@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/isolation/expected/atomic_fleet_lifecycle_races.out

@@ -0,0 +1,1479 @@
+Parsed test spec with 3 sessions
+
+starting permutation: retry_begin retry_onboard lifecycle_begin revoke_fleet_agent retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_fleet_agent: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'agent', (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation agent revoke', jsonb_build_object()
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_fleet_agent: <... completed>
+subject_kind
+------------
+agent       
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |revoked      |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin revoke_fleet_key retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_fleet_key: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'signing_key', (select k.id from agent_board.agent_signing_keys k join agent_board.agents a on a.id=k.agent_id where a.handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation key revoke', jsonb_build_object()
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_fleet_key: <... completed>
+subject_kind
+------------
+signing_key 
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |revoked   |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin revoke_agent retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select status from agent_board.revoke_agent(
+    (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    'isolation legacy agent revoke'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_agent: <... completed>
+status   
+---------
+suspended
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+suspended   |active    |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin revoke_agent_subtree retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent_subtree: 
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation agent subtree revoke'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_agent_subtree: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+revoked     |revoked   |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin revoke_human_subtree retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_human_subtree: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select owner_user_id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation human subtree revoke'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_human_subtree: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+revoked     |revoked   |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin revoke_harness retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_harness: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'harness', (select id from agent_board.fleet_harness_registrations where machine_id='16240000-0000-0000-0000-000000000003'),
+    '16240000-0000-0000-0000-000000000001', 'isolation harness revoke', jsonb_build_object()
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_harness: <... completed>
+subject_kind
+------------
+harness     
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |revoked      |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin revoke_repo retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_repo: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'repo_scope', (select frs.id from agent_board.fleet_repo_scopes frs join agent_board.fleet_harness_registrations fhr on fhr.id=frs.harness_registration_id where fhr.machine_id='16240000-0000-0000-0000-000000000003'),
+    '16240000-0000-0000-0000-000000000001', 'isolation repo revoke', jsonb_build_object()
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_repo: <... completed>
+subject_kind
+------------
+repo_scope  
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |active       |revoked   |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin revoke_machine retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_machine: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'machine', '16240000-0000-0000-0000-000000000003',
+    '16240000-0000-0000-0000-000000000001', 'isolation machine revoke', jsonb_build_object()
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_machine: <... completed>
+subject_kind
+------------
+machine     
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |active       |active    |revoked      |active      |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin reclaim_machine retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step reclaim_machine: 
+  select owner_agent_id from agent_board.reclaim_fleet_machine(
+    '16240000-0000-0000-0000-000000000003',
+    '16240000-0000-0000-0000-000000000004',
+    '16240000-0000-0000-0000-000000000001', 'isolation machine reclaim'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step reclaim_machine: <... completed>
+                      owner_agent_id
+------------------------------------
+16240000-0000-0000-0000-000000000004
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |revoked      |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin revoke_domain retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_domain: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'trust_domain', '16240000-0000-0000-0000-000000000002',
+    '16240000-0000-0000-0000-000000000001', 'isolation domain revoke', jsonb_build_object()
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_domain: <... completed>
+subject_kind
+------------
+trust_domain
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |active       |active    |active       |revoked     |     1|       1
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard lifecycle_begin reclaim_domain retry_commit lifecycle_commit check
+count
+-----
+    1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step reclaim_domain: 
+  select owner_agent_id from agent_board.reclaim_fleet_trust_domain(
+    '16240000-0000-0000-0000-000000000002',
+    '16240000-0000-0000-0000-000000000004',
+    '16240000-0000-0000-0000-000000000001', 'isolation domain reclaim'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step reclaim_domain: <... completed>
+                      owner_agent_id
+------------------------------------
+16240000-0000-0000-0000-000000000004
+(1 row)
+
+step lifecycle_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin revoke_fleet_agent retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_fleet_agent: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'agent', (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation agent revoke', jsonb_build_object()
