@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/tests/isolation/specs/claimkey_renew_race.spec

@@ -0,0 +1,67 @@
+# CLAIMGATE/CLAIMKEY (#133) MUST-FIX 1 — renew_claim canonicalization is race-safe.
+#
+# Two ACTIVE claims name the SAME physical machine via distinct legacy keys that both
+# canonicalize to 'fpRace' ('machine:fpRace' and '  fpRace  '). Renewed concurrently, each
+# session's canonicalizing UPDATE targets 'fpRace' on claims_active_resource_unique. A
+# check-then-act guard would let both observe the slot free at READ COMMITTED and one would
+# raise 23505 — the panel's must-fix. The shipped renew wraps the UPDATE in a unique_violation
+# handler that retries ONCE keeping the current key, so the loser does NOT raise: it renews the
+# lease and keeps its legacy key (the deferred alias ENFORCE closes).
+#
+# WHAT THIS PINS (a TRACE, per Postgres's own isolation suite): session rb's renew BLOCKS on
+# ra's uncommitted index entry (isolationtester prints `<waiting ...>`), and after ra commits rb
+# COMPLETES returning its kept legacy key '  fpRace  ' — no error line. Both leases stay active.
+#
+# MUTATION SIGNAL (verified in the PR): drop the `exception when unique_violation ... retry`
+# handler (or stop it catching unique_violation) → rb no longer completes cleanly; the trace
+# shows `ERROR:  duplicate key value violates unique constraint "claims_active_resource_unique"`
+# and the golden diverges. Both sessions run as service_role (renew's ownership check is bypassed
+# for the operator carve-out; canonicalization is actor-independent).
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, handle, display_name, status)
+  values ('c1a70000-0000-4000-8000-000000000001', 'agent', 'ck-race-agent', 'CK Race Agent', 'active');
+  insert into agent_board.claims(agent_id, resource_kind, resource_key, lease_token, lease_expires_at) values
+    ('c1a70000-0000-4000-8000-000000000001', 'machine', 'machine:fpRace',
+     '00000000-0000-4000-8000-0000000000c1', now() + interval '1 hour'),
+    ('c1a70000-0000-4000-8000-000000000001', 'machine', '  fpRace  ',
+     '00000000-0000-4000-8000-0000000000c2', now() + interval '1 hour');
+}
+
+teardown
+{
+  delete from agent_board.claims where agent_id = 'c1a70000-0000-4000-8000-000000000001';
+  delete from agent_board.agents where id = 'c1a70000-0000-4000-8000-000000000001';
+}
+
+# ra renews the 'machine:fpRace' row -> canonical 'fpRace' is free at its snapshot, so it takes
+# the slot and holds the uncommitted index entry.
+session "ra"
+step "ra_begin"  { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "ra_renew"  {
+  select resource_key
+    from agent_board.renew_claim('00000000-0000-4000-8000-0000000000c1', now() + interval '2 hours');
+}
+step "ra_commit" { COMMIT; }
+
+# rb renews the '  fpRace  ' row -> canonicalizes to the SAME 'fpRace'; its UPDATE blocks on ra's
+# index entry, then on ra commit hits unique_violation and the handler retries keeping '  fpRace  '.
+session "rb"
+step "rb_begin"  { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "rb_renew"  {
+  select resource_key
+    from agent_board.renew_claim('00000000-0000-4000-8000-0000000000c2', now() + interval '2 hours');
+}
+step "rb_commit" { COMMIT; }
+
+# checker: both leases remain active; ra healed to 'fpRace', rb kept its legacy '  fpRace  '.
+session "chk"
+step "chk" {
+  select resource_key
+    from agent_board.claims
+   where lease_token in ('00000000-0000-4000-8000-0000000000c1','00000000-0000-4000-8000-0000000000c2')
+   order by resource_key;
+}
+
+permutation "ra_begin" "ra_renew" "rb_begin" "rb_renew" "ra_commit" "rb_commit" "chk"

