@consiliency/agent-board-schema 1.2.0

package/migrations/20260628000004_agent_board_fleet_registry.sql

@@ -0,0 +1,411 @@
+create table if not exists agent_board.fleet_trust_domains (
+  id uuid primary key default gen_random_uuid(),
+  slug text not null unique,
+  display_name text not null,
+  domain_kind text not null check (domain_kind in ('tailnet', 'regenesis', 'development_mac', 'partner', 'external')),
+  owner_agent_id uuid not null references agent_board.agents(id) on delete cascade,
+  lifecycle_state text not null default 'pending' check (lifecycle_state in ('pending', 'active', 'quarantined', 'suspended', 'revoked')),
+  approved_at timestamptz,
+  revoked_at timestamptz,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint fleet_trust_domains_metadata_object check (jsonb_typeof(metadata) = 'object'),
+  constraint fleet_trust_domains_revoked_shape check (
+    (lifecycle_state = 'revoked' and revoked_at is not null)
+    or (lifecycle_state <> 'revoked' and revoked_at is null)
+  )
+);
+
+comment on table agent_board.fleet_trust_domains is 'Metadata-safe fleet trust-domain registry; does not store raw host inventory or provider payloads.';
+
+create table if not exists agent_board.fleet_machines (
+  id uuid primary key default gen_random_uuid(),
+  trust_domain_id uuid not null references agent_board.fleet_trust_domains(id) on delete cascade,
+  owner_agent_id uuid not null references agent_board.agents(id) on delete cascade,
+  machine_label text not null,
+  machine_fingerprint text not null,
+  lifecycle_state text not null default 'pending' check (lifecycle_state in ('pending', 'active', 'quarantined', 'suspended', 'revoked')),
+  enrollment_source text not null default 'portal' check (enrollment_source in ('portal', 'tailnet_bootstrap', 'provider_bootstrap', 'manual_import')),
+  enrolled_at timestamptz,
+  revoked_at timestamptz,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint fleet_machines_owner_fingerprint_unique unique (owner_agent_id, machine_fingerprint),
+  constraint fleet_machines_metadata_object check (jsonb_typeof(metadata) = 'object'),
+  constraint fleet_machines_revoked_shape check (
+    (lifecycle_state = 'revoked' and revoked_at is not null)
+    or (lifecycle_state <> 'revoked' and revoked_at is null)
+  )
+);
+
+comment on table agent_board.fleet_machines is 'Metadata-safe enrolled machine records. Fingerprints are bounded descriptors, not raw host inventory.';
+
+create index if not exists idx_agent_board_fleet_machines_trust_domain
+  on agent_board.fleet_machines(trust_domain_id, lifecycle_state, enrolled_at desc);
+
+create unique index if not exists idx_agent_board_fleet_machines_fingerprint_unique
+  on agent_board.fleet_machines(machine_fingerprint);
+
+create table if not exists agent_board.fleet_harness_registrations (
+  id uuid primary key default gen_random_uuid(),
+  machine_id uuid not null references agent_board.fleet_machines(id) on delete cascade,
+  harness_kind text not null check (harness_kind in ('codex', 'claude', 'gemini', 'cursor', 'generic_cli', 'mcp')),
+  harness_label text not null,
+  lifecycle_state text not null default 'active' check (lifecycle_state in ('pending', 'active', 'quarantined', 'suspended', 'revoked')),
+  revoked_at timestamptz,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint fleet_harness_registrations_metadata_object check (jsonb_typeof(metadata) = 'object'),
+  constraint fleet_harness_registrations_revoked_shape check (
+    (lifecycle_state = 'revoked' and revoked_at is not null)
+    or (lifecycle_state <> 'revoked' and revoked_at is null)
+  )
+);
+
+create unique index if not exists idx_agent_board_fleet_harness_active_unique
+  on agent_board.fleet_harness_registrations(machine_id, harness_kind, harness_label)
+  where lifecycle_state = 'active';
+
