@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/isolation/expected/atomic_fleet_onboarding.out

@@ -0,0 +1,75 @@
+Parsed test spec with 3 sessions
+
+starting permutation: first_begin first_onboard second_begin second_onboard first_commit second_commit check
+count
+-----
+    1
+(1 row)
+
+step first_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step first_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+    from agent_board.onboard_federated_fleet_agent(
+      'https://atomic-race.test', 'message-board', 'human-race',
+      jsonb_build_object('iss','https://atomic-race.test','aud','message-board','sub','human-race','iat',100),
+      'atomic-race-agent',
+      'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
+      'raw_ed25519_base64url',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+      true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+      (select code from agent_board.board_invite_tokens where created_by_agent_id = '16220000-0000-0000-0000-000000000001'),
+      (select id from agent_board.boards where slug = 'atomic-race-board'),
+      '16220000-0000-0000-0000-000000000003',
+      'codex', 'phase-loop', 'message-board', 'sha256:atomic-race-repo',
+      'worker', 'phase_worker', 'atomic-race-agent'
+    );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+created             |created               |created            
+(1 row)
+
+step second_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step second_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+    from agent_board.onboard_federated_fleet_agent(
+      'https://atomic-race.test', 'message-board', 'human-race',
+      jsonb_build_object('iss','https://atomic-race.test','aud','message-board','sub','human-race','iat',200,'jti','rotated'),
+      'atomic-race-agent',
+      'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
+      'raw_ed25519_base64url',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+      true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+      (select code from agent_board.board_invite_tokens where created_by_agent_id = '16220000-0000-0000-0000-000000000001'),
+      (select id from agent_board.boards where slug = 'atomic-race-board'),
+      '16220000-0000-0000-0000-000000000003',
+      'codex', 'phase-loop', 'message-board', 'sha256:atomic-race-repo',
+      'worker', 'phase_worker', 'atomic-race-agent'
+    );
+ <waiting ...>
+step first_commit: COMMIT;
+step second_onboard: <... completed>
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step second_commit: COMMIT;
+step check: 
+  select count(*) as agents,
+         (select count(*) from agent_board.agent_signing_keys k
+           join agent_board.agents a on a.id=k.agent_id
+          where a.handle='atomic-race-agent') as keys,
+         (select count(*) from agent_board.board_invite_redemptions r
+           join agent_board.board_invite_tokens i on i.id=r.invite_id
+          where i.created_by_agent_id='16220000-0000-0000-0000-000000000001') as redemptions,
+         (select count(*) from agent_board.fleet_machine_agents b
+           join agent_board.agents a on a.id=b.agent_id
+          where a.handle='atomic-race-agent') as bindings
+    from agent_board.agents where handle='atomic-race-agent';
+
+agents|keys|redemptions|bindings
+------+----+-----------+--------
+     1|   1|          1|       1
+(1 row)
+

package/tests/isolation/expected/atomic_fleet_subtree_lock_order.out

@@ -0,0 +1,60 @@
+Parsed test spec with 4 sessions
+
+starting permutation: blocker_begin blocker_lock retry_begin retry_onboard subtree_begin revoke_human_subtree blocker_commit subtree_commit retry_commit check
+step blocker_begin: BEGIN;
+step blocker_lock: 
+  select pg_advisory_xact_lock(hashtextextended('sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA', 0));
+
+pg_advisory_xact_lock
+---------------------
+                     
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-subtree.test', 'message-board', 'human-subtree',
+    jsonb_build_object('iss','https://atomic-subtree.test','aud','message-board','sub','human-subtree','iat',200),
+    'atomic-subtree-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='ffffffff-ffff-ffff-ffff-ffffffffff01'),
+    (select id from agent_board.boards where slug='atomic-subtree-board'),
+    '16270000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-subtree-repo', 'worker', 'phase_worker',
+    'atomic-subtree-agent'
+  );
+ <waiting ...>
+step subtree_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_human_subtree: 
+  select revoked_agent_count
+  from agent_board.revoke_human_subtree(
+    (select owner_user_id from agent_board.agents where handle='atomic-subtree-agent'),
+    'ffffffff-ffff-ffff-ffff-ffffffffff01', 'isolation subtree revoke'
+  );
+
+revoked_agent_count
+-------------------
+                  2
+(1 row)
+
+step blocker_commit: COMMIT;
+step subtree_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  human owner has been revoked
+step retry_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='ffffffff-ffff-ffff-ffff-ffffffffff01') as creator_status,
+    (select status from agent_board.agents where handle='atomic-subtree-agent') as enrolled_status,
+    (select status from agent_board.agent_signing_keys where fingerprint='sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA') as key_status,
+    (select count(*) from agent_board.fleet_machine_agents where machine_id='16270000-0000-0000-0000-000000000003') as bindings;
+
+creator_status|enrolled_status|key_status|bindings
+--------------+---------------+----------+--------
+revoked       |revoked        |revoked   |       1
+(1 row)
+