package/tests/isolation/specs/consent_approval_lock.spec

@@ -0,0 +1,98 @@
+# message-board#115 — the consent-approval SET-lock serialises a concurrent withdrawal.
+#
+# resolve_board_request opens with an UNFILTERED, id-ordered `for update` over the
+# WHOLE (board, agent) membership set, BEFORE it reads consent or writes. That
+# breadth is load-bearing: a concurrent self-withdrawal on a DIFFERENT physical row
+# (the active one) than the pending row being resolved must serialise behind it
+# (message-board#109). A pending-only / filtered / LIMITed lock would leave the
+# active row free and reopen the race.
+#
+# WHAT THIS PINS (and, deliberately, what it does NOT): on current code a lost
+# UPDATE is independently prevented by membership_id threading (the sink acts on the
+# exact row the resolver validated), so dropping the lock does NOT corrupt the final
+# state — it changes SERIALIZATION. The observable that regresses is the BLOCK
+# itself: with the lock, the withdrawer waits; without it (dropped OR narrowed), the
+# withdrawer proceeds immediately. isolationtester records that as the presence vs
+# absence of `<waiting ...>` in the trace, and the golden diff is the signal. This is
+# exactly how Postgres's own isolation suite pins lock behaviour.
+#
+# THE SURGICAL PERMUTATION: the subject S carries a legal (active A, pending P)
+# duplicate. The approver resolves S to 'joined' — with an active row present this is
+# the Option-1 path: resolve acquires the SET-lock and returns the ACTIVE row A
+# untouched. (Post-#116 it also retires the dangling pending row P via the sink — a
+# write to P, never to A.) So resolve never WRITES A; the SET-lock is the ONLY thing
+# it does to A, isolating the lock as the single variable. The withdrawer withdraws
+# the ACTIVE row A; it blocks on the SET-lock, then applies after commit.
+#
+# Both sessions run as service_role — the SET-lock sits AFTER the actor check and is
+# actor-independent, so this needs no auth.users identity substrate; the lock trace
+# is identical to the authenticated path.
+#
+# MUTATION SIGNAL (a TRACE diff): drop the `for update` block, OR narrow it with
+# `and bm.membership_state in ('requested','invited')` — either leaves A unlocked, so
+# w_leave no longer shows `<waiting ...>` and the golden diverges. Both mutations are
+# verified in the PR.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, handle, display_name, status) values
+    ('115a0000-0000-4000-8000-000000000001', 'agent', 'iso115-owner',   'Iso115 Owner',   'active'),
+    ('115a0000-0000-4000-8000-000000000002', 'agent', 'iso115-subject', 'Iso115 Subject', 'active');
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+    values ('115b0000-0000-4000-8000-000000000001', 'iso115-board', 'Iso115 Board',
+            '115a0000-0000-4000-8000-000000000001', 'private', 'active');
+  -- Legal (active, pending) duplicate for the subject: A is joined (active), P is a
+  -- separate pending request. The active-unique index permits it (only A is active).
+  insert into agent_board.board_memberships(id, board_id, agent_id, membership_state, role, created_by_agent_id) values
+    ('115c0000-0000-4000-8000-0000000000aa', '115b0000-0000-4000-8000-000000000001',
+     '115a0000-0000-4000-8000-000000000002', 'joined',    'member', '115a0000-0000-4000-8000-000000000002'),
+    ('115c0000-0000-4000-8000-0000000000bb', '115b0000-0000-4000-8000-000000000001',
+     '115a0000-0000-4000-8000-000000000002', 'requested', 'member', '115a0000-0000-4000-8000-000000000002');
+}
+
+teardown
+{
+  delete from agent_board.board_membership_events where board_id = '115b0000-0000-4000-8000-000000000001';
+  delete from agent_board.board_memberships     where board_id = '115b0000-0000-4000-8000-000000000001';
+  delete from agent_board.boards                where id       = '115b0000-0000-4000-8000-000000000001';
+  delete from agent_board.agents                where id in ('115a0000-0000-4000-8000-000000000001','115a0000-0000-4000-8000-000000000002');
+}
+
+# approver resolves the subject to 'joined'. With active row A present this is the
+# Option-1 path — it acquires the whole-set `for update` and returns A untouched
+# (retiring the dangling pending row P via the sink, but never writing A).
+session "approver"
+step "a_begin"   { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "a_resolve" {
+  select membership_state
+    from agent_board.resolve_board_request(
+      '115b0000-0000-4000-8000-000000000001',
+      '115a0000-0000-4000-8000-000000000002',
+      'joined',
+      '115a0000-0000-4000-8000-000000000001');
+}
+step "a_commit"  { COMMIT; }
+
+# withdrawer withdraws the subject's ACTIVE membership (row A). Its write blocks on
+# the approver's whole-set lock until the approver commits.
+session "withdrawer"
+step "w_begin"   { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "w_leave"   {
+  select membership_state
+    from agent_board.update_board_membership(
+      '115b0000-0000-4000-8000-000000000001',
+      '115a0000-0000-4000-8000-000000000002',
+      'left');
+}
+step "w_commit"  { COMMIT; }
+
+# checker asserts the active row landed 'left' — the withdrawal applied, serialised
+# after the approval, not overwritten.
+session "checker"
+step "chk" {
+  select membership_state
+    from agent_board.board_memberships
+   where id = '115c0000-0000-4000-8000-0000000000aa';
+}
+
+permutation "a_begin" "a_resolve" "w_begin" "w_leave" "a_commit" "w_commit" "chk"

