@consiliency/agent-board-schema 1.22.0 → 1.23.0

package/tests/isolation/specs/atomic_fleet_board_archive.spec

@@ -0,0 +1,134 @@
+# Consiliency/message-board#162 — board archival and composed fleet onboarding
+# share the board row lock. Prove archive-first rejects and onboarding-first
+# commits before archival without consuming another invite use.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16290000-0000-0000-0000-000000000001', 'agent', 'agent',
+          'atomic-archive-owner', 'Atomic Archive Owner', 'active');
+  select count(*) from agent_board.create_board(
+    '16290000-0000-0000-0000-000000000001',
+    'atomic-archive-board', 'Atomic Archive Board',
+    'Consiliency/message-board#162 archive race', jsonb_build_object(), 'private'
+  );
+  insert into agent_board.fleet_trust_domains(
+    id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at
+  ) values (
+    '16290000-0000-0000-0000-000000000002', 'atomic-archive-domain',
+    'Atomic Archive Domain', 'tailnet', '16290000-0000-0000-0000-000000000001',
+    'active', now()
+  );
+  insert into agent_board.fleet_machines(
+    id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+    lifecycle_state, enrollment_source, enrolled_at
+  ) values (
+    '16290000-0000-0000-0000-000000000003',
+    '16290000-0000-0000-0000-000000000002',
+    '16290000-0000-0000-0000-000000000001',
+    'claw', 'sha256:atomic-archive-machine', 'active', 'portal', now()
+  );
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://atomic-archive.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+  select count(*) from agent_board.create_fleet_onboarding_invite(
+    (select id from agent_board.boards where slug='atomic-archive-board'),
+    '16290000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-archive-repo', 'worker', 'phase_worker',
+    'atomic-archive-agent', 1, now() + interval '1 hour',
+    '16290000-0000-0000-0000-000000000001', jsonb_build_object()
+  );
+  select count(*) from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-archive.test', 'message-board', 'human-archive',
+    jsonb_build_object('iss','https://atomic-archive.test','aud','message-board','sub','human-archive'),
+    'atomic-archive-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16290000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-archive-board'),
+    '16290000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-archive-repo', 'worker', 'phase_worker',
+    'atomic-archive-agent'
+  );
+}
+
+teardown
+{
+  delete from agent_board.fleet_machine_agents where machine_id='16290000-0000-0000-0000-000000000003';
+  delete from agent_board.fleet_repo_scopes where harness_registration_id in (
+    select id from agent_board.fleet_harness_registrations where machine_id='16290000-0000-0000-0000-000000000003'
+  );
+  delete from agent_board.fleet_harness_registrations where machine_id='16290000-0000-0000-0000-000000000003';
+  delete from agent_board.board_invite_redemptions where invite_id in (
+    select id from agent_board.board_invite_tokens where created_by_agent_id='16290000-0000-0000-0000-000000000001'
+  );
+  truncate agent_board.fleet_onboarding_invite_bounds;
+  delete from agent_board.board_invite_tokens where created_by_agent_id='16290000-0000-0000-0000-000000000001';
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug='atomic-archive-board'
+  );
+  delete from agent_board.enrollment_federation_audit where issuer='https://atomic-archive.test';
+  delete from agent_board.agent_signing_keys where agent_id in (
+    select id from agent_board.agents where handle='atomic-archive-agent'
+  );
+  delete from agent_board.agents where handle='atomic-archive-agent';
+  delete from agent_board.boards where slug='atomic-archive-board';
+  delete from agent_board.fleet_machines where id='16290000-0000-0000-0000-000000000003';
+  delete from agent_board.fleet_trust_domains where id='16290000-0000-0000-0000-000000000002';
+  delete from agent_board.agents where id='16290000-0000-0000-0000-000000000001';
+  delete from agent_board.identity_providers where issuer='https://atomic-archive.test';
+}
+
+session "blocker"
+step "blocker_begin" { BEGIN; }
+step "block_machine" {
+  select id from agent_board.fleet_machines
