@consiliency/agent-board-schema 1.22.0 → 1.23.0

package/tests/isolation/expected/atomic_fedsession_fleet_lock_order.out

@@ -0,0 +1,79 @@
+Parsed test spec with 4 sessions
+
+starting permutation: guard_begin guard_board_key_share fleet_begin fleet_onboard portal_begin portal_enroll guard_commit fleet_commit portal_commit check
+count
+-----
+    1
+(1 row)
+
+step guard_begin: BEGIN;
+step guard_board_key_share: 
+  select slug from agent_board.boards
+   where slug='atomic-cross-board' for key share;
+
+slug              
+------------------
+atomic-cross-board
+(1 row)
+
+step fleet_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step fleet_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+    from agent_board.onboard_federated_fleet_agent(
+      'https://atomic-cross.test', 'message-board', 'cross-human',
+      jsonb_build_object('iss','https://atomic-cross.test','aud','message-board','sub','cross-human','iat',100),
+      'atomic-cross-agent',
+      'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
+      'raw_ed25519_base64url',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+      true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+      (select code from agent_board.board_invite_tokens where created_by_agent_id='162a0000-0000-0000-0000-000000000001'),
+      (select id from agent_board.boards where slug='atomic-cross-board'),
+      '162a0000-0000-0000-0000-000000000003',
+      'codex', 'phase-loop', 'message-board', 'sha256:atomic-cross-repo',
+      'worker', 'phase_worker', 'atomic-cross-agent'
+    );
+ <waiting ...>
+step portal_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step portal_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://atomic-cross.test', 'message-board', 'cross-human',
+    jsonb_build_object('sub','cross-human','iat',200), 'Cross Human'
+  );
+ <waiting ...>
+step guard_commit: COMMIT;
+step fleet_onboard: <... completed>
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+created             |created               |created            
+(1 row)
+
+step fleet_commit: COMMIT;
+step portal_enroll: <... completed>
+status
+------
+active
+(1 row)
+
+step portal_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.agents
+      where owner_user_id=(select auth_user_id from agent_board.agents
+                            where metadata #>> ARRAY['federation','subject']='cross-human'
+                            order by kind='human' desc limit 1)) as owned_agents,
+    (select count(*) from agent_board.board_memberships m
+      join agent_board.agents a on a.id=m.agent_id
+     where m.board_id=(select id from agent_board.boards where slug='atomic-cross-board')
+       and a.owner_user_id=(select auth_user_id from agent_board.agents
+                            where metadata #>> ARRAY['federation','subject']='cross-human'
+                            order by kind='human' desc limit 1)) as memberships,
+    (select count(*) from agent_board.fleet_machine_agents b
+      join agent_board.agents a on a.id=b.agent_id
+     where a.handle='atomic-cross-agent') as bindings;
+
+owned_agents|memberships|bindings
+------------+-----------+--------
+           2|          2|       1
+(1 row)
+

package/tests/isolation/expected/atomic_fedsession_human_revoke.out

@@ -0,0 +1,87 @@
+Parsed test spec with 3 sessions
+
+starting permutation: portal_begin portal_enroll revoke_begin revoke_human portal_commit revoke_commit check
+count
+-----
+    1
+(1 row)
+
+step portal_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step portal_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://atomic-fedsession.test', 'message-board', 'portal-human-race',
+    jsonb_build_object('sub','portal-human-race','iat',200), 'Portal Human Race'
+  );
+
+status
+------
+active
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_human: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents where metadata #>> ARRAY['federation','subject'] = 'portal-human-race'),
+    '16290000-0000-0000-0000-000000000001', 'portal race revoke'
+  );
+ <waiting ...>
+step portal_commit: COMMIT;
+step revoke_human: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step revoke_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.fleet_human_revocations where issuer='https://atomic-fedsession.test') as markers,
+    (select count(*) from agent_board.agents where metadata #>> ARRAY['federation','subject'] = 'portal-human-race' and status='active') as active_humans,
+    (select count(*) from agent_board.enrollment_federation_audit where issuer='https://atomic-fedsession.test') as audits;
+
+markers|active_humans|audits
+-------+-------------+------
+      1|            0|     2
+(1 row)
+
+
+starting permutation: revoke_begin revoke_human portal_begin portal_enroll revoke_commit portal_commit check
+count
+-----
+    1
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_human: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents where metadata #>> ARRAY['federation','subject'] = 'portal-human-race'),
+    '16290000-0000-0000-0000-000000000001', 'portal race revoke'
+  );
+
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step portal_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step portal_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://atomic-fedsession.test', 'message-board', 'portal-human-race',
+    jsonb_build_object('sub','portal-human-race','iat',200), 'Portal Human Race'
+  );
+ <waiting ...>
+step revoke_commit: COMMIT;
+step portal_enroll: <... completed>
+ERROR:  human identity is durably revoked
+step portal_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.fleet_human_revocations where issuer='https://atomic-fedsession.test') as markers,
+    (select count(*) from agent_board.agents where metadata #>> ARRAY['federation','subject'] = 'portal-human-race' and status='active') as active_humans,
+    (select count(*) from agent_board.enrollment_federation_audit where issuer='https://atomic-fedsession.test') as audits;
+
+markers|active_humans|audits
+-------+-------------+------
+      1|            0|     1
+(1 row)
+