package/tests/isolation/specs/consent_emit_actual_state.spec

@@ -0,0 +1,79 @@
+# message-board#105 — membership writers emit the ACTUAL row state, not a literal.
+#
+# bootstrap_board_owner_memberships upserts the owner membership with
+# `INSERT ... ON CONFLICT (board_id, agent_id) WHERE (active) DO UPDATE SET role='owner'`
+# and emits `RETURNING bm.membership_state` (the ACTUAL post-upsert state), NOT a
+# literal 'joined'. The ON CONFLICT branch lifts only the role, so a membership a
+# concurrent session already made 'subscribed' STAYS subscribed — and the emitted
+# ledger event must say 'subscribed', not 'joined'.
+#
+# That conflict branch is only reachable under concurrency (a single-transaction
+# pgTAP file cannot produce it): bootstrap's eligibility read must see the owner as
+# having NO active membership (so it enters the loop and attempts the INSERT), yet
+# its INSERT must collide with an active row. We force it deterministically:
+#
+#   maker holds an UNCOMMITTED 'subscribed' owner membership. Its row is invisible
+#   to boot's eligibility read (READ COMMITTED), so boot enters the loop; boot's
+#   INSERT then BLOCKS on maker's uncommitted entry in the partial active-unique
+#   index (isolationtester reports <waiting>). maker commits; boot's ON CONFLICT
+#   resolves against the now-committed 'subscribed' row and emits result_state
+#   'subscribed'.
+#
+# MUTATION SIGNAL (a VALUE diff): revert the emit to a literal 'joined' and the
+# checker step reports 'joined' instead of 'subscribed' — the golden diverges.
+#
+# bootstrap()'s output is filtered to this board and projects only the two FIXED
+# UUIDs (never the random membership_id) so the golden is deterministic.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, handle, display_name, status)
+    values ('105a0000-0000-4000-8000-000000000001', 'agent', 'iso105-owner', 'Iso105 Owner', 'active');
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+    values ('105b0000-0000-4000-8000-000000000001', 'iso105-board', 'Iso105 Board',
+            '105a0000-0000-4000-8000-000000000001', 'private', 'active');
+}
+
+teardown
+{
+  delete from agent_board.board_membership_events where board_id = '105b0000-0000-4000-8000-000000000001';
+  delete from agent_board.board_memberships     where board_id = '105b0000-0000-4000-8000-000000000001';
+  delete from agent_board.boards                where id       = '105b0000-0000-4000-8000-000000000001';
+  delete from agent_board.agents                where id       = '105a0000-0000-4000-8000-000000000001';
+}
+
+# maker creates (but does not yet commit) an ACTIVE 'subscribed' owner membership.
+session "maker"
+step "m_begin"  { BEGIN; }
+step "m_sub"    {
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
+  values ('105b0000-0000-4000-8000-000000000001', '105a0000-0000-4000-8000-000000000001',
+          'subscribed', 'member', '105a0000-0000-4000-8000-000000000001');
+}
+step "m_commit" { COMMIT; }
+
+# boot runs the operator bootstrap (service_role-only). Projects only the two fixed
+# UUIDs for THIS board so the trace is deterministic.
+session "boot"
+step "b_begin"  { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "b_boot"   {
+  select board_id, owner_agent_id
+    from agent_board.bootstrap_board_owner_memberships()
+   where board_id = '105b0000-0000-4000-8000-000000000001';
+}
+step "b_commit" { COMMIT; }
+
+# checker reads the emitted ledger event: its result_state must be the ACTUAL row
+# state ('subscribed'), not the literal 'joined'.
+session "checker"
+step "chk" {
+  select result_state, event_kind, provenance
+    from agent_board.board_membership_events
+   where board_id = '105b0000-0000-4000-8000-000000000001'
+     and agent_id = '105a0000-0000-4000-8000-000000000001'
+     and event_kind = 'operator_repair'
+   order by seq desc
+   limit 1;
+}
+
+permutation "m_begin" "m_sub" "b_begin" "b_boot" "m_commit" "b_commit" "chk"