package/tests/isolation/expected/ceiling_setter_lock_before_upsert.out

@@ -0,0 +1,95 @@
+Parsed test spec with 4 sessions
+
+starting permutation: holder_begin hold_ceiling_lock setter_begin set_ceiling probe_begin probe_ceiling_row probe_commit holder_commit setter_commit check
+step holder_begin: BEGIN;
+step hold_ceiling_lock: 
+  select agent_board._lock_board_authority_ceiling(
+    (select id from agent_board.boards where slug='ceiling-order-board')) as locked;
+
+locked
+------
+      
+(1 row)
+
+step setter_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '19600000-0000-0000-0000-0000000000a1';
+
+step set_ceiling: 
+  select ceiling_max_grantable_role from agent_board.set_board_authority_ceiling(
+    (select id from agent_board.boards where slug='ceiling-order-board'),
+    'member'
+  );
+ <waiting ...>
+step probe_begin: BEGIN;
+step probe_ceiling_row: 
+  select max_grantable_role from agent_board.board_authority_ceilings
+   where board_id = (select id from agent_board.boards where slug='ceiling-order-board')
+   for update nowait;
+
+max_grantable_role
+------------------
+admin             
+(1 row)
+
+step probe_commit: COMMIT;
+step holder_commit: COMMIT;
+step set_ceiling: <... completed>
+ceiling_max_grantable_role
+--------------------------
+member                    
+(1 row)
+
+step setter_commit: COMMIT;
+step check: 
+  select max_grantable_role from agent_board.board_authority_ceilings
+   where board_id = (select id from agent_board.boards where slug='ceiling-order-board');
+
+max_grantable_role
+------------------
+member            
+(1 row)
+
+
+starting permutation: setter_begin set_ceiling setter_commit probe_begin probe_ceiling_row probe_commit check
+step setter_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '19600000-0000-0000-0000-0000000000a1';
+
+step set_ceiling: 
+  select ceiling_max_grantable_role from agent_board.set_board_authority_ceiling(
+    (select id from agent_board.boards where slug='ceiling-order-board'),
+    'member'
+  );
+
+ceiling_max_grantable_role
+--------------------------
+member                    
+(1 row)
+
+step setter_commit: COMMIT;
+step probe_begin: BEGIN;
+step probe_ceiling_row: 
+  select max_grantable_role from agent_board.board_authority_ceilings
+   where board_id = (select id from agent_board.boards where slug='ceiling-order-board')
+   for update nowait;
+
+max_grantable_role
+------------------
+member            
+(1 row)
+
+step probe_commit: COMMIT;
+step check: 
+  select max_grantable_role from agent_board.board_authority_ceilings
+   where board_id = (select id from agent_board.boards where slug='ceiling-order-board');
+
+max_grantable_role
+------------------
+member            
+(1 row)
+

package/tests/isolation/expected/claimgate_ownerless_quota.out

@@ -0,0 +1,36 @@
+Parsed test spec with 3 sessions
+
+starting permutation: sa_begin sa_acq sb_begin sb_acq sa_commit sb_commit chk
+step sa_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = 'c0a70000-0000-4000-8000-0000000000aa';
+step sa_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cg-iso-sa', now() + interval '1 hour', null, null);
+
+resource_key
+------------
+cg-iso-sa   
+(1 row)
+
+step sb_begin: BEGIN; SET LOCAL ROLE authenticated; SET LOCAL "request.jwt.claim.role" = 'authenticated'; SET LOCAL "request.jwt.claim.sub" = 'c0a70000-0000-4000-8000-0000000000aa';
+step sb_acq: 
+  select resource_key
+    from agent_board.acquire_claim(null, 'file', 'cg-iso-sb', now() + interval '1 hour', null, null);
+ <waiting ...>
+step sa_commit: COMMIT;
+step sb_acq: <... completed>
+ERROR:  ownerless active-claim quota reached (50 per agent)
+step sb_commit: COMMIT;
+step chk: 
+  select count(*)::int as active_file_claims
+    from agent_board.claims
+   where agent_id = 'c0a70000-0000-4000-8000-0000000000bb'
+     and resource_kind = 'file'
+     and status = 'active'
+     and released_at is null
+     and lease_expires_at > now();
+
+active_file_claims
+------------------
+                50
+(1 row)
+