package/tests/isolation/expected/atomic_fleet_authority_races.out

@@ -0,0 +1,469 @@
+Parsed test spec with 4 sessions
+
+starting permutation: retry_begin retry_onboard invalidator_begin remove_member retry_commit invalidator_commit check
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step remove_member: 
+  select membership_state from agent_board.update_board_membership(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    (select id from agent_board.agents where handle='atomic-authority-agent'),
+    'removed', jsonb_build_object('reason','isolation member removal')
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step remove_member: <... completed>
+membership_state
+----------------
+removed         
+(1 row)
+
+step invalidator_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |owner/joined     |removed     |             
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard invalidator_begin revoke_creator retry_commit invalidator_commit check
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_creator: 
+  select status from agent_board.revoke_agent(
+    '16250000-0000-0000-0000-000000000001', 'isolation creator revoke'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step revoke_creator: <... completed>
+status   
+---------
+suspended
+(1 row)
+
+step invalidator_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+suspended     |owner/joined     |joined      |             
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard invalidator_begin demote_creator retry_commit invalidator_commit check
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step demote_creator: 
+  select role from agent_board.grant_board_role(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000001', 'observer',
+    '16250000-0000-0000-0000-000000000001'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step demote_creator: <... completed>
+role    
+--------
+observer
+(1 row)
+
+step invalidator_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |observer/joined  |joined      |             
+(1 row)
+
+
+starting permutation: invalidator_begin remove_member retry_begin retry_onboard invalidator_commit retry_commit check
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step remove_member: 
+  select membership_state from agent_board.update_board_membership(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    (select id from agent_board.agents where handle='atomic-authority-agent'),
+    'removed', jsonb_build_object('reason','isolation member removal')
+  );
+
+membership_state
+----------------
+removed         
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+ <waiting ...>
+step invalidator_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |owner/joined     |removed     |             
+(1 row)
+
+
+starting permutation: invalidator_begin revoke_creator retry_begin retry_onboard invalidator_commit retry_commit check
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_creator: 
+  select status from agent_board.revoke_agent(
+    '16250000-0000-0000-0000-000000000001', 'isolation creator revoke'
+  );
+
+status   
+---------
+suspended
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+ <waiting ...>
+step invalidator_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+suspended     |owner/joined     |joined      |             
+(1 row)
+
+
+starting permutation: invalidator_begin demote_creator retry_begin retry_onboard invalidator_commit retry_commit check
+step invalidator_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step demote_creator: 
+  select role from agent_board.grant_board_role(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000001', 'observer',
+    '16250000-0000-0000-0000-000000000001'
+  );
+
+role    
+--------
+observer
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+ <waiting ...>
+step invalidator_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |observer/joined  |joined      |             
+(1 row)
+
+
+starting permutation: retry_begin retry_onboard ceiling_begin set_ceiling retry_commit ceiling_commit check
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+reused              |reused                |reused             
+(1 row)
+
+step ceiling_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '16250000-0000-0000-0000-0000000000a1';
+
+step set_ceiling: 
+  select ceiling_max_grantable_role from agent_board.set_board_authority_ceiling(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    'observer'
+  );
+ <waiting ...>
+step retry_commit: COMMIT;
+step set_ceiling: <... completed>
+ceiling_max_grantable_role
+--------------------------
+observer                  
+(1 row)
+
+step ceiling_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |owner/joined     |joined      |observer     
+(1 row)
+
+
+starting permutation: ceiling_begin set_ceiling retry_begin retry_onboard ceiling_commit retry_commit check
+step ceiling_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '16250000-0000-0000-0000-0000000000a1';
+
+step set_ceiling: 
+  select ceiling_max_grantable_role from agent_board.set_board_authority_ceiling(
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    'observer'
+  );
+
+ceiling_max_grantable_role
+--------------------------
+observer                  
+(1 row)
+
+step retry_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step retry_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-authority.test', 'message-board', 'human-authority',
+    jsonb_build_object('iss','https://atomic-authority.test','aud','message-board','sub','human-authority','iat',200),
+    'atomic-authority-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16250000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-authority-board'),
+    '16250000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-authority-repo', 'worker', 'phase_worker',
+    'atomic-authority-agent'
+  );
+ <waiting ...>
+step ceiling_commit: COMMIT;
+step retry_onboard: <... completed>
+ERROR:  fleet onboarding invite is not usable
+step retry_commit: COMMIT;
+step check: 
+  select
+    (select status from agent_board.agents where id='16250000-0000-0000-0000-000000000001') as creator_status,
+    (select role || '/' || membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id='16250000-0000-0000-0000-000000000001'
+        and membership_state in ('joined','subscribed')) as creator_authority,
+    (select membership_state from agent_board.board_memberships
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')
+        and agent_id=(select id from agent_board.agents where handle='atomic-authority-agent')
+      order by (membership_state in ('joined','subscribed')) desc, created_at desc, id desc limit 1) as member_state,
+    (select max_grantable_role from agent_board.board_authority_ceilings
+      where board_id=(select id from agent_board.boards where slug='atomic-authority-board')) as board_ceiling;
+
+creator_status|creator_authority|member_state|board_ceiling
+--------------+-----------------+------------+-------------
+active        |owner/joined     |joined      |observer     
+(1 row)
+