package/tests/isolation/specs/domain_reclaim_revoke_race.spec

@@ -0,0 +1,88 @@
+# #153 TOCTOU — reclaim_fleet_trust_domain serializes against a concurrent squatter
+# revoke('trust_domain'), and revoke re-checks domain ownership UNDER a row lock.
+#
+# revoke_fleet_subject's trust_domain-ownership authz check was UNLOCKED: a squatter could call
+# revoke('trust_domain', D); its ownership SELECT reads owner=squatter (passes) with no lock, then
+# its lifecycle UPDATE blocks on reclaim's `select ... for update` and — pre-fix — applies AFTER
+# reclaim commits (owner=new_owner), revoking the domain the operator just handed over (a
+# DoS-flavoured defeat of reclaim's atomicity — the exact whole-domain analogue of #150's machine
+# TOCTOU). The fix takes `select ... for update` on the owning fleet_trust_domains row BEFORE the
+# ownership check, so revoke serializes behind reclaim and the re-read sees committed ownership
+# (owner=new_owner) → the squatter's revoke is refused 42501.
+#
+# P1 — reclaim-vs-squatter-revoke (the pin). reclaim (service_role) takes the lock and holds it;
+# the squatter's authenticated revoke BLOCKS at its own FOR UPDATE (isolationtester prints
+# `<waiting ...>`), then after reclaim commits RE-READS ownership under the lock, sees owner=
+# new_owner, and RAISES `trust domain is not owned by current_agent_id()`. FINAL: owner=new_owner,
+# lifecycle=active — the reclaimed domain is NOT nuked.
+#
+# MUTATION SIGNAL: drop the trust_domain FOR UPDATE lock from revoke_fleet_subject → the squatter's
+# ownership SELECT reads the stale (pre-commit) owner=squatter and PASSES without waiting; revoke
+# then blocks at its lifecycle UPDATE, and after reclaim commits it SUCCEEDS (returns an event id)
+# and the checker shows lifecycle=revoked / owner=new_owner — the trace diverges from this golden.
+
+setup
+{
+  insert into auth.users(id) values ('b2000000-0000-4000-8000-000000000002');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id) values
+    ('a2000000-0000-4000-8000-000000000001', 'agent', 'domreclaim-iso-operator', 'Dom Reclaim Iso Operator', 'active', null),
+    ('a2000000-0000-4000-8000-000000000002', 'agent', 'domreclaim-iso-squatter', 'Dom Reclaim Iso Squatter', 'active', 'b2000000-0000-4000-8000-000000000002'),
+    ('a2000000-0000-4000-8000-000000000003', 'agent', 'domreclaim-iso-newowner', 'Dom Reclaim Iso New Owner', 'active', null);
+
+  -- An active domain owned by the squatter (the squatted domain).
+  insert into agent_board.fleet_trust_domains(id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values ('d2000000-0000-4000-8000-000000000001', 'domreclaim-iso-domain', 'Dom Reclaim Iso Domain', 'tailnet',
+          'a2000000-0000-4000-8000-000000000002', 'active', now());
+}
+
+teardown
+{
+  delete from agent_board.fleet_revocation_events where subject_id = 'd2000000-0000-4000-8000-000000000001';
+  delete from agent_board.fleet_trust_domains where id = 'd2000000-0000-4000-8000-000000000001';
+  delete from agent_board.agents where id in (
+    'a2000000-0000-4000-8000-000000000001',
+    'a2000000-0000-4000-8000-000000000002',
+    'a2000000-0000-4000-8000-000000000003');
+  delete from auth.users where id = 'b2000000-0000-4000-8000-000000000002';
+}
+
+# ra: the operator reclaim (service_role). Its `select ... for update` locks the domain row until
+# ra commits, reassigning ownership to the new owner.
+session "ra"
+step "ra_begin"   { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "ra_reclaim" {
+  select owner_agent_id
+    from agent_board.reclaim_fleet_trust_domain(
+      'd2000000-0000-4000-8000-000000000001', 'a2000000-0000-4000-8000-000000000003',
+      'a2000000-0000-4000-8000-000000000001', 'iso operator domain reclaim');
+}
+step "ra_commit"  { COMMIT; }
+
+# rb: the squatter's revoke via the authenticated domain-owner path. With the fix it BLOCKS at its
+# own FOR UPDATE, then re-reads committed ownership and is refused 42501.
+session "rb"
+step "rb_begin"  {
+  BEGIN;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = 'b2000000-0000-4000-8000-000000000002';
+}
+step "rb_revoke" {
+  select revocation_event_id
+    from agent_board.revoke_fleet_subject(
+      'trust_domain', 'd2000000-0000-4000-8000-000000000001', 'a2000000-0000-4000-8000-000000000002',
+      'iso squatter domain revoke', jsonb_build_object('redacted', true));
+}
+step "rb_commit" { COMMIT; }
+
+# checker: final ownership + lifecycle of the contested domain.
+session "chk"
+step "chk" {
+  select owner_agent_id, lifecycle_state
+    from agent_board.fleet_trust_domains
+   where id = 'd2000000-0000-4000-8000-000000000001';
+}
+
+# P1: reclaim holds the lock; the squatter's revoke blocks then is refused → domain stays active
+# under the new owner (the revoke is NOT applied).
+permutation "ra_begin" "ra_reclaim" "rb_begin" "rb_revoke" "ra_commit" "rb_commit" "chk"

