@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/isolation/expected/atomic_fleet_authority_races.out

@@ -0,0 +1,469 @@
+Parsed test spec with 4 sessions
+
+starting permutation: retry_begin retry_onboard invalidator_begin remove_member retry_commit invalidator_commit check
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step remove_member: 
+  select membership_state from agent_board.update_board_membership(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    (select id from agent_board.agents where handle='atomic-authority-agent'),
+    'removed', jsonb_build_object('reason','isolation member removal')
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step remove_member: <... completed>
+membership_state
+----------------
+removed         
+(1 row)
+
+step invalidator_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |owner/joined     |removed     |             
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard invalidator_begin revoke_creator retry_commit invalidator_commit check
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_creator: 
+  select status from agent_board.revoke_agent(
+    '16250000-0000-0000-0000-000000000001', 'isolation creator revoke'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_creator: <... completed>
+status   
+---------
+suspended
+(1 row)
+
+step invalidator_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+suspended     |owner/joined     |joined      |             
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard invalidator_begin demote_creator retry_commit invalidator_commit check
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step demote_creator: 
+  select role from agent_board.grant_board_role(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000001', 'observer',
+    '16250000-0000-0000-0000-000000000001'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step demote_creator: <... completed>
+role    
+--------
+observer
+(1 row)
+
+step invalidator_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |observer/joined  |joined      |             
+(1 row)
+
+
+starting permutation: invalidator_begin remove_member retry_begin retry_onboard invalidator_commit retry_commit check
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step remove_member: 
+  select membership_state from agent_board.update_board_membership(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    (select id from agent_board.agents where handle='atomic-authority-agent'),
+    'removed', jsonb_build_object('reason','isolation member removal')
+  );
+
+membership_state
+----------------
+removed         
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+ <waiting ...>
+step invalidator_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |owner/joined     |removed     |             
+(1 row)
+
+
+starting permutation: invalidator_begin revoke_creator retry_begin retry_onboard invalidator_commit retry_commit check
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_creator: 
+  select status from agent_board.revoke_agent(
+    '16250000-0000-0000-0000-000000000001', 'isolation creator revoke'
+  );
+
+status   
+---------
+suspended
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+ <waiting ...>
+step invalidator_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+suspended     |owner/joined     |joined      |             
+(1 row)
+
+
+starting permutation: invalidator_begin demote_creator retry_begin retry_onboard invalidator_commit retry_commit check
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step demote_creator: 
+  select role from agent_board.grant_board_role(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000001', 'observer',
+    '16250000-0000-0000-0000-000000000001'
+  );
+
+role    
+--------
+observer
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+ <waiting ...>
+step invalidator_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |observer/joined  |joined      |             
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard ceiling_begin set_ceiling retry_commit ceiling_commit check
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step ceiling_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '16250000-0000-0000-0000-0000000000a1';
+
+step set_ceiling: 
+  select ceiling_max_grantable_role from agent_board.set_board_authority_ceiling(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    'observer'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step set_ceiling: <... completed>
+ceiling_max_grantable_role
+--------------------------
+observer                  
+(1 row)
+
+step ceiling_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |owner/joined     |joined      |observer     
+(1 row)
+
+
+starting permutation: ceiling_begin set_ceiling retry_begin retry_onboard ceiling_commit retry_commit check
+step ceiling_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '16250000-0000-0000-0000-0000000000a1';
+
+step set_ceiling: 
+  select ceiling_max_grantable_role from agent_board.set_board_authority_ceiling(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    'observer'
+  );
+
+ceiling_max_grantable_role
+--------------------------
+observer                  
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+ <waiting ...>
+step ceiling_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |owner/joined     |joined      |observer     
+(1 row)
+

package/tests/isolation/expected/atomic_fleet_binding_revoke.out

@@ -0,0 +1,103 @@
+Parsed test spec with 3 sessions
+
+starting permutation: retry_begin retry_onboard revoke_begin revoke_binding retry_commit revoke_commit check_binding
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select binding_disposition from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-binding.test', 'message-board', 'human-binding',
+    jsonb_build_object('iss','https://atomic-binding.test','aud','message-board','sub','human-binding','iat',200),
+    'atomic-binding-agent','yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url','sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true,null,'agent',ARRAY['board:send'],ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16230000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-binding-board'),
+    '16230000-0000-0000-0000-000000000003','codex','phase-loop',
+    'message-board','sha256:atomic-binding-repo','worker','phase_worker','atomic-binding-agent'
+  );
+
+binding_disposition
+-------------------
+reused             
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_binding: 
+  select lifecycle_state from agent_board.revoke_fleet_machine_agent_binding(
+    (select id from agent_board.fleet_machine_agents where machine_id='16230000-0000-0000-0000-000000000003'),
+    '16230000-0000-0000-0000-000000000001','isolation proof',jsonb_build_object()
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_binding: <... completed>
+lifecycle_state
+---------------
+revoked        
+(1 row)
+
+step revoke_commit: COMMIT;
+step check_binding: 
+  select count(*) filter (where lifecycle_state='active') as active,
+         count(*) filter (where lifecycle_state='revoked') as revoked,
+         count(*) as total
+    from agent_board.fleet_machine_agents
+   where machine_id='16230000-0000-0000-0000-000000000003';
+
+active|revoked|total
+------+-------+-----
+     0|      1|    1
+(1 row)
+
+
+starting permutation: revoke_begin revoke_binding retry_begin retry_onboard revoke_commit retry_commit check_binding
+count
+-----
+    1
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_binding: 
+  select lifecycle_state from agent_board.revoke_fleet_machine_agent_binding(
+    (select id from agent_board.fleet_machine_agents where machine_id='16230000-0000-0000-0000-000000000003'),
+    '16230000-0000-0000-0000-000000000001','isolation proof',jsonb_build_object()
+  );
+
+lifecycle_state
+---------------
+revoked        
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select binding_disposition from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-binding.test', 'message-board', 'human-binding',
+    jsonb_build_object('iss','https://atomic-binding.test','aud','message-board','sub','human-binding','iat',200),
+    'atomic-binding-agent','yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url','sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true,null,'agent',ARRAY['board:send'],ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16230000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-binding-board'),
+    '16230000-0000-0000-0000-000000000003','codex','phase-loop',
+    'message-board','sha256:atomic-binding-repo','worker','phase_worker','atomic-binding-agent'
+  );
+ <waiting ...>
+step revoke_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check_binding: 
+  select count(*) filter (where lifecycle_state='active') as active,
+         count(*) filter (where lifecycle_state='revoked') as revoked,
+         count(*) as total
+    from agent_board.fleet_machine_agents
+   where machine_id='16230000-0000-0000-0000-000000000003';
+
+active|revoked|total
+------+-------+-----
+     0|      1|    1
+(1 row)
+