package/tests/isolation/expected/claimkey_renew_race.out

@@ -0,0 +1,38 @@
+Parsed test spec with 3 sessions
+
+starting permutation: ra_begin ra_renew rb_begin rb_renew ra_commit rb_commit chk
+step ra_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ra_renew: 
+  select resource_key
+    from agent_board.renew_claim('00000000-0000-4000-8000-0000000000c1', now() + interval '2 hours');
+
+resource_key
+------------
+fpRace      
+(1 row)
+
+step rb_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rb_renew: 
+  select resource_key
+    from agent_board.renew_claim('00000000-0000-4000-8000-0000000000c2', now() + interval '2 hours');
+ <waiting ...>
+step ra_commit: COMMIT;
+step rb_renew: <... completed>
+resource_key
+------------
+  fpRace    
+(1 row)
+
+step rb_commit: COMMIT;
+step chk: 
+  select resource_key
+    from agent_board.claims
+   where lease_token in ('00000000-0000-4000-8000-0000000000c1','00000000-0000-4000-8000-0000000000c2')
+   order by resource_key;
+
+resource_key
+------------
+  fpRace    
+fpRace      
+(2 rows)
+

package/tests/isolation/expected/consent_approval_lock.out

@@ -0,0 +1,43 @@
+Parsed test spec with 3 sessions
+
+starting permutation: a_begin a_resolve w_begin w_leave a_commit w_commit chk
+step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_resolve: 
+  select membership_state
+    from agent_board.resolve_board_request(
+      '115b0000-0000-4000-8000-000000000001',
+      '115a0000-0000-4000-8000-000000000002',
+      'joined',
+      '115a0000-0000-4000-8000-000000000001');
+
+membership_state
+----------------
+joined          
+(1 row)
+
+step w_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step w_leave: 
+  select membership_state
+    from agent_board.update_board_membership(
+      '115b0000-0000-4000-8000-000000000001',
+      '115a0000-0000-4000-8000-000000000002',
+      'left');
+ <waiting ...>
+step a_commit: COMMIT;
+step w_leave: <... completed>
+membership_state
+----------------
+left            
+(1 row)
+
+step w_commit: COMMIT;
+step chk: 
+  select membership_state
+    from agent_board.board_memberships
+   where id = '115c0000-0000-4000-8000-0000000000aa';
+
+membership_state
+----------------
+left            
+(1 row)
+

package/tests/isolation/expected/consent_emit_actual_state.out

@@ -0,0 +1,37 @@
+Parsed test spec with 3 sessions
+
+starting permutation: m_begin m_sub b_begin b_boot m_commit b_commit chk
+step m_begin: BEGIN;
+step m_sub: 
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id)
+  values ('105b0000-0000-4000-8000-000000000001', '105a0000-0000-4000-8000-000000000001',
+          'subscribed', 'member', '105a0000-0000-4000-8000-000000000001');
+
+step b_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_boot: 
+  select board_id, owner_agent_id
+    from agent_board.bootstrap_board_owner_memberships()
+   where board_id = '105b0000-0000-4000-8000-000000000001';
+ <waiting ...>
+step m_commit: COMMIT;
+step b_boot: <... completed>
+board_id                            |owner_agent_id                      
+------------------------------------+------------------------------------
+105b0000-0000-4000-8000-000000000001|105a0000-0000-4000-8000-000000000001
+(1 row)
+
+step b_commit: COMMIT;
+step chk: 
+  select result_state, event_kind, provenance
+    from agent_board.board_membership_events
+   where board_id = '105b0000-0000-4000-8000-000000000001'
+     and agent_id = '105a0000-0000-4000-8000-000000000001'
+     and event_kind = 'operator_repair'
+   order by seq desc
+   limit 1;
+
+result_state|event_kind     |provenance         
+------------+---------------+-------------------
+subscribed  |operator_repair|operator-designated
+(1 row)
+