package/tests/isolation/specs/reactivate_revoke_race.spec

@@ -0,0 +1,115 @@
+# #146 MUST-FIX 3 (concurrency) — reactivate_fleet_machine serializes against a concurrent
+# revoke, and re-checks the revoked precondition UNDER a row lock.
+#
+# reactivate_fleet_machine's read-decide-write was unconditional and unlocked: a revoke that
+# committed mid-operation could be silently overwritten (machine ends active with reactivated_at
+# newer than the revoke's event — the revoke, possibly a security response, is lost). The fix
+# takes `select ... for update` on the fleet_machines row before the still-revoked re-check, so
+# the whole operation serializes against revoke_fleet_subject (whose fleet_machines UPDATE also
+# locks that row).
+#
+# Two permutations, both service_role (reactivate is operator-only; revoke is operator here):
+#
+# P1 — reactivate-vs-revoke (the panel's requested pin). reactivate takes the lock and holds
+# it; the concurrent revoke BLOCKS (isolationtester prints `<waiting ...>`), then applies after
+# reactivate commits. FINAL: the machine is revoked and evaluate denies (machine_revoked) — the
+# revoke is NOT lost. Combined with MUST-FIX 1 (revoke advances effective_at=now()), the late
+# revoke both flips lifecycle AND post-dates reactivated_at, so both guards deny.
+#
+# P2 — reactivate-vs-reactivate (the for-update MUTATION signal). The second reactivate blocks
+# on the first's lock, then RE-READS under the lock: the machine is now active, so its
+# still-revoked re-check fails and it RAISES `fleet machine is not revoked; nothing to
+# reactivate`. MUTATION SIGNAL: drop `for update` from reactivate's read → the second reactivate
+# reads the stale (pre-commit) revoked snapshot, its re-check passes, and it succeeds instead of
+# raising — the `<waiting>`/error trace diverges from this golden.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, handle, display_name, status) values
+    ('a0000000-0000-4000-8000-000000000001', 'agent', 'react-iso-owner', 'React Iso Owner', 'active'),
+    ('a0000000-0000-4000-8000-000000000002', 'agent', 'react-iso-sender', 'React Iso Sender', 'active'),
+    ('a0000000-0000-4000-8000-000000000003', 'agent', 'react-iso-recip', 'React Iso Recipient', 'active');
+
+  insert into agent_board.fleet_trust_domains(id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values ('d0000000-0000-4000-8000-000000000001', 'react-iso-domain', 'React Iso Domain', 'tailnet',
+          'a0000000-0000-4000-8000-000000000001', 'active', now());
+
+  -- A machine that is already revoked (with a PRIOR machine-revocation event, effective 1h ago).
+  insert into agent_board.fleet_machines(id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+                                         lifecycle_state, enrollment_source, enrolled_at, revoked_at, reactivated_at, metadata)
+  values ('60000000-0000-4000-8000-000000000001', 'd0000000-0000-4000-8000-000000000001',
+          'a0000000-0000-4000-8000-000000000001', 'react-iso-m', 'sha256:react-iso-m',
+          'revoked', 'portal', now(), now(), null, jsonb_build_object('redacted', true, 'metadata-safe', true));
+
+  insert into agent_board.fleet_machine_agents(machine_id, agent_id, agent_role)
+  values ('60000000-0000-4000-8000-000000000001', 'a0000000-0000-4000-8000-000000000002', 'phase_worker');
+
+  insert into agent_board.fleet_revocation_events(id, subject_kind, subject_id, machine_id, revoked_by_agent_id, revocation_reason, effective_at, metadata)
