard ceiling in operator_max_active_children /
+-- operator_child_ttl_ceiling, which the OPERATOR branch of upsert_delegation_policy
+-- ESTABLISHES and the self-service branch PRESERVES; mint_delegated_child then clamps
+-- the self-service effective cap to least(self, operator ceiling, 25/24h). That closes
+-- the LOCKED threat model (an authenticated root has SELECT-only on the table, so it
+-- cannot loosen the ceiling through the function).
+--
+-- THE RESIDUAL DOOR (operator misuse, not a self-service escalation): service_role still
+-- held a DIRECT insert/update grant (20260717000400:42). An operator using raw SQL could
+-- set delegation_policies.max_active_children / .child_ttl_ceiling WITHOUT populating the
+-- operator_* ceiling columns; a later self-service upsert then PRESERVES the NULL ceiling
+-- while the mint reads NULL as "no operator ceiling" and the root widens back to 25/24h.
+-- The operator's intent is not durable when it bypasses the function.
+--
+-- WHY THE REVOKE IS SAFE (verified against pg_catalog on the live schema):
+--   * upsert_delegation_policy is the ONLY function that writes the table
+--     (INSERT/UPDATE), and it is SECURITY DEFINER OWNED BY the table owner (postgres) —
+--     it runs with the owner's implicit privileges, NOT service_role's grant. Revoking
+--     the grant does not touch it. (renew_delegated_grant and mint_delegated_child only
+--     reference the table in SELECT/lock and write delegation_grants, not this table.)
+--   * The mint-child Edge Function and every supabase/functions/* path use RPCs only —
+--     no raw table write to delegation_policies.
+--   * The pgTAP suite connects as postgres, the table OWNER, so its direct-insert test
+--     seeds keep working via ownership (owner privileges are implicit and unaffected by a
+--     grant revoke); no test seed needed migration to the function.
+--
+-- After this, an operator setting caps MUST go through upsert_delegation_policy, whose
+-- operator branch synchronizes the operator_* ceiling — so the #142 durable ceiling can
+-- never be left NULL by a legitimate operator write. "The writer is THE writer, enforced
+-- not conventional" (CLAUDE.md rule #1).
+--
+-- SELECT is deliberately KEPT (readers/operators still read the table). Additive,
+-- forward-only ACL change; schema_version stays 8.
+-- =============================================================================
+
+revoke insert, update on agent_board.delegation_policies from service_role;