+   where id='16290000-0000-0000-0000-000000000003' for update;
+}
+step "blocker_commit" { COMMIT; }
+
+session "archive"
+step "archive_begin" { BEGIN; }
+step "archive_board" {
+  update agent_board.boards set status='archived'
+   where slug='atomic-archive-board' returning status;
+}
+step "archive_commit" { COMMIT; }
+
+session "retry"
+step "retry_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "retry_onboard" {
+  select identity_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-archive.test', 'message-board', 'human-archive',
+    jsonb_build_object('iss','https://atomic-archive.test','aud','message-board','sub','human-archive','iat',200),
+    'atomic-archive-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16290000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-archive-board'),
+    '16290000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-archive-repo', 'worker', 'phase_worker',
+    'atomic-archive-agent'
+  );
+}
+step "retry_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select
+    (select status from agent_board.boards where slug='atomic-archive-board') as board_status,
+    (select uses_count from agent_board.board_invite_tokens where created_by_agent_id='16290000-0000-0000-0000-000000000001') as uses_count,
+    (select count(*) from agent_board.fleet_machine_agents where machine_id='16290000-0000-0000-0000-000000000003') as bindings;
+}
+
+permutation "archive_begin" "archive_board" "retry_begin" "retry_onboard" "archive_commit" "retry_commit" "check"
+permutation "blocker_begin" "block_machine" "retry_begin" "retry_onboard" "archive_begin" "archive_board" "blocker_commit" "retry_commit" "archive_commit" "check"

package/tests/isolation/specs/atomic_fleet_human_fresh_revoke.spec

@@ -0,0 +1,142 @@
+# Consiliency/message-board#162 — a total human revocation and a fresh-key
+# onboarding share the durable human-owner lock. Prove both orders: onboarding
+# first is included in the subtree, while revocation first durably blocks it.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16280000-0000-0000-0000-000000000001', 'agent', 'agent',
+          'atomic-human-owner', 'Atomic Human Owner', 'active');
+  select count(*) from agent_board.create_board(
+    '16280000-0000-0000-0000-000000000001',
+    'atomic-human-board', 'Atomic Human Board',
+    'Consiliency/message-board#162 fresh human race', jsonb_build_object(), 'private'
+  );
+  insert into agent_board.fleet_trust_domains(
+    id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at
+  ) values (
+    '16280000-0000-0000-0000-000000000002', 'atomic-human-domain',
+    'Atomic Human Domain', 'tailnet', '16280000-0000-0000-0000-000000000001',
+    'active', now()
+  );
+  insert into agent_board.fleet_machines(
+    id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+    lifecycle_state, enrollment_source, enrolled_at
+  ) values (
+    '16280000-0000-0000-0000-000000000003',
+    '16280000-0000-0000-0000-000000000002',
+    '16280000-0000-0000-0000-000000000001',
+    'claw', 'sha256:atomic-human-machine', 'active', 'portal', now()
+  );
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://atomic-human.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+  select count(*) from agent_board.enroll_federated_identity(
+    'https://atomic-human.test', 'message-board', 'human-fresh-race',
+    jsonb_build_object('iss','https://atomic-human.test','aud','message-board','sub','human-fresh-race'),
+    'atomic-human-existing',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[], null
+  );
+  select count(*) from agent_board.create_fleet_onboarding_invite(
+    (select id from agent_board.boards where slug='atomic-human-board'),
+    '16280000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-human-repo', 'worker', 'phase_worker',
+    'atomic-human-fresh', 1, now() + interval '1 hour',
+    '16280000-0000-0000-0000-000000000001', jsonb_build_object()
+  );
+}
+
+teardown
+{
+  delete from agent_board.fleet_revocation_events where agent_id in (
+    select id from agent_board.agents where handle in ('atomic-human-existing','atomic-human-fresh')
+  );
+  delete from agent_board.fleet_machine_agents where machine_id='16280000-0000-0000-0000-000000000003';