+  values ('e0000000-0000-4000-8000-000000000001', 'machine', '60000000-0000-4000-8000-000000000001', '60000000-0000-4000-8000-000000000001',
+          'a0000000-0000-4000-8000-000000000001', 'iso initial revoke', now() - interval '1 hour',
+          jsonb_build_object('redacted', true, 'metadata-safe', true));
+
+  -- Allow-by-default receive policy so a non-revoked bound machine would pass; the only lever
+  -- the checker exercises is the machine-revocation state.
+  insert into agent_board.fleet_receive_policies(recipient_agent_id, policy_name, default_action, require_signed_sender, lifecycle_state, metadata)
+  values ('a0000000-0000-4000-8000-000000000003', 'react iso allow', 'allow', false, 'active', jsonb_build_object());
+}
+
+teardown
+{
+  delete from agent_board.fleet_revocation_events where subject_id = '60000000-0000-4000-8000-000000000001';
+  delete from agent_board.fleet_machine_agents where machine_id = '60000000-0000-4000-8000-000000000001';
+  delete from agent_board.fleet_machines where id = '60000000-0000-4000-8000-000000000001';
+  delete from agent_board.fleet_receive_policies where recipient_agent_id = 'a0000000-0000-4000-8000-000000000003';
+  delete from agent_board.fleet_trust_domains where id = 'd0000000-0000-4000-8000-000000000001';
+  delete from agent_board.agents where id in (
+    'a0000000-0000-4000-8000-000000000001',
+    'a0000000-0000-4000-8000-000000000002',
+    'a0000000-0000-4000-8000-000000000003');
+}
+
+# ra: the reactivation. Its `select ... for update` locks the machine row until ra commits.
+session "ra"
+step "ra_begin"  { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "ra_react"  {
+  select lifecycle_state
+    from agent_board.reactivate_fleet_machine(
+      '60000000-0000-4000-8000-000000000001', 'a0000000-0000-4000-8000-000000000001', 'iso reactivate');
+}
+step "ra_commit" { COMMIT; }
+
+# rb: a competing writer — either a revoke (P1) or a second reactivate (P2). Its row write
+# blocks on ra's lock until ra commits.
+session "rb"
+step "rb_begin"   { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "rb_revoke"  {
+  select revocation_event_id
+    from agent_board.revoke_fleet_subject(
+      'machine', '60000000-0000-4000-8000-000000000001', 'a0000000-0000-4000-8000-000000000001',
+      'iso re-revoke', jsonb_build_object('redacted', true));
+}
+step "rb_react"   {
+  select lifecycle_state
+    from agent_board.reactivate_fleet_machine(
+      '60000000-0000-4000-8000-000000000001', 'a0000000-0000-4000-8000-000000000001', 'iso second reactivate');
+}
+step "rb_commit"  { COMMIT; }
+
+# checker: final machine lifecycle + the policy verdict for the bound sender.
+session "chk"
+step "chk" {
+  select fm.lifecycle_state,
+         (select denial_class
+            from agent_board.evaluate_fleet_sender_policy(
+              'a0000000-0000-4000-8000-000000000002', 'a0000000-0000-4000-8000-000000000003',
+              fm.id, null, 'send_direct_message', null, false)) as denial_class
+    from agent_board.fleet_machines fm
+   where fm.id = '60000000-0000-4000-8000-000000000001';
+}
+
+# P1: reactivate holds the lock; the revoke blocks then applies → final revoked + denied.
+permutation "ra_begin" "ra_react" "rb_begin" "rb_revoke" "ra_commit" "rb_commit" "chk"
+
+# P2: reactivate holds the lock; the second reactivate blocks, re-reads under the lock, and
+# raises (nothing to reactivate) → the for-update mutation signal.
+permutation "ra_begin" "ra_react" "rb_begin" "rb_react" "ra_commit" "rb_commit" "chk"

