@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/tests/agent_board_fleet_domain_reclaim.test.sql

@@ -0,0 +1,419 @@
+-- #153 whole-domain squatting arbitration — reassign a squatted fleet_trust_domain's owner.
+--
+-- reclaim_fleet_trust_domain (service_role only) is the operator arbitration path for a WHOLE
+-- domain squatted by someone other than its rightful owner — the residual #150's machine-level
+-- reclaim could not cover. It reassigns fleet_trust_domains.owner_agent_id to the arbitrated new
+-- owner under a row lock; the reassignment is atomic at the domain row and post-commit every authz
+-- site (revoke_fleet_subject('trust_domain'), register_fleet_machine, set_fleet_receive_policy) reads
+-- the new owner. SERIALIZATION CAVEAT (#159): only revoke_fleet_subject('trust_domain') is locked
+-- against an in-flight reclaim here; register_fleet_machine / set_fleet_receive_policy are NOT yet
+-- serialized (tracked in #159). It writes NO fleet_revocation_events row (a trust_domain ledger row
+-- over-denies the whole domain incl. the new owner — #150 divergence rationale), and APPENDS the
+-- audit to metadata.reclaim_history.
+--
+-- These assertions pin:
+--   * reclaim reassigns owner_agent_id (state + returned prior owner) — PIN: skip the reassign ⇒
+--     (3)/(10)/(12)/(13) fail (owner stays squatter, authority does not move).
+--   * NO trust_domain revocation event is written by reclaim (7) — PIN: add a revoke-event write ⇒
+--     a row appears ⇒ (7) fails. Pins the over-deny divergence rationale.
+--   * NON-GOAL scope: a machine in the reclaimed domain KEEPS owner=squatter (8) — PIN: also
+--     reassign machine owners ⇒ (8) fails. Documents domain-vs-machine separation.
+--   * AUTHORITY BRACKET (rule #2/#3): each authority probe is bracketed by a BEFORE probe under the
+--     same authenticated principal proving current_agent_id() resolves — so an AFTER flip is a
+--     genuine authority change, not a null-actor artifact. register_fleet_machine into the domain is
+--     the reversible authority lever: squatter CAN before / CANNOT after; new owner CANNOT before /
+--     CAN after (9-12). The kill switch itself: squatter's revoke('trust_domain') is REFUSED after
+--     reclaim (13) — PIN: skip reassign ⇒ squatter still owns ⇒ not refused ⇒ (13) fails.
+--   * reclaim is operator-only: an authenticated caller (the victim) is refused 42501 (14) — PIN:
+--     remove the _is_service_role() body guard ⇒ (14) fails (body guard isolated from the ACL by a
+--     temp grant to authenticated).
+--   * reclaim validates the new owner + provenance agent exist and the domain exists (15,16,17).
+--   * REVOKED-DOMAIN RESIDUAL (documented, positive pin): reclaim of a domain the squatter already
+--     revoked SUCCEEDS + transfers owner (18,19) but the domain STAYS revoked (20) — no domain
+--     un-revoke path today. Pins the boundary positively (rule #1) rather than leaving a silent gap.
+--   * AUDIT APPEND (rule #2): a second reclaim APPENDS to reclaim_history (21) — PIN: overwrite ⇒
+--     length stays 1 ⇒ (21) fails.
+--   * CLASS (rule #1 / EC-4): reclaim_fleet_trust_domain is the ONLY function-writer of
+--     fleet_trust_domains.owner_agent_id (22) — catalog-derived, so a future owner-writer names
+--     itself. (No RPC INSERTs a domain; domains are seeded by direct table INSERT, which is not a
+--     function and cannot match.)
+--
+-- Tests run as session_user=postgres ⇒ _is_service_role() is true; probes and the authz assertion
+-- flip to role=authenticated (jwt claims) to exercise the principal / body guard.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(22);
+
+-- (1) Shape.