+  );
+
+subject_kind
+------------
+agent       
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |revoked      |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin revoke_fleet_key retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_fleet_key: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'signing_key', (select k.id from agent_board.agent_signing_keys k join agent_board.agents a on a.id=k.agent_id where a.handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation key revoke', jsonb_build_object()
+  );
+
+subject_kind
+------------
+signing_key 
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  enrollment replay conflicts with the frozen identity contract
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |revoked   |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin revoke_agent retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select status from agent_board.revoke_agent(
+    (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    'isolation legacy agent revoke'
+  );
+
+status   
+---------
+suspended
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  enrollment replay conflicts with the frozen identity contract
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+suspended   |active    |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin revoke_agent_subtree retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent_subtree: 
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation agent subtree revoke'
+  );
+
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  enrollment replay conflicts with the frozen identity contract
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+revoked     |revoked   |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin revoke_human_subtree retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_human_subtree: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select owner_user_id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation human subtree revoke'
+  );
+
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  human owner has been revoked
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+revoked     |revoked   |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin revoke_harness retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_harness: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'harness', (select id from agent_board.fleet_harness_registrations where machine_id='16240000-0000-0000-0000-000000000003'),
+    '16240000-0000-0000-0000-000000000001', 'isolation harness revoke', jsonb_build_object()
+  );
+
+subject_kind
+------------
+harness     
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |revoked      |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin revoke_repo retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_repo: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'repo_scope', (select frs.id from agent_board.fleet_repo_scopes frs join agent_board.fleet_harness_registrations fhr on fhr.id=frs.harness_registration_id where fhr.machine_id='16240000-0000-0000-0000-000000000003'),
+    '16240000-0000-0000-0000-000000000001', 'isolation repo revoke', jsonb_build_object()
+  );
+
+subject_kind
+------------
+repo_scope  
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |active       |revoked   |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin revoke_machine retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_machine: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'machine', '16240000-0000-0000-0000-000000000003',
+    '16240000-0000-0000-0000-000000000001', 'isolation machine revoke', jsonb_build_object()
+  );
+
+subject_kind
+------------
+machine     
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding machine is not usable
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |active       |active    |revoked      |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin reclaim_machine retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step reclaim_machine: 
+  select owner_agent_id from agent_board.reclaim_fleet_machine(
+    '16240000-0000-0000-0000-000000000003',
+    '16240000-0000-0000-0000-000000000004',
+    '16240000-0000-0000-0000-000000000001', 'isolation machine reclaim'
+  );
+
+                      owner_agent_id
+------------------------------------
+16240000-0000-0000-0000-000000000004
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding machine is not usable
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |revoked      |active       |active    |active       |active      |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin revoke_domain retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_domain: 
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'trust_domain', '16240000-0000-0000-0000-000000000002',
+    '16240000-0000-0000-0000-000000000001', 'isolation domain revoke', jsonb_build_object()
+  );
+
+subject_kind
+------------
+trust_domain
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding trust domain is not usable
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |active       |active    |active       |revoked     |     1|       1
+(1 row)
+
+
+starting permutation: lifecycle_begin reclaim_domain retry_begin retry_onboard lifecycle_commit retry_commit check
+count
+-----
+    1
+(1 row)
+
+step lifecycle_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step reclaim_domain: 
+  select owner_agent_id from agent_board.reclaim_fleet_trust_domain(
+    '16240000-0000-0000-0000-000000000002',
+    '16240000-0000-0000-0000-000000000004',
+    '16240000-0000-0000-0000-000000000001', 'isolation domain reclaim'
+  );
+
+                      owner_agent_id
+------------------------------------
+16240000-0000-0000-0000-000000000004
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+ <waiting ...>
+step lifecycle_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding trust domain is not usable
+step retry_commit: COMMIT;
+step check: 
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+
+agent_status|key_status|binding_state|harness_state|repo_state|machine_state|domain_state|agents|bindings
+------------+----------+-------------+-------------+----------+-------------+------------+------+--------
+active      |active    |active       |active       |active    |active       |active      |     1|       1
+(1 row)
+