+create table if not exists agent_board.fleet_repo_scopes (
+  id uuid primary key default gen_random_uuid(),
+  harness_registration_id uuid not null references agent_board.fleet_harness_registrations(id) on delete cascade,
+  repo_slug text not null,
+  repo_fingerprint text not null,
+  scope_role text not null check (scope_role in ('owner', 'operator', 'worker', 'reviewer', 'observer')),
+  lifecycle_state text not null default 'active' check (lifecycle_state in ('pending', 'active', 'quarantined', 'suspended', 'revoked')),
+  revoked_at timestamptz,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint fleet_repo_scopes_metadata_object check (jsonb_typeof(metadata) = 'object'),
+  constraint fleet_repo_scopes_revoked_shape check (
+    (lifecycle_state = 'revoked' and revoked_at is not null)
+    or (lifecycle_state <> 'revoked' and revoked_at is null)
+  )
+);
+
+create unique index if not exists idx_agent_board_fleet_repo_scopes_active_unique
+  on agent_board.fleet_repo_scopes(harness_registration_id, repo_fingerprint, scope_role)
+  where lifecycle_state = 'active';
+
+create table if not exists agent_board.fleet_machine_agents (
+  id uuid primary key default gen_random_uuid(),
+  machine_id uuid not null references agent_board.fleet_machines(id) on delete cascade,
+  agent_id uuid not null references agent_board.agents(id) on delete cascade,
+  repo_scope_id uuid references agent_board.fleet_repo_scopes(id) on delete set null,
+  signing_key_id uuid references agent_board.agent_signing_keys(id) on delete set null,
+  agent_role text not null default 'phase_worker' check (agent_role in ('portal_operator', 'pipeline_runtime', 'phase_worker', 'reviewer', 'callback_receiver')),
+  lifecycle_state text not null default 'active' check (lifecycle_state in ('pending', 'active', 'quarantined', 'suspended', 'revoked')),
+  parent_agent_id uuid references agent_board.agents(id) on delete set null,
+  revoked_at timestamptz,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint fleet_machine_agents_not_self_parent check (parent_agent_id is null or parent_agent_id <> agent_id),
+  constraint fleet_machine_agents_metadata_object check (jsonb_typeof(metadata) = 'object'),
+  constraint fleet_machine_agents_revoked_shape check (
+    (lifecycle_state = 'revoked' and revoked_at is not null)
+    or (lifecycle_state <> 'revoked' and revoked_at is null)
+  )
+);
+
+create unique index if not exists idx_agent_board_fleet_machine_agents_active_unique
+  on agent_board.fleet_machine_agents(machine_id, agent_id, coalesce(repo_scope_id, '00000000-0000-0000-0000-000000000000'::uuid))
+  where lifecycle_state = 'active';
+
+create index if not exists idx_agent_board_fleet_machine_agents_agent
+  on agent_board.fleet_machine_agents(agent_id, lifecycle_state, updated_at desc);
+
+create table if not exists agent_board.fleet_receive_policies (
+  id uuid primary key default gen_random_uuid(),
+  recipient_agent_id uuid references agent_board.agents(id) on delete cascade,
+  board_id uuid references agent_board.boards(id) on delete cascade,
+  trust_domain_id uuid references agent_board.fleet_trust_domains(id) on delete cascade,
+  policy_name text not null,
+  default_action text not null default 'deny' check (default_action in ('allow', 'deny', 'quarantine', 'non_actionable')),
+  require_signed_sender boolean not null default false,
+  lifecycle_state text not null default 'active' check (lifecycle_state in ('pending', 'active', 'quarantined', 'suspended', 'revoked')),
+  revoked_at timestamptz,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint fleet_receive_policies_has_target check (
+    recipient_agent_id is not null or board_id is not null or trust_domain_id is not null
+  ),
+  constraint fleet_receive_policies_metadata_object check (jsonb_typeof(metadata) = 'object'),
+  constraint fleet_receive_policies_revoked_shape check (