+  delete from agent_board.fleet_repo_scopes where harness_registration_id in (
+    select id from agent_board.fleet_harness_registrations where machine_id='16280000-0000-0000-0000-000000000003'
+  );
+  delete from agent_board.fleet_harness_registrations where machine_id='16280000-0000-0000-0000-000000000003';
+  delete from agent_board.board_invite_redemptions where invite_id in (
+    select id from agent_board.board_invite_tokens where created_by_agent_id='16280000-0000-0000-0000-000000000001'
+  );
+  truncate agent_board.fleet_onboarding_invite_bounds;
+  delete from agent_board.board_invite_tokens where created_by_agent_id='16280000-0000-0000-0000-000000000001';
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug='atomic-human-board'
+  );
+  delete from agent_board.enrollment_federation_audit where issuer='https://atomic-human.test';
+  delete from agent_board.agent_signing_keys where agent_id in (
+    select id from agent_board.agents where handle in ('atomic-human-existing','atomic-human-fresh')
+  );
+  delete from agent_board.fleet_human_revocations where owner_user_id in (
+    select owner_user_id from agent_board.agents where handle in ('atomic-human-existing','atomic-human-fresh')
+  );
+  delete from agent_board.agents where handle in ('atomic-human-existing','atomic-human-fresh');
+  delete from agent_board.boards where slug='atomic-human-board';
+  delete from agent_board.fleet_machines where id='16280000-0000-0000-0000-000000000003';
+  delete from agent_board.fleet_trust_domains where id='16280000-0000-0000-0000-000000000002';
+  delete from agent_board.agents where id='16280000-0000-0000-0000-000000000001';
+  delete from agent_board.identity_providers where issuer='https://atomic-human.test';
+}
+
+session "blocker"
+step "blocker_begin" { BEGIN; }
+step "block_creator" {
+  select id from agent_board.agents
+   where id='16280000-0000-0000-0000-000000000001' for update;
+}
+step "block_existing" {
+  select handle from agent_board.agents where handle='atomic-human-existing' for update;
+}
+step "blocker_commit" { COMMIT; }
+
+session "onboard"
+step "onboard_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "onboard_fresh" {
+  select identity_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-human.test', 'message-board', 'human-fresh-race',
+    jsonb_build_object('iss','https://atomic-human.test','aud','message-board','sub','human-fresh-race','iat',200),
+    'atomic-human-fresh',
+    'TDyof3w0SMg4SDYuj-qenolHC_n05cZbrLSckKVGtMo',
+    'raw_ed25519_base64url',
+    'sha256:lSBZnHvmPvQONy8aoygp-fmTg26iZenrZC-L5LN9m7M',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16280000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-human-board'),
+    '16280000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-human-repo', 'worker', 'phase_worker',
+    'atomic-human-fresh'
+  );
+}
+step "onboard_commit" { COMMIT; }
+
+session "revoke"
+step "revoke_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "revoke_human" {
+  select revoked_agent_count
+  from agent_board.revoke_human_subtree(
+    (select owner_user_id from agent_board.agents where handle='atomic-human-existing'),
+    '16280000-0000-0000-0000-000000000001', 'fresh race revoke'
+  );
+}
+step "revoke_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select
+    (select count(*) from agent_board.fleet_human_revocations) as human_revocations,
+    (select count(*) from agent_board.agents where handle='atomic-human-fresh') as fresh_agents,
+    (select coalesce(max(status),'absent') from agent_board.agents where handle='atomic-human-fresh') as fresh_status,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint='sha256:lSBZnHvmPvQONy8aoygp-fmTg26iZenrZC-L5LN9m7M') as fresh_keys;
+}
+
+permutation "blocker_begin" "block_creator" "onboard_begin" "onboard_fresh" "revoke_begin" "revoke_human" "blocker_commit" "onboard_commit" "revoke_commit" "check"
+permutation "blocker_begin" "block_existing" "revoke_begin" "revoke_human" "onboard_begin" "onboard_fresh" "blocker_commit" "revoke_commit" "onboard_commit" "check"

package/tests/isolation/specs/atomic_fleet_identity_disposition.spec

@@ -0,0 +1,118 @@
+# Consiliency/message-board#162 — a fleet enrollment that waits behind a