+select has_function(
+  'agent_board', 'reclaim_fleet_trust_domain',
+  array['uuid', 'uuid', 'uuid', 'text'],
+  'reclaim_fleet_trust_domain exists'
+);
+
+create temp table _dr_fx (
+  operator uuid,      -- arbitration actor (p_reclaimed_by); no auth mapping needed
+  squatter uuid,      -- squats the domains; owner of dom_core/dom_revoked/dom_authz
+  new_owner uuid,     -- arbitrated rightful owner
+  victim uuid,        -- used for the operator-only authz probe
+  dom_core uuid,      -- main reclaim + authority + kill-switch
+  dom_revoked uuid,   -- revoked by the squatter BEFORE reclaim (residual pin)
+  dom_authz uuid,     -- operator-only probe target
+  m_core uuid,        -- a machine in dom_core (non-goal: stays owned by squatter)
+  squatter_user uuid,
+  new_owner_user uuid,
+  victim_user uuid
+) on commit drop;
+grant all on table _dr_fx to authenticated, service_role;
+
+create temp table _dr_probe (label text, allowed boolean) on commit drop;
+grant all on table _dr_probe to authenticated, service_role;
+
+do $$
+declare
+  v_operator uuid := gen_random_uuid();
+  v_squatter uuid := gen_random_uuid();
+  v_new_owner uuid := gen_random_uuid();
+  v_victim uuid := gen_random_uuid();
+  v_dom_core uuid;
+  v_dom_revoked uuid;
+  v_dom_authz uuid;
+  v_m_core uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_operator, 'agent', 'dr-operator', 'DR Operator'),
+    (v_squatter, 'agent', 'dr-squatter', 'DR Squatter'),
+    (v_new_owner, 'agent', 'dr-new-owner', 'DR New Owner'),
+    (v_victim, 'agent', 'dr-victim', 'DR Victim');
+
+  -- All three domains are squatted (owned by the squatter). dom_core + dom_authz active; dom_revoked
+  -- active now (revoked below via the squatter's own kill switch to exercise the residual).
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values
+    ('dr-domain-core', 'DR Domain Core', 'tailnet', v_squatter, 'active', now()),
+    ('dr-domain-revoked', 'DR Domain Revoked', 'tailnet', v_squatter, 'active', now()),
+    ('dr-domain-authz', 'DR Domain Authz', 'tailnet', v_squatter, 'active', now());
+  select id into v_dom_core from agent_board.fleet_trust_domains where slug = 'dr-domain-core';
+  select id into v_dom_revoked from agent_board.fleet_trust_domains where slug = 'dr-domain-revoked';
+  select id into v_dom_authz from agent_board.fleet_trust_domains where slug = 'dr-domain-authz';
+
+  -- A machine the squatter owns inside dom_core (non-goal: domain reclaim must NOT reassign it).
+  select machine_id into v_m_core from agent_board.register_fleet_machine(
+    v_squatter, v_dom_core, 'dr-m-core', 'sha256:dr-m-core', 'portal', '{"redacted":true}'::jsonb);
+
+  insert into _dr_fx(operator, squatter, new_owner, victim, dom_core, dom_revoked, dom_authz, m_core)
+  values (v_operator, v_squatter, v_new_owner, v_victim, v_dom_core, v_dom_revoked, v_dom_authz, v_m_core);
+end
+$$;
+
+-- Map the squatter, new owner and victim agents to auth users so the authenticated probes/authz
+-- call resolve a principal via current_agent_id() → auth.uid().
+do $$
+declare
+  v_sfx text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_squatter_user uuid;
+  v_new_owner_user uuid;
+  v_victim_user uuid;
+begin
+  v_squatter_user := public.ensure_github_user('dr-squatter-' || v_sfx, 'dr-squatter-' || v_sfx || '@example.test', 'dr-squatter-' || v_sfx, 'DR Squatter ' || v_sfx);
+  v_new_owner_user := public.ensure_github_user('dr-newowner-' || v_sfx, 'dr-newowner-' || v_sfx || '@example.test', 'dr-newowner-' || v_sfx, 'DR New Owner ' || v_sfx);
+  v_victim_user := public.ensure_github_user('dr-victim-' || v_sfx, 'dr-victim-' || v_sfx || '@example.test', 'dr-victim-' || v_sfx, 'DR Victim ' || v_sfx);
+
+  update agent_board.agents set auth_user_id = v_squatter_user where id = (select squatter from _dr_fx);
+  update agent_board.agents set auth_user_id = v_new_owner_user where id = (select new_owner from _dr_fx);
+  update agent_board.agents set auth_user_id = v_victim_user where id = (select victim from _dr_fx);
+
+  update _dr_fx set squatter_user = v_squatter_user, new_owner_user = v_new_owner_user, victim_user = v_victim_user;
+end
+$$;
+
+------------------------------------------------------------------------------------------
+-- BEFORE authority probes (rule #2/#3 bracket): register_fleet_machine into dom_core is the
+-- reversible authority lever (requires ftd.owner_agent_id = actor). The squatter (owner) CAN; the
+-- new owner CANNOT — proving both principals resolve, so the AFTER flips below are genuine.