+    (lifecycle_state = 'revoked' and revoked_at is not null)
+    or (lifecycle_state <> 'revoked' and revoked_at is null)
+  )
+);
+
+create index if not exists idx_agent_board_fleet_receive_policies_target
+  on agent_board.fleet_receive_policies(
+    coalesce(recipient_agent_id, '00000000-0000-0000-0000-000000000000'::uuid),
+    coalesce(board_id, '00000000-0000-0000-0000-000000000000'::uuid),
+    coalesce(trust_domain_id, '00000000-0000-0000-0000-000000000000'::uuid),
+    lifecycle_state,
+    updated_at desc
+  );
+
+create table if not exists agent_board.fleet_trust_sets (
+  id uuid primary key default gen_random_uuid(),
+  receive_policy_id uuid not null references agent_board.fleet_receive_policies(id) on delete cascade,
+  subject_kind text not null default 'trust_domain' check (subject_kind in ('trust_domain', 'machine', 'harness', 'repo_scope', 'agent')),
+  trust_domain_id uuid references agent_board.fleet_trust_domains(id) on delete cascade,
+  machine_id uuid references agent_board.fleet_machines(id) on delete cascade,
+  agent_id uuid references agent_board.agents(id) on delete cascade,
+  repo_scope_id uuid references agent_board.fleet_repo_scopes(id) on delete cascade,
+  harness_registration_id uuid references agent_board.fleet_harness_registrations(id) on delete cascade,
+  effect text not null check (effect in ('allow', 'deny', 'quarantine', 'non_actionable')),
+  require_signed_sender boolean,
+  lifecycle_state text not null default 'active' check (lifecycle_state in ('pending', 'active', 'quarantined', 'suspended', 'revoked')),
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint fleet_trust_sets_has_target check (
+    trust_domain_id is not null
+    or machine_id is not null
+    or agent_id is not null
+    or repo_scope_id is not null
+    or harness_registration_id is not null
+  ),
+  constraint fleet_trust_sets_metadata_object check (jsonb_typeof(metadata) = 'object')
+);
+
+create table if not exists agent_board.fleet_revocation_events (
+  id uuid primary key default gen_random_uuid(),
+  subject_kind text not null check (subject_kind in ('trust_domain', 'machine', 'harness', 'repo_scope', 'agent', 'signing_key', 'credential')),
+  subject_id uuid not null,
+  trust_domain_id uuid references agent_board.fleet_trust_domains(id) on delete cascade,
+  machine_id uuid references agent_board.fleet_machines(id) on delete cascade,
+  harness_registration_id uuid references agent_board.fleet_harness_registrations(id) on delete cascade,
+  repo_scope_id uuid references agent_board.fleet_repo_scopes(id) on delete cascade,
+  agent_id uuid references agent_board.agents(id) on delete cascade,
+  signing_key_id uuid references agent_board.agent_signing_keys(id) on delete cascade,
+  revoked_by_agent_id uuid not null references agent_board.agents(id) on delete restrict,
+  revocation_reason text not null,
+  effective_at timestamptz not null default now(),
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  constraint fleet_revocation_events_metadata_object check (jsonb_typeof(metadata) = 'object')
+);
+
+create index if not exists idx_agent_board_fleet_revocation_actor
+  on agent_board.fleet_revocation_events(revoked_by_agent_id, effective_at desc);
+
+alter table agent_board.fleet_receive_policies
+  add column if not exists revoked_at timestamptz;
+
+alter table agent_board.fleet_trust_sets
+  add column if not exists subject_kind text not null default 'trust_domain',
+  add column if not exists require_signed_sender boolean,
+  add column if not exists lifecycle_state text not null default 'active',
+  add column if not exists updated_at timestamptz not null default now();
+
+alter table agent_board.fleet_trust_sets
+  drop constraint if exists fleet_trust_sets_subject_kind_check,