+# concurrent legacy enrollment for the same fingerprint must report the identity
+# as reused. The outer composed RPC takes the fingerprint lock before classifying.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16260000-0000-0000-0000-000000000001', 'agent', 'agent',
+          'atomic-disposition-owner', 'Atomic Disposition Owner', 'active');
+  select count(*) from agent_board.create_board(
+    '16260000-0000-0000-0000-000000000001',
+    'atomic-disposition-board', 'Atomic Disposition Board',
+    'Consiliency/message-board#162 disposition isolation proof',
+    jsonb_build_object(), 'private'
+  );
+  insert into agent_board.fleet_trust_domains(
+    id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at
+  ) values (
+    '16260000-0000-0000-0000-000000000002', 'atomic-disposition-domain',
+    'Atomic Disposition Domain', 'tailnet', '16260000-0000-0000-0000-000000000001',
+    'active', now()
+  );
+  insert into agent_board.fleet_machines(
+    id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+    lifecycle_state, enrollment_source, enrolled_at
+  ) values (
+    '16260000-0000-0000-0000-000000000003',
+    '16260000-0000-0000-0000-000000000002',
+    '16260000-0000-0000-0000-000000000001',
+    'claw', 'sha256:atomic-disposition-machine', 'active', 'portal', now()
+  );
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://atomic-disposition.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+  select count(*) from agent_board.create_fleet_onboarding_invite(
+    (select id from agent_board.boards where slug='atomic-disposition-board'),
+    '16260000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-disposition-repo', 'worker', 'phase_worker',
+    'atomic-disposition-agent', 1, now() + interval '1 hour',
+    '16260000-0000-0000-0000-000000000001', jsonb_build_object()
+  );
+}
+
+teardown
+{
+  delete from agent_board.fleet_machine_agents where machine_id='16260000-0000-0000-0000-000000000003';
+  delete from agent_board.fleet_repo_scopes where harness_registration_id in (
+    select id from agent_board.fleet_harness_registrations where machine_id='16260000-0000-0000-0000-000000000003'
+  );
+  delete from agent_board.fleet_harness_registrations where machine_id='16260000-0000-0000-0000-000000000003';
+  delete from agent_board.board_invite_redemptions where invite_id in (
+    select id from agent_board.board_invite_tokens where created_by_agent_id='16260000-0000-0000-0000-000000000001'
+  );
+  truncate agent_board.fleet_onboarding_invite_bounds;
+  delete from agent_board.board_invite_tokens where created_by_agent_id='16260000-0000-0000-0000-000000000001';
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug='atomic-disposition-board'
+  );
+  delete from agent_board.enrollment_federation_audit where issuer='https://atomic-disposition.test';
+  delete from agent_board.agent_signing_keys where agent_id in (
+    select id from agent_board.agents where handle='atomic-disposition-agent'
+  );
+  delete from agent_board.agents where handle='atomic-disposition-agent';
+  delete from agent_board.boards where slug='atomic-disposition-board';
+  delete from agent_board.fleet_machines where id='16260000-0000-0000-0000-000000000003';
+  delete from agent_board.fleet_trust_domains where id='16260000-0000-0000-0000-000000000002';
+  delete from agent_board.agents where id='16260000-0000-0000-0000-000000000001';
+  delete from agent_board.identity_providers where issuer='https://atomic-disposition.test';
+}
+
+session "legacy"
+step "legacy_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "legacy_enroll" {
+  select agent_handle
+  from agent_board.enroll_federated_identity(
+    'https://atomic-disposition.test', 'message-board', 'human-disposition',
+    jsonb_build_object('iss','https://atomic-disposition.test','aud','message-board','sub','human-disposition','iat',100),
+    'atomic-disposition-agent',
+    '5TG73fnNhqeYkoSvPf9QwmWkvKWe0yA7B8YinAWQ8m4', 'raw_ed25519_base64url',
+    'sha256:qhjEQe9R_x26TBZyBsd-LrpR1fh7Mvnz86rbsCKtjz8', true, null, 'agent',
+    ARRAY['board:send'], ARRAY[]::text[], null
+  );
+}
+step "legacy_commit" { COMMIT; }
+
+session "fleet"