package/tests/isolation/specs/reclaim_revoke_race.spec

@@ -0,0 +1,94 @@
+# #150 MUST-FIX 1 (codex) — reclaim_fleet_machine serializes against a concurrent squatter
+# revoke('machine'), and revoke re-checks machine ownership UNDER a row lock.
+#
+# revoke_fleet_subject's machine-ownership authz check was UNLOCKED: a squatter could call
+# revoke('machine', M); its ownership SELECT reads owner=squatter (passes) with no lock, then its
+# lifecycle UPDATE blocks on reclaim's `select ... for update` and — pre-fix — applies AFTER
+# reclaim commits (owner=new_owner), revoking the machine the operator just handed over (a
+# DoS-flavoured defeat of reclaim's atomicity). The fix takes `select ... for update` on the owning
+# fleet_machines row BEFORE the ownership check, so revoke serializes behind reclaim and the
+# re-read sees committed ownership (owner=new_owner) → the squatter's revoke is refused 42501.
+#
+# P1 — reclaim-vs-squatter-revoke (the pin). reclaim (service_role) takes the lock and holds it;
+# the squatter's authenticated revoke BLOCKS at its own FOR UPDATE (isolationtester prints
+# `<waiting ...>`), then after reclaim commits RE-READS ownership under the lock, sees owner=
+# new_owner, and RAISES `machine is not owned by current_agent_id()`. FINAL: owner=new_owner,
+# lifecycle=active — the reclaimed machine is NOT nuked.
+#
+# MUTATION SIGNAL: drop the FOR UPDATE lock from revoke_fleet_subject → the squatter's ownership
+# SELECT reads the stale (pre-commit) owner=squatter and PASSES without waiting; revoke then blocks
+# at its lifecycle UPDATE, and after reclaim commits it SUCCEEDS (returns an event id) and the
+# checker shows lifecycle=revoked / owner=new_owner — the trace diverges from this golden.
+
+setup
+{
+  insert into auth.users(id) values ('b1000000-0000-4000-8000-000000000002');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id) values
+    ('a1000000-0000-4000-8000-000000000001', 'agent', 'reclaim-iso-operator', 'Reclaim Iso Operator', 'active', null),
+    ('a1000000-0000-4000-8000-000000000002', 'agent', 'reclaim-iso-squatter', 'Reclaim Iso Squatter', 'active', 'b1000000-0000-4000-8000-000000000002'),
+    ('a1000000-0000-4000-8000-000000000003', 'agent', 'reclaim-iso-newowner', 'Reclaim Iso New Owner', 'active', null);
+
+  insert into agent_board.fleet_trust_domains(id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at)
+  values ('d1000000-0000-4000-8000-000000000001', 'reclaim-iso-domain', 'Reclaim Iso Domain', 'tailnet',
+          'a1000000-0000-4000-8000-000000000002', 'active', now());
+
+  -- An active machine owned by the squatter (the pre-registered/squatted fingerprint).
+  insert into agent_board.fleet_machines(id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+                                         lifecycle_state, enrollment_source, enrolled_at, revoked_at, metadata)
+  values ('61000000-0000-4000-8000-000000000001', 'd1000000-0000-4000-8000-000000000001',
+          'a1000000-0000-4000-8000-000000000002', 'reclaim-iso-m', 'sha256:reclaim-iso-m',
+          'active', 'portal', now(), null, jsonb_build_object('redacted', true, 'metadata-safe', true));
+}
+
+teardown
+{
+  delete from agent_board.fleet_revocation_events where subject_id = '61000000-0000-4000-8000-000000000001';
+  delete from agent_board.fleet_machines where id = '61000000-0000-4000-8000-000000000001';
+  delete from agent_board.fleet_trust_domains where id = 'd1000000-0000-4000-8000-000000000001';
+  delete from agent_board.agents where id in (
+    'a1000000-0000-4000-8000-000000000001',
+    'a1000000-0000-4000-8000-000000000002',
+    'a1000000-0000-4000-8000-000000000003');
+  delete from auth.users where id = 'b1000000-0000-4000-8000-000000000002';
+}
+
+# ra: the operator reclaim (service_role). Its `select ... for update` locks the machine row until
+# ra commits, reassigning ownership to the new owner.
+session "ra"
+step "ra_begin"   { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "ra_reclaim" {
+  select owner_agent_id
+    from agent_board.reclaim_fleet_machine(
+      '61000000-0000-4000-8000-000000000001', 'a1000000-0000-4000-8000-000000000003',
+      'a1000000-0000-4000-8000-000000000001', 'iso operator reclaim');
+}
+step "ra_commit"  { COMMIT; }
+
+# rb: the squatter's revoke via the authenticated domain-owner path. With the fix it BLOCKS at its
+# own FOR UPDATE, then re-reads committed ownership and is refused 42501.
+session "rb"
+step "rb_begin"  {
+  BEGIN;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = 'b1000000-0000-4000-8000-000000000002';
+}
+step "rb_revoke" {
+  select revocation_event_id
+    from agent_board.revoke_fleet_subject(
+      'machine', '61000000-0000-4000-8000-000000000001', 'a1000000-0000-4000-8000-000000000002',
+      'iso squatter revoke', jsonb_build_object('redacted', true));
+}
+step "rb_commit" { COMMIT; }
+
+# checker: final ownership + lifecycle of the contested machine.
+session "chk"
+step "chk" {
+  select owner_agent_id, lifecycle_state
+    from agent_board.fleet_machines
+   where id = '61000000-0000-4000-8000-000000000001';
+}
+
+# P1: reclaim holds the lock; the squatter's revoke blocks then is refused → machine stays active
+# under the new owner (the revoke is NOT applied).
+permutation "ra_begin" "ra_reclaim" "rb_begin" "rb_revoke" "ra_commit" "rb_commit" "chk"