+  add constraint fleet_trust_sets_subject_kind_check check (subject_kind in ('trust_domain', 'machine', 'harness', 'repo_scope', 'agent')),
+  drop constraint if exists fleet_trust_sets_lifecycle_state_check,
+  add constraint fleet_trust_sets_lifecycle_state_check check (lifecycle_state in ('pending', 'active', 'quarantined', 'suspended', 'revoked'));
+
+create index if not exists idx_agent_board_fleet_trust_sets_policy
+  on agent_board.fleet_trust_sets(receive_policy_id, lifecycle_state, effect);
+
+alter table agent_board.fleet_revocation_events
+  add column if not exists subject_id uuid,
+  add column if not exists trust_domain_id uuid references agent_board.fleet_trust_domains(id) on delete cascade,
+  add column if not exists machine_id uuid references agent_board.fleet_machines(id) on delete cascade,
+  add column if not exists harness_registration_id uuid references agent_board.fleet_harness_registrations(id) on delete cascade,
+  add column if not exists repo_scope_id uuid references agent_board.fleet_repo_scopes(id) on delete cascade,
+  add column if not exists agent_id uuid references agent_board.agents(id) on delete cascade,
+  add column if not exists signing_key_id uuid references agent_board.agent_signing_keys(id) on delete cascade;
+
+update agent_board.fleet_revocation_events
+   set subject_id = coalesce(subject_id, trust_domain_id, machine_id, harness_registration_id, repo_scope_id, agent_id, signing_key_id)
+ where subject_id is null;
+
+create unique index if not exists idx_agent_board_fleet_revocation_subject_unique
+  on agent_board.fleet_revocation_events(subject_kind, subject_id);
+
+grant select, insert, update, delete on agent_board.fleet_trust_domains,
+  agent_board.fleet_machines,
+  agent_board.fleet_harness_registrations,
+  agent_board.fleet_repo_scopes,
+  agent_board.fleet_machine_agents,
+  agent_board.fleet_receive_policies,
+  agent_board.fleet_trust_sets,
+  agent_board.fleet_revocation_events
+to service_role;
+
+grant select on agent_board.fleet_trust_domains,
+  agent_board.fleet_machines,
+  agent_board.fleet_harness_registrations,
+  agent_board.fleet_repo_scopes,
+  agent_board.fleet_machine_agents,
+  agent_board.fleet_receive_policies,
+  agent_board.fleet_trust_sets,
+  agent_board.fleet_revocation_events
+to authenticated;
+
+alter table agent_board.fleet_trust_domains enable row level security;
+alter table agent_board.fleet_machines enable row level security;
+alter table agent_board.fleet_harness_registrations enable row level security;
+alter table agent_board.fleet_repo_scopes enable row level security;
+alter table agent_board.fleet_machine_agents enable row level security;
+alter table agent_board.fleet_receive_policies enable row level security;
+alter table agent_board.fleet_trust_sets enable row level security;
+alter table agent_board.fleet_revocation_events enable row level security;
+
+do $$
+declare
+  v_table text;
+begin
+  foreach v_table in array array[
+    'fleet_trust_domains',
+    'fleet_machines',
+    'fleet_harness_registrations',
+    'fleet_repo_scopes',
+    'fleet_machine_agents',
+    'fleet_receive_policies',
+    'fleet_trust_sets',
+    'fleet_revocation_events'
+  ]
+  loop
+    execute format('drop policy if exists %I on agent_board.%I', 'agent_board_service_all_' || v_table, v_table);
+    execute format('create policy %I on agent_board.%I as permissive for all to service_role using (true) with check (true)', 'agent_board_service_all_' || v_table, v_table);
+  end loop;
+end;
+$$;
+
+drop policy if exists agent_board_authenticated_select_fleet_trust_domains on agent_board.fleet_trust_domains;
+create policy agent_board_authenticated_select_fleet_trust_domains
+on agent_board.fleet_trust_domains
+as permissive
+for select
+to authenticated
+using (owner_agent_id = agent_board.current_agent_id());
+