+------------------------------------------------------------------------------------------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select squatter from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-sqbefore', 'sha256:dr-m-sqbefore', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('squatter_before', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('squatter_before', false);
+  end;
+end $$;
+select set_config('request.jwt.claim.sub', (select new_owner_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select new_owner from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-nobefore', 'sha256:dr-m-nobefore', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('new_owner_before', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('new_owner_before', false);
+  end;
+end $$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+------------------------------------------------------------------------------------------
+-- CORE: operator reclaims dom_core from the squatter to the new owner.
+------------------------------------------------------------------------------------------
+-- (2) Reclaim succeeds (allow-side lives_ok + separate state reads, #113).
+select lives_ok(
+  $$ create temp table _dr_core as
+       select * from agent_board.reclaim_fleet_trust_domain(
+         (select dom_core from _dr_fx), (select new_owner from _dr_fx),
+         (select operator from _dr_fx), 'operator arbitrated: domain belongs to new owner') $$,
+  'core: service_role reclaim of dom_core succeeds'
+);
+
+-- (3) Owner is reassigned. MUTATION PIN: skipping the owner reassignment leaves owner=squatter.
+select is(
+  (select owner_agent_id from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  (select new_owner from _dr_fx),
+  'core: reclaim reassigns owner_agent_id to the new owner'
+);
+
+-- (4) The returned prior owner is the squatter.
+select is(
+  (select prior_owner_agent_id from _dr_core),
+  (select squatter from _dr_fx),
+  'core: reclaim returns the prior owner (the squatter)'
+);
+
+-- (5) Audit APPENDED to metadata.reclaim_history: last record has operator + prior owner.
+select ok(
+  (select (metadata -> 'reclaim_history' -> -1 ->> 'reclaimed_by') = (select operator::text from _dr_fx)
+      and (metadata -> 'reclaim_history' -> -1 ->> 'prior_owner') = (select squatter::text from _dr_fx)
+     from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  'core: reclaim audit (reclaimed_by + prior owner) appended to metadata.reclaim_history'
+);
+
+-- (6) The audit records the prior lifecycle (active here) — makes the revoked residual visible.
+select is(
+  (select metadata -> 'reclaim_history' -> -1 ->> 'prior_lifecycle_state'
+     from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  'active',
+  'core: reclaim audit records prior_lifecycle_state'
+);
+
+-- (7) NO trust_domain revocation event is written by reclaim (over-deny divergence rationale).
+-- MUTATION PIN: adding a fleet_revocation_events write to reclaim makes a row appear → this flips.
+select is(
+  (select count(*)::integer from agent_board.fleet_revocation_events
+     where subject_kind = 'trust_domain' and subject_id = (select dom_core from _dr_fx)),
+  0,
+  'core: reclaim writes NO trust_domain revocation event (no over-deny)'
+);
+
+-- (8) NON-GOAL: a machine in dom_core KEEPS owner=squatter (domain reclaim ≠ machine reclaim).
+-- MUTATION PIN: also reassigning machine owners in reclaim flips this to new_owner.
+select is(
+  (select owner_agent_id from agent_board.fleet_machines where id = (select m_core from _dr_fx)),
+  (select squatter from _dr_fx),
+  'non-goal: a machine in the reclaimed domain keeps owner=squatter'
+);
+
+------------------------------------------------------------------------------------------
+-- AFTER authority probes: register authority on dom_core post-reclaim, then the kill switch.