package/tests/isolation/expected/domain_reclaim_revoke_race.out

@@ -0,0 +1,40 @@
+Parsed test spec with 3 sessions
+
+starting permutation: ra_begin ra_reclaim rb_begin rb_revoke ra_commit rb_commit chk
+step ra_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ra_reclaim: 
+  select owner_agent_id
+    from agent_board.reclaim_fleet_trust_domain(
+      'd2000000-0000-4000-8000-000000000001', 'a2000000-0000-4000-8000-000000000003',
+      'a2000000-0000-4000-8000-000000000001', 'iso operator domain reclaim');
+
+owner_agent_id                      
+------------------------------------
+a2000000-0000-4000-8000-000000000003
+(1 row)
+
+step rb_begin: 
+  BEGIN;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = 'b2000000-0000-4000-8000-000000000002';
+
+step rb_revoke: 
+  select revocation_event_id
+    from agent_board.revoke_fleet_subject(
+      'trust_domain', 'd2000000-0000-4000-8000-000000000001', 'a2000000-0000-4000-8000-000000000002',
+      'iso squatter domain revoke', jsonb_build_object('redacted', true));
+ <waiting ...>
+step ra_commit: COMMIT;
+step rb_revoke: <... completed>
+ERROR:  trust domain is not owned by current_agent_id()
+step rb_commit: COMMIT;
+step chk: 
+  select owner_agent_id, lifecycle_state
+    from agent_board.fleet_trust_domains
+   where id = 'd2000000-0000-4000-8000-000000000001';
+
+owner_agent_id                      |lifecycle_state
+------------------------------------+---------------
+a2000000-0000-4000-8000-000000000003|active         
+(1 row)
+

package/tests/isolation/expected/enroll_identity_board_owner_lock_order.out

@@ -0,0 +1,55 @@
+Parsed test spec with 4 sessions
+
+starting permutation: ohold_begin ohold_lock enroll_begin enroll_enroll bprobe_board_nowait ohold_commit enroll_commit check
+step ohold_begin: BEGIN;
+step ohold_lock: 
+  select 1 as locked from auth.users u
+   where u.id = (select uid from lo194_owner)
+   for update;
+
+locked
+------
+     1
+(1 row)
+
+step enroll_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step enroll_enroll: 
+  select agent_handle, invite_redeemed
+    from agent_board.enroll_federated_identity(
+      'https://lo194-iso.test', 'message-board', 'iso-human',
+      jsonb_build_object('iss','https://lo194-iso.test','aud','message-board','sub','iso-human'),
+      'lo194-iso-agent',
+      public.test_pubkey('lo194-iso-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('lo194-iso-k1'),
+      true, null, 'agent', ARRAY[]::text[], ARRAY[]::text[],
+      'lo194-iso-code'
+    );
+ <waiting ...>
+step bprobe_board_nowait: 
+  select slug from agent_board.boards where slug='lo194-iso-board' for update nowait;
+
+ERROR:  could not obtain lock on row in relation "boards"
+step ohold_commit: COMMIT;
+step enroll_enroll: <... completed>
+agent_handle   |invite_redeemed
+---------------+---------------
+lo194-iso-agent|t              
+(1 row)
+
+step enroll_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.board_memberships m
+      join agent_board.agents a on a.id = m.agent_id
+     where m.board_id = (select id from agent_board.boards where slug='lo194-iso-board')
+       and a.handle = 'lo194-iso-agent'
+       and m.membership_state = 'joined') as enrolled_agent_memberships,
+    (select count(*) from agent_board.board_invite_redemptions r
+      join agent_board.board_invite_tokens t on t.id = r.invite_id
+     where t.code = 'lo194-iso-code') as redemptions;
+
+enrolled_agent_memberships|redemptions
+--------------------------+-----------
+                         1|          1
+(1 row)
+