+step "fleet_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "fleet_onboard" {
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-disposition.test', 'message-board', 'human-disposition',
+    jsonb_build_object('iss','https://atomic-disposition.test','aud','message-board','sub','human-disposition','iat',101),
+    'atomic-disposition-agent',
+    '5TG73fnNhqeYkoSvPf9QwmWkvKWe0yA7B8YinAWQ8m4', 'raw_ed25519_base64url',
+    'sha256:qhjEQe9R_x26TBZyBsd-LrpR1fh7Mvnz86rbsCKtjz8', true, null, 'agent',
+    ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16260000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-disposition-board'),
+    '16260000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-disposition-repo', 'worker', 'phase_worker',
+    'atomic-disposition-agent'
+  );
+}
+step "fleet_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select
+    (select count(*) from agent_board.agents where handle='atomic-disposition-agent') as agents,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint='sha256:qhjEQe9R_x26TBZyBsd-LrpR1fh7Mvnz86rbsCKtjz8') as keys,
+    (select count(*) from agent_board.fleet_machine_agents where machine_id='16260000-0000-0000-0000-000000000003') as bindings;
+}
+
+permutation "legacy_begin" "legacy_enroll" "fleet_begin" "fleet_onboard" "legacy_commit" "fleet_commit" "check"

package/tests/isolation/specs/atomic_fleet_lifecycle_races.spec

@@ -0,0 +1,244 @@
+# Consiliency/message-board#162 — composed retry races every public lifecycle
+# writer that can invalidate a completed fleet authority chain. Each writer is
+# exercised in both winner orderings against the real onboarding RPC.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values
+    ('16240000-0000-0000-0000-000000000001', 'agent', 'agent',
+     'atomic-lifecycle-owner', 'Atomic Lifecycle Owner', 'active'),
+    ('16240000-0000-0000-0000-000000000004', 'agent', 'agent',
+     'atomic-lifecycle-new-owner', 'Atomic Lifecycle New Owner', 'active');
+
+  select count(*) from agent_board.create_board(
+    '16240000-0000-0000-0000-000000000001', 'atomic-lifecycle-board',
+    'Atomic Lifecycle Board', 'Consiliency/message-board#162 isolation proof',
+    jsonb_build_object(), 'private'
+  );
+  insert into agent_board.fleet_trust_domains(
+    id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at
+  ) values (
+    '16240000-0000-0000-0000-000000000002', 'atomic-lifecycle-domain',
+    'Atomic Lifecycle Domain', 'tailnet', '16240000-0000-0000-0000-000000000001',
+    'active', now()
+  );
+  insert into agent_board.fleet_machines(
+    id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+    lifecycle_state, enrollment_source, enrolled_at
+  ) values (
+    '16240000-0000-0000-0000-000000000003',
+    '16240000-0000-0000-0000-000000000002',
+    '16240000-0000-0000-0000-000000000001',
+    'claw', 'sha256:atomic-lifecycle-machine', 'active', 'portal', now()
+  );
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://atomic-lifecycle.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+  select count(*) from agent_board.create_fleet_onboarding_invite(
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent', 1, now() + interval '1 hour',
+    '16240000-0000-0000-0000-000000000001', jsonb_build_object()
+  );
+  select count(*) from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle'),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+}
+
+teardown
+{
+  delete from agent_board.fleet_human_revocations;
+  delete from agent_board.fleet_revocation_events where subject_id in (
+    '16240000-0000-0000-0000-000000000002',
+    '16240000-0000-0000-0000-000000000003',
+    (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    (select k.id from agent_board.agent_signing_keys k join agent_board.agents a on a.id=k.agent_id where a.handle='atomic-lifecycle-agent'),
+    (select id from agent_board.fleet_harness_registrations where machine_id='16240000-0000-0000-0000-000000000003'),
+    (select frs.id from agent_board.fleet_repo_scopes frs join agent_board.fleet_harness_registrations fhr on fhr.id=frs.harness_registration_id where fhr.machine_id='16240000-0000-0000-0000-000000000003')
+  );
+  delete from agent_board.fleet_machine_agents where machine_id='16240000-0000-0000-0000-000000000003';