+------------------------------------------------------------------------------------------
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select squatter from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-sqafter', 'sha256:dr-m-sqafter', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('squatter_after', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('squatter_after', false);
+  end;
+end $$;
+select set_config('request.jwt.claim.sub', (select new_owner_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.register_fleet_machine((select new_owner from _dr_fx), (select dom_core from _dr_fx),
+      'dr-m-noafter', 'sha256:dr-m-noafter', 'portal', '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('new_owner_after', true);
+  exception when sqlstate '42501' then insert into _dr_probe values ('new_owner_after', false);
+  end;
+end $$;
+-- Kill switch: the squatter (no longer owner) tries revoke_fleet_subject('trust_domain', dom_core).
+select set_config('request.jwt.claim.sub', (select squatter_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform agent_board.revoke_fleet_subject('trust_domain', (select dom_core from _dr_fx),
+      (select squatter from _dr_fx), 'squatter tries the kill switch after losing the domain',
+      '{"redacted":true}'::jsonb);
+    insert into _dr_probe values ('squatter_killswitch_denied', false);   -- reached completion → NOT denied
+  exception when sqlstate '42501' then insert into _dr_probe values ('squatter_killswitch_denied', true);
+  end;
+end $$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- (9)(10) Authority lever (register): squatter COULD before (bracket) → CANNOT after (PIN skip reassign).
+select is((select allowed from _dr_probe where label = 'squatter_before'), true,
+  'bracket: the squatter (owner) could register into dom_core before reclaim');
+select is((select allowed from _dr_probe where label = 'squatter_after'), false,
+  'squatter: loses domain authority (cannot register into dom_core) after reclaim');
+-- (11)(12) New owner: CANNOT before (bracket) → CAN after (PIN skip reassign).
+select is((select allowed from _dr_probe where label = 'new_owner_before'), false,
+  'bracket: the new owner could NOT register into dom_core before reclaim');
+select is((select allowed from _dr_probe where label = 'new_owner_after'), true,
+  'new owner: gains domain authority (can register into dom_core) after reclaim');
+-- (13) KILL SWITCH removed: the squatter's revoke('trust_domain') is refused after reclaim.
+-- MUTATION PIN: skipping the owner reassign leaves the squatter owning dom_core → revoke is NOT
+-- refused → denied=false → this flips.
+select is((select allowed from _dr_probe where label = 'squatter_killswitch_denied'), true,
+  'kill-switch: the squatter''s revoke(trust_domain) is refused (42501) after reclaim');
+
+------------------------------------------------------------------------------------------
+-- AUTHZ (dom_authz): operator-only. An authenticated caller (the victim) is refused. The BODY guard
+-- is isolated from the service_role-only grant by a temp grant to authenticated.
+------------------------------------------------------------------------------------------
+create temp table _dr_authz (denied boolean) on commit drop;
+grant all on table _dr_authz to authenticated, service_role;
+
+grant execute on function agent_board.reclaim_fleet_trust_domain(uuid, uuid, uuid, text) to authenticated;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select victim_user::text from _dr_fx), true);
+do $$
+begin
+  begin
+    perform * from agent_board.reclaim_fleet_trust_domain(
+      (select dom_authz from _dr_fx), (select victim from _dr_fx),
+      (select victim from _dr_fx), 'victim self-reclaim attempt');
+    insert into _dr_authz values (false);   -- reached completion → NOT denied
+  exception when sqlstate '42501' then insert into _dr_authz values (true);
+  end;
+end
+$$;
+reset role;
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+revoke execute on function agent_board.reclaim_fleet_trust_domain(uuid, uuid, uuid, text) from authenticated;
+
+-- (14) MUTATION PIN: removing the _is_service_role() body guard lets the authenticated call
+-- complete → denied=false → this flips.
+select ok(
+  (select denied from _dr_authz),
+  'authz: authenticated caller (the victim) cannot reclaim (42501) — operator-only'
+);
+
+------------------------------------------------------------------------------------------
+-- VALIDATION.