package/tests/seeds/20260806000100_agent_board_consent_substrate.sql.pre.sql

@@ -0,0 +1,19 @@
+-- message-board#103 — pre-MBCONSENT-A seed: a legacy PENDING membership that predates the consent
+-- ledger, so the shipped backfill (20260806000100, board-authored neutral event per pending
+-- subject) has a real row to act on. Applied by the test runner immediately BEFORE that migration
+-- (schema is at the migration-N-1 state here — board_membership_events does not exist yet).
+--
+-- Distinctive fixed ids (bf103-*) so the row does not collide with any test's own fixtures. The
+-- board's creator differs from the member, satisfying the backfill's board-authored predicate.
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+values
+  ('bf103aaa-0000-0000-0000-000000000001', 'agent', 'agent', 'bf103-creator', 'BF103 Creator', 'active'),
+  ('bf103aaa-0000-0000-0000-000000000002', 'agent', 'agent', 'bf103-member',  'BF103 Member',  'active')
+on conflict (id) do nothing;
+
+insert into agent_board.boards(id, slug, name, description, created_by_agent_id)
+values ('bf103bbb-0000-0000-0000-0000000000b1', 'bf103-board', 'BF103 Board', 'consent backfill seed', 'bf103aaa-0000-0000-0000-000000000001')
+on conflict (id) do nothing;
+
+insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+values ('bf103bbb-0000-0000-0000-0000000000b1', 'bf103aaa-0000-0000-0000-000000000002', 'requested', 'bf103aaa-0000-0000-0000-000000000001', 'member');

package/tests/seeds/20260822000200_agent_board_mint_harden_fingerprint_backfill.sql.pre.sql

@@ -0,0 +1,39 @@
+-- Pre-migration seed (message-board#103 hook) for the MINTHARDEN fingerprint backfill.
+--
+-- Runs immediately BEFORE 20260822000200 — i.e. AFTER 20260822000100 installed the
+-- integrity trigger and helpers. It simulates a row that predates the trigger: a
+-- string-era mint child signing key with a CANONICAL public_key but a fingerprint
+-- derived over the base64url STRING (the 20260718001000:203 bug). Such a row can only
+-- exist by bypassing the new trigger, so it is inserted under session_replication_role=
+-- replica — exactly reproducing a legacy row created before the trigger existed.
+--
+-- The backfill (20260822000200) must re-derive its fingerprint to the raw-byte value;
+-- agent_board_mint_harden_backfill.test.sql asserts the SHIPPED backfill did so
+-- (behavioural — a mutation removing the UPDATE leaves the stale string fingerprint and
+-- the assertion fails). Distinctive fixed ids so nothing collides with other fixtures.
+do $$
+declare
+  v_owner uuid;
+  v_agent uuid := 'fb111111-0000-4b11-8000-000000000200';
+  v_key   uuid := 'fb111111-0000-4b11-8000-000000000201';
+  v_pub   text := public.test_pubkey('fbfill-legacy-1');
+  -- The OLD string-era derivation: sha256 over the base64url STRING bytes (not the raw key).
+  v_string_fp text := 'sha256:' || rtrim(translate(encode(
+    extensions.digest(convert_to(public.test_pubkey('fbfill-legacy-1'), 'UTF8'), 'sha256'), 'base64'), '+/', '-_'), '=');
+begin
+  v_owner := public.ensure_github_user(
+    'fbfill-legacy-owner', 'fbfill-legacy-owner@example.test', 'fbfill-legacy-owner', 'FB Legacy Owner');
+
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_agent, 'agent', 'agent'::agent_board.agent_kind, 'fbfill-legacy-agent', 'FB Legacy Agent',
+          'active', v_owner, v_owner);
+
+  -- Bypass the 20260822000100 integrity trigger to plant the legacy (string-fingerprint) row.
+  set local session_replication_role = replica;
+  insert into agent_board.agent_signing_keys(
+    id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state, metadata)
+  values (v_key, v_agent, 'delegated-ephemeral', 1, v_pub, 'raw_ed25519_base64url', v_string_fp,
+          'active', 'proven', jsonb_build_object('legacyStringFingerprint', true));
+  set local session_replication_role = default;
+end
+$$;