+  delete from agent_board.fleet_repo_scopes where harness_registration_id in (
+    select id from agent_board.fleet_harness_registrations where machine_id='16240000-0000-0000-0000-000000000003'
+  );
+  delete from agent_board.fleet_harness_registrations where machine_id='16240000-0000-0000-0000-000000000003';
+  delete from agent_board.board_invite_redemptions where invite_id in (
+    select id from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'
+  );
+  truncate agent_board.fleet_onboarding_invite_bounds;
+  delete from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001';
+  delete from agent_board.board_memberships where board_id in (
+    select id from agent_board.boards where slug='atomic-lifecycle-board'
+  );
+  delete from agent_board.enrollment_federation_audit where agent_id in (
+    select id from agent_board.agents where handle='atomic-lifecycle-agent'
+  );
+  delete from agent_board.agent_signing_keys where agent_id in (
+    select id from agent_board.agents where handle='atomic-lifecycle-agent'
+  );
+  delete from agent_board.agents where handle='atomic-lifecycle-agent';
+  delete from agent_board.boards where slug='atomic-lifecycle-board';
+  delete from agent_board.fleet_machines where id='16240000-0000-0000-0000-000000000003';
+  delete from agent_board.fleet_trust_domains where id='16240000-0000-0000-0000-000000000002';
+  delete from agent_board.agents where id in (
+    '16240000-0000-0000-0000-000000000001',
+    '16240000-0000-0000-0000-000000000004'
+  );
+  delete from agent_board.identity_providers where issuer='https://atomic-lifecycle.test';
+}
+
+session "retry"
+step "retry_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "retry_onboard" {
+  select identity_disposition, membership_disposition, binding_disposition
+  from agent_board.onboard_federated_fleet_agent(
+    'https://atomic-lifecycle.test', 'message-board', 'human-lifecycle',
+    jsonb_build_object('iss','https://atomic-lifecycle.test','aud','message-board','sub','human-lifecycle','iat',200),
+    'atomic-lifecycle-agent',
+    'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
+    'raw_ed25519_base64url',
+    'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
+    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    (select code from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001'),
+    (select id from agent_board.boards where slug='atomic-lifecycle-board'),
+    '16240000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:atomic-lifecycle-repo', 'worker', 'phase_worker',
+    'atomic-lifecycle-agent'
+  );
+}
+step "retry_commit" { COMMIT; }
+
+session "lifecycle"
+step "lifecycle_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "revoke_fleet_agent" {
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'agent', (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation agent revoke', jsonb_build_object()
+  );
+}
+step "revoke_fleet_key" {
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'signing_key', (select k.id from agent_board.agent_signing_keys k join agent_board.agents a on a.id=k.agent_id where a.handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation key revoke', jsonb_build_object()
+  );
+}
+step "revoke_agent" {
+  select status from agent_board.revoke_agent(
+    (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    'isolation legacy agent revoke'
+  );
+}
+step "revoke_agent_subtree" {
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation agent subtree revoke'
+  );
+}
+step "revoke_human_subtree" {
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select owner_user_id from agent_board.agents where handle='atomic-lifecycle-agent'),
+    '16240000-0000-0000-0000-000000000001', 'isolation human subtree revoke'
+  );
+}
+step "revoke_harness" {
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'harness', (select id from agent_board.fleet_harness_registrations where machine_id='16240000-0000-0000-0000-000000000003'),
+    '16240000-0000-0000-0000-000000000001', 'isolation harness revoke', jsonb_build_object()
+  );
+}
+step "revoke_repo" {