+------------------------------------------------------------------------------------------
+-- (15) unknown new owner
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_trust_domain(%L::uuid, %L::uuid, %L::uuid, 'unknown new owner') $$,
+    (select dom_authz from _dr_fx), gen_random_uuid(), (select operator from _dr_fx)),
+  '22023', NULL, 'validate: reclaim to an unknown new owner raises'
+);
+-- (16) unknown provenance
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_trust_domain(%L::uuid, %L::uuid, %L::uuid, 'unknown provenance') $$,
+    (select dom_authz from _dr_fx), (select new_owner from _dr_fx), gen_random_uuid()),
+  '22023', NULL, 'validate: reclaim with an unknown reclaimed_by agent raises'
+);
+-- (17) unknown domain
+select throws_ok(
+  format($$ select * from agent_board.reclaim_fleet_trust_domain(%L::uuid, %L::uuid, %L::uuid, 'unknown domain') $$,
+    gen_random_uuid(), (select new_owner from _dr_fx), (select operator from _dr_fx)),
+  '22023', NULL, 'validate: reclaim of a non-existent domain raises'
+);
+
+------------------------------------------------------------------------------------------
+-- REVOKED-DOMAIN RESIDUAL (documented, positive pin): the squatter revokes dom_revoked first; the
+-- operator then reclaims it. Ownership transfers, but the domain STAYS revoked (no un-revoke path).
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform agent_board.revoke_fleet_subject('trust_domain', (select dom_revoked from _dr_fx),
+    (select squatter from _dr_fx), 'squatter revoke before arbitration', '{"redacted":true}'::jsonb);
+end
+$$;
+-- (18)
+select lives_ok(
+  $$ select * from agent_board.reclaim_fleet_trust_domain(
+       (select dom_revoked from _dr_fx), (select new_owner from _dr_fx),
+       (select operator from _dr_fx), 'reclaim a revoked-then-squatted domain') $$,
+  'revoked-residual: reclaiming a revoked domain succeeds'
+);
+-- (19)
+select is(
+  (select owner_agent_id from agent_board.fleet_trust_domains where id = (select dom_revoked from _dr_fx)),
+  (select new_owner from _dr_fx),
+  'revoked-residual: reclaim of a revoked domain still transfers ownership'
+);
+-- (20) BOUNDARY AS BEHAVIOR: the owner-transfer SUCCEEDED (owner=new_owner) AND the domain is STILL
+-- revoked — one compound assertion so the intentional residual is pinned as behavior, not inferred
+-- across two checks. PIN (mutation H): making reclaim revive the domain (lifecycle='active' on the
+-- revoked branch) flips this; skipping the reassign (owner stays squatter) also flips it.
+select ok(
+  (select owner_agent_id = (select new_owner from _dr_fx) and lifecycle_state = 'revoked'
+     from agent_board.fleet_trust_domains where id = (select dom_revoked from _dr_fx)),
+  'revoked-residual: after a successful owner-transfer the pre-revoked domain STAYS revoked (intentional boundary)'
+);
+
+------------------------------------------------------------------------------------------
+-- AUDIT APPEND (rule #2): a SECOND reclaim of dom_core APPENDS to reclaim_history.
+------------------------------------------------------------------------------------------
+do $$
+begin
+  perform * from agent_board.reclaim_fleet_trust_domain(
+    (select dom_core from _dr_fx), (select victim from _dr_fx),
+    (select operator from _dr_fx), 'second arbitration on the same domain');
+end
+$$;
+-- (21) MUTATION PIN: reverting the audit to overwrite (single-element array / flat keys) leaves
+-- reclaim_history at length 1 → this flips.
+select is(
+  (select jsonb_array_length(metadata -> 'reclaim_history') from agent_board.fleet_trust_domains where id = (select dom_core from _dr_fx)),
+  2,
+  'audit: a repeated reclaim appends to reclaim_history (prior record preserved)'
+);
+
+------------------------------------------------------------------------------------------
+-- CLASS (rule #1 / EC-4): catalog-derived — reclaim_fleet_trust_domain is the ONLY writer of
+-- fleet_trust_domains.owner_agent_id. A future owner-writer appears here BY NAME. WRITER = a
+-- function whose definition INSERTs owner_agent_id into fleet_trust_domains or UPDATEs
+-- fleet_trust_domains assigning owner_agent_id. Reads (WHERE owner_agent_id = ...) and the lifecycle
+-- -only revoke UPDATE (no owner_agent_id =) do not match. Aggregates excluded (prokind='f').