+drop policy if exists agent_board_authenticated_select_fleet_machines on agent_board.fleet_machines;
+create policy agent_board_authenticated_select_fleet_machines
+on agent_board.fleet_machines
+as permissive
+for select
+to authenticated
+using (
+  owner_agent_id = agent_board.current_agent_id()
+  or exists (
+    select 1
+      from agent_board.fleet_machine_agents fma
+     where fma.machine_id = id
+       and fma.agent_id = agent_board.current_agent_id()
+       and fma.lifecycle_state = 'active'
+  )
+);
+
+drop policy if exists agent_board_authenticated_select_fleet_harness_registrations on agent_board.fleet_harness_registrations;
+create policy agent_board_authenticated_select_fleet_harness_registrations
+on agent_board.fleet_harness_registrations
+as permissive
+for select
+to authenticated
+using (
+  exists (
+    select 1
+      from agent_board.fleet_machines fm
+     where fm.id = machine_id
+       and fm.owner_agent_id = agent_board.current_agent_id()
+  )
+);
+
+drop policy if exists agent_board_authenticated_select_fleet_repo_scopes on agent_board.fleet_repo_scopes;
+create policy agent_board_authenticated_select_fleet_repo_scopes
+on agent_board.fleet_repo_scopes
+as permissive
+for select
+to authenticated
+using (
+  exists (
+    select 1
+      from agent_board.fleet_harness_registrations fhr
+      join agent_board.fleet_machines fm on fm.id = fhr.machine_id
+     where fhr.id = harness_registration_id
+       and fm.owner_agent_id = agent_board.current_agent_id()
+  )
+);
+
+drop policy if exists agent_board_authenticated_select_fleet_machine_agents on agent_board.fleet_machine_agents;
+create policy agent_board_authenticated_select_fleet_machine_agents
+on agent_board.fleet_machine_agents
+as permissive
+for select
+to authenticated
+using (
+  agent_id = agent_board.current_agent_id()
+  or exists (
+    select 1
+      from agent_board.fleet_machines fm
+     where fm.id = machine_id
+       and fm.owner_agent_id = agent_board.current_agent_id()
+  )
+);
+
+drop policy if exists agent_board_authenticated_select_fleet_receive_policies on agent_board.fleet_receive_policies;
+create policy agent_board_authenticated_select_fleet_receive_policies
+on agent_board.fleet_receive_policies
+as permissive
+for select
+to authenticated
+using (
+  recipient_agent_id = agent_board.current_agent_id()
+  or exists (
+    select 1
+      from agent_board.fleet_trust_domains ftd
+     where ftd.id = trust_domain_id
+       and ftd.owner_agent_id = agent_board.current_agent_id()
+  )
+  or exists (
+    select 1
+      from agent_board.boards b
+     where b.id = board_id
+       and b.created_by_agent_id = agent_board.current_agent_id()
+  )
+);
+
+drop policy if exists agent_board_authenticated_select_fleet_trust_sets on agent_board.fleet_trust_sets;
+create policy agent_board_authenticated_select_fleet_trust_sets
+on agent_board.fleet_trust_sets
+as permissive
+for select
+to authenticated
+using (
+  exists (
+    select 1
+      from agent_board.fleet_receive_policies frp
+     where frp.id = receive_policy_id
+       and (
+         frp.recipient_agent_id = agent_board.current_agent_id()
+         or exists (
+           select 1
+             from agent_board.fleet_trust_domains ftd
+            where ftd.id = frp.trust_domain_id
+              and ftd.owner_agent_id = agent_board.current_agent_id()
+         )
+       )
+  )
+);
+
+drop policy if exists agent_board_authenticated_select_fleet_revocation_events on agent_board.fleet_revocation_events;
+create policy agent_board_authenticated_select_fleet_revocation_events
+on agent_board.fleet_revocation_events
+as permissive
+for select
+to authenticated
+using (revoked_by_agent_id = agent_board.current_agent_id());
+
+insert into agent_board.schema_version (version)
+values (6)
+on conflict ((true)) do update set version = excluded.version;