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'repo_scope', (select frs.id from agent_board.fleet_repo_scopes frs join agent_board.fleet_harness_registrations fhr on fhr.id=frs.harness_registration_id where fhr.machine_id='16240000-0000-0000-0000-000000000003'),
+    '16240000-0000-0000-0000-000000000001', 'isolation repo revoke', jsonb_build_object()
+  );
+}
+step "revoke_machine" {
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'machine', '16240000-0000-0000-0000-000000000003',
+    '16240000-0000-0000-0000-000000000001', 'isolation machine revoke', jsonb_build_object()
+  );
+}
+step "reclaim_machine" {
+  select owner_agent_id from agent_board.reclaim_fleet_machine(
+    '16240000-0000-0000-0000-000000000003',
+    '16240000-0000-0000-0000-000000000004',
+    '16240000-0000-0000-0000-000000000001', 'isolation machine reclaim'
+  );
+}
+step "revoke_domain" {
+  select subject_kind from agent_board.revoke_fleet_subject(
+    'trust_domain', '16240000-0000-0000-0000-000000000002',
+    '16240000-0000-0000-0000-000000000001', 'isolation domain revoke', jsonb_build_object()
+  );
+}
+step "reclaim_domain" {
+  select owner_agent_id from agent_board.reclaim_fleet_trust_domain(
+    '16240000-0000-0000-0000-000000000002',
+    '16240000-0000-0000-0000-000000000004',
+    '16240000-0000-0000-0000-000000000001', 'isolation domain reclaim'
+  );
+}
+step "lifecycle_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select a.status as agent_status,
+         k.status as key_status,
+         b.lifecycle_state as binding_state,
+         h.lifecycle_state as harness_state,
+         r.lifecycle_state as repo_state,
+         m.lifecycle_state as machine_state,
+         d.lifecycle_state as domain_state,
+         (select count(*) from agent_board.agents aa where aa.handle='atomic-lifecycle-agent') as agents,
+         (select count(*) from agent_board.fleet_machine_agents bb join agent_board.agents aa on aa.id=bb.agent_id where aa.handle='atomic-lifecycle-agent') as bindings
+    from agent_board.agents a
+    join agent_board.agent_signing_keys k on k.agent_id=a.id
+    join agent_board.fleet_machine_agents b on b.agent_id=a.id
+    join agent_board.fleet_machines m on m.id=b.machine_id
+    join agent_board.fleet_trust_domains d on d.id=m.trust_domain_id
+    join agent_board.fleet_harness_registrations h on h.machine_id=m.id
+    join agent_board.fleet_repo_scopes r on r.harness_registration_id=h.id
+   where a.handle='atomic-lifecycle-agent';
+}
+
+# Retry wins, then the real lifecycle writer commits.
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "revoke_fleet_agent" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "revoke_fleet_key" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "revoke_agent" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "revoke_agent_subtree" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "revoke_human_subtree" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "revoke_harness" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "revoke_repo" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "revoke_machine" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "reclaim_machine" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "revoke_domain" "retry_commit" "lifecycle_commit" "check"
+permutation "retry_begin" "retry_onboard" "lifecycle_begin" "reclaim_domain" "retry_commit" "lifecycle_commit" "check"
+
+# The lifecycle writer wins; retry must roll back without replacement authority.
+permutation "lifecycle_begin" "revoke_fleet_agent" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "revoke_fleet_key" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "revoke_agent" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "revoke_agent_subtree" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "revoke_human_subtree" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "revoke_harness" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "revoke_repo" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "revoke_machine" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "reclaim_machine" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "revoke_domain" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"
+permutation "lifecycle_begin" "reclaim_domain" "retry_begin" "retry_onboard" "lifecycle_commit" "retry_commit" "check"