package/tests/isolation/expected/fedsession_provider_absent_owner_lock.out

@@ -0,0 +1,37 @@
+Parsed test spec with 3 sessions
+
+starting permutation: ohold_begin ohold_lock portal_begin portal_enroll ohold_commit portal_commit check
+step ohold_begin: BEGIN;
+step ohold_lock: 
+  select 1 as locked from auth.users u
+   where u.id = (select uid from lo193_owner)
+   for update;
+
+locked
+------
+     1
+(1 row)
+
+step portal_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step portal_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://lo193-iso.test', 'message-board', 'iso-orphan',
+    jsonb_build_object('sub','iso-orphan'), 'Iso Orphan'
+  );
+
+ERROR:  issuer/audience not in the identity-provider allowlist (rejected before any owner or board lock)
+step ohold_commit: COMMIT;
+step portal_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.agents a
+      where a.kind = 'human'
+        and a.metadata #>> ARRAY['federation','subject'] = 'iso-orphan') as human_agents,
+    (select count(*) from agent_board.identity_providers ip
+      where ip.issuer = 'https://lo193-iso.test') as providers;
+
+human_agents|providers
+------------+---------
+           0|        0
+(1 row)
+

package/tests/isolation/expected/onboarding_ceiling_lock_order.out

@@ -0,0 +1,123 @@
+Parsed test spec with 4 sessions
+
+starting permutation: holder_begin hold_ceiling_lock onboard_begin onboard_call probe_begin probe_boards_row probe_commit holder_commit onboard_commit check
+count
+-----
+    1
+(1 row)
+
+step holder_begin: BEGIN;
+step hold_ceiling_lock: 
+  select agent_board._lock_board_authority_ceiling(
+    (select id from agent_board.boards where slug='onboard-ceiling-board')) as locked;
+
+locked
+------
+      
+(1 row)
+
+step onboard_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step onboard_call: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://onboard-ceiling.test', 'message-board', 'human-onboard-ceiling',
+    jsonb_build_object('iss','https://onboard-ceiling.test','aud','message-board','sub','human-onboard-ceiling'),
+    'onboard-ceiling-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='19610000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='onboard-ceiling-board'),
+    '19610000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:onboard-ceiling-repo', 'worker', 'phase_worker',
+    'onboard-ceiling-agent'
+  );
+ <waiting ...>
+step probe_begin: BEGIN;
+step probe_boards_row: 
+  select status from agent_board.boards
+   where id = (select id from agent_board.boards where slug='onboard-ceiling-board')
+   for update nowait;
+
+status
+------
+active
+(1 row)
+
+step probe_commit: COMMIT;
+step holder_commit: COMMIT;
+step onboard_call: <... completed>
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+created             |created               |created            
+(1 row)
+
+step onboard_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.agents where handle='onboard-ceiling-agent') as onboarded_agents,
+    (select count(*) from agent_board.board_memberships bm
+      where bm.board_id=(select id from agent_board.boards where slug='onboard-ceiling-board')
+        and bm.agent_id in (select id from agent_board.agents where handle='onboard-ceiling-agent')) as memberships;
+
+onboarded_agents|memberships
+----------------+-----------
+               1|          1
+(1 row)
+
+
+starting permutation: onboard_begin onboard_call onboard_commit probe_begin probe_boards_row probe_commit check
+count
+-----
+    1
+(1 row)
+
+step onboard_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step onboard_call: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://onboard-ceiling.test', 'message-board', 'human-onboard-ceiling',
+    jsonb_build_object('iss','https://onboard-ceiling.test','aud','message-board','sub','human-onboard-ceiling'),
+    'onboard-ceiling-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='19610000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='onboard-ceiling-board'),
+    '19610000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:onboard-ceiling-repo', 'worker', 'phase_worker',
+    'onboard-ceiling-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+created             |created               |created            
+(1 row)
+
+step onboard_commit: COMMIT;
+step probe_begin: BEGIN;
+step probe_boards_row: 
+  select status from agent_board.boards
+   where id = (select id from agent_board.boards where slug='onboard-ceiling-board')
+   for update nowait;
+
+status
+------
+active
+(1 row)
+
+step probe_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.agents where handle='onboard-ceiling-agent') as onboarded_agents,
+    (select count(*) from agent_board.board_memberships bm
+      where bm.board_id=(select id from agent_board.boards where slug='onboard-ceiling-board')
+        and bm.agent_id in (select id from agent_board.agents where handle='onboard-ceiling-agent')) as memberships;
+
+onboarded_agents|memberships
+----------------+-----------
+               1|          1
+(1 row)
+