+------------------------------------------------------------------------------------------
+-- (22)
+select is(
+  (
+    select string_agg(proname, ', ' order by proname)
+      from (
+        select p.proname
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+         where n.nspname = 'agent_board'
+           and p.prokind = 'f'
+           and (
+             pg_get_functiondef(p.oid) ~ 'insert into agent_board\.fleet_trust_domains\s*\([^)]*owner_agent_id'
+             or pg_get_functiondef(p.oid) ~ 'update agent_board\.fleet_trust_domains[^;]*owner_agent_id\s*='
+           )
+      ) writers
+  ),
+  'reclaim_fleet_trust_domain',
+  'class: reclaim_fleet_trust_domain is the only writer of fleet_trust_domains.owner_agent_id (a new writer names itself)'
+);
+
+select * from finish();
+
+rollback;

package/tests/agent_board_fleet_machine_hijack.test.sql

@@ -0,0 +1,190 @@
+-- #141 register_fleet_machine fleet-ownership hijack.
+--
+-- machine_fingerprint is globally unique, so a fingerprint conflict can target ANY owner's
+-- machine. The fix gates the `on conflict do update` with `where owner_agent_id = <resolved
+-- actor>` and raises 42501 when the conflicting row belongs to a different owner. These
+-- assertions pin: (a) a cross-owner re-register RAISES and leaves the victim row untouched,
+-- (b) a same-owner re-register still updates descriptive fields, and (c) a same-owner
+-- re-register does NOT resurrect a deliberately revoked machine.
+--
+-- Tests run as session_user=postgres => _is_service_role() is true => _resolved_actor_agent_id
+-- returns the supplied p_owner_agent_id verbatim, so owner A and owner B are addressed
+-- directly. (The authenticated-actor path -- p_owner must match current_agent_id() -- is
+-- already covered by agent_board_fleet_policy.test.sql's impersonation block.)
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(14);
+
+select has_function(
+  'agent_board', 'register_fleet_machine',
+  array['uuid', 'uuid', 'text', 'text', 'text', 'jsonb'],
+  'register_fleet_machine exists'
+);
+
+create temp table _hijack_fx (
+  owner_a uuid,
+  owner_b uuid,
+  domain_a uuid,
+  domain_b uuid,
+  machine uuid
+) on commit drop;
+
+grant all on table _hijack_fx to authenticated, service_role;
+
+do $$
+declare
+  v_owner_a uuid := gen_random_uuid();
+  v_owner_b uuid := gen_random_uuid();
+  v_domain_a uuid;
+  v_domain_b uuid;
+  v_machine uuid;
+begin
+  insert into agent_board.agents(id, agent_type, handle, display_name)
+  values
+    (v_owner_a, 'agent', 'fleet-hijack-owner-a', 'Fleet Hijack Owner A'),
+    (v_owner_b, 'agent', 'fleet-hijack-owner-b', 'Fleet Hijack Owner B');
+
+  insert into agent_board.fleet_trust_domains(slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values
+    ('fleet-hijack-domain-a', 'Hijack Domain A', 'tailnet', v_owner_a, 'active', now()),
+    ('fleet-hijack-domain-b', 'Hijack Domain B', 'external', v_owner_b, 'active', now());
+
+  select id into v_domain_a from agent_board.fleet_trust_domains where slug = 'fleet-hijack-domain-a';
+  select id into v_domain_b from agent_board.fleet_trust_domains where slug = 'fleet-hijack-domain-b';
+
+  -- Owner A registers the machine that owner B will try to steal.
+  select machine_id
+    into v_machine
+    from agent_board.register_fleet_machine(
+      v_owner_a, v_domain_a, 'owner-a-claw', 'sha256:fleet-hijack-fixture', 'portal', '{"redacted":true}'::jsonb
+    );
+
+  insert into _hijack_fx(owner_a, owner_b, domain_a, domain_b, machine)
+  values (v_owner_a, v_owner_b, v_domain_a, v_domain_b, v_machine);
+end
+$$;
+
+-- (1) Cross-owner re-register of an existing fingerprint RAISES 42501.
+-- Mutation pin: neutering the `where owner_agent_id = v_actor_agent_id` gate on the
+-- do-update (e.g. `where true`) lets the cross-owner update proceed and this THROWS_OK
+-- flips to `not ok` (the call lives instead of raising).
+select throws_ok(
+  $$ select * from agent_board.register_fleet_machine(
+       (select owner_b from _hijack_fx),
+       (select domain_b from _hijack_fx),
+       'owner-b-steal',
+       'sha256:fleet-hijack-fixture',
+       'portal',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  '42501',
+  NULL,
+  'cross-owner re-register of an existing fingerprint raises 42501'
+);
+
+-- (2)(3) The victim row is untouched by the failed hijack: owner and lifecycle unchanged.
+-- Mutation pin: additionally restoring `owner_agent_id = excluded.owner_agent_id` to the
+-- do-update (the original stealing upsert) flips assertion (2) -- the owner becomes owner_b.
+select is(
+  (select owner_agent_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  (select owner_a from _hijack_fx),
+  'failed hijack leaves owner_agent_id unchanged (still owner A)'
+);
+select is(
+  (select lifecycle_state from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  'active',
+  'failed hijack leaves lifecycle_state unchanged (still active)'
+);
+
+-- (4)(5) No cross-owner WRITE at all: the descriptive fields the attacker supplied
+-- (label, trust domain) are also untouched. My do-update writes machine_label and
+-- trust_domain_id unconditionally once the owner-gate opens, so neutering that gate
+-- (mutation 1) flips these directly -- pinning the no-cross-owner-write property, not
+-- just the raise.
+select is(
+  (select machine_label from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  'owner-a-claw',
+  'failed hijack leaves machine_label unchanged (attacker label not written)'
+);
+select is(
+  (select trust_domain_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  (select domain_a from _hijack_fx),
+  'failed hijack leaves trust_domain_id unchanged (attacker domain not written)'
+);
+
+-- (6) Same-owner re-register still succeeds and updates descriptive fields.
+select lives_ok(
+  $$ create temp table _hijack_rereg as
+       select * from agent_board.register_fleet_machine(
+         (select owner_a from _hijack_fx),
+         (select domain_a from _hijack_fx),
+         'owner-a-claw-renamed',
+         'sha256:fleet-hijack-fixture',
+         'portal',
+         '{"redacted":true}'::jsonb
+       ) $$,
+  'same-owner re-register succeeds'
+);
+
+-- (7)(8)(9) It is the SAME row, the label updated, and the owner is still owner A.
+select is(
+  (select machine_id from _hijack_rereg),
+  (select machine from _hijack_fx),
+  'same-owner re-register updates the existing row (machine_id unchanged)'
+);
+select is(
+  (select machine_label from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  'owner-a-claw-renamed',
+  'same-owner re-register updates the machine label'
+);
+select is(
+  (select owner_agent_id from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  (select owner_a from _hijack_fx),
+  'same-owner re-register keeps owner_agent_id = owner A'
+);
+
+-- (10) Owner A revokes their own machine.
+select lives_ok(
+  $$ select * from agent_board.revoke_fleet_subject(
+       'machine',
+       (select machine from _hijack_fx),
+       (select owner_a from _hijack_fx),
+       'test revocation',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  'owner A revokes their machine'
+);
+
+-- (11) A same-owner re-register of the now-revoked machine still succeeds ...
+select lives_ok(
+  $$ select * from agent_board.register_fleet_machine(
+       (select owner_a from _hijack_fx),
+       (select domain_a from _hijack_fx),
+       'owner-a-claw-reregistered',
+       'sha256:fleet-hijack-fixture',
+       'portal',
+       '{"redacted":true}'::jsonb
+     ) $$,
+  'same-owner re-register of a revoked machine succeeds'
+);
+
+-- (13)(14) ... but does NOT resurrect it: lifecycle_state and revoked_at are preserved.
+-- Mutation pin: restoring `lifecycle_state = 'active', revoked_at = null` to the do-update
+-- (the original un-revoke) flips both assertions.
+select is(
+  (select lifecycle_state from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  'revoked',
+  're-register does not resurrect a revoked machine (lifecycle_state stays revoked)'
+);
+select ok(
+  (select revoked_at is not null from agent_board.fleet_machines where machine_fingerprint = 'sha256:fleet-hijack-fixture'),
+  're-register does not clear revoked_at of a revoked machine'
+);
+
+select * from finish();
+
+rollback;