@consiliency/agent-board-schema 1.25.0 → 1.27.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/fixtures/already-applied.json +4 -0
  2. package/migrations/20260908000100_agent_board_signer_lifecycle_revalidation.sql +451 -0
  3. package/package.json +1 -1
  4. package/schema-manifest.json +12 -3
  5. package/src/tooling.test.mjs +2 -2
  6. package/tests/agent_board_atomic_fleet_onboarding.test.sql +6 -1
  7. package/tests/agent_board_signed_authority_provenance.test.sql +24 -1
  8. package/tests/agent_board_signer_lifecycle.test.sql +709 -0
  9. package/tests/catalog/p_metadata_parameters.json +4 -0
  10. package/tests/isolation/expected/signed_grant_onboarding_deadlock.out +220 -0
  11. package/tests/isolation/expected/signer_lifecycle_revoke.out +307 -0
  12. package/tests/isolation/specs/signed_grant_onboarding_deadlock.spec +159 -0
  13. package/tests/isolation/specs/signer_lifecycle_revoke.spec +176 -0
package/tests/catalog/p_metadata_parameters.json CHANGED
@@ -17,6 +17,10 @@
17
17
  "signature": "_agent_principal_active(p_agent_id uuid)",
18
18
  "declares_p_metadata": false
19
19
  },
20
+ {
21
+ "signature": "_assert_signed_authority_signer_live(p_actor_agent_id uuid, p_gateway_decision jsonb)",
22
+ "declares_p_metadata": false
23
+ },
20
24
  {
21
25
  "signature": "_board_membership_events_provenance_guard()",
22
26
  "declares_p_metadata": false
package/tests/isolation/expected/signed_grant_onboarding_deadlock.out ADDED
@@ -0,0 +1,220 @@
1
+ Parsed test spec with 3 sessions
2
+
3
+ starting permutation: onboard_begin onboard_advisory onboard_agents auth_begin auth_grant onboard_membership onboard_commit auth_commit check
4
+ step onboard_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
5
+ step onboard_advisory:
6
+ select agent_board._lock_board_authority_ceiling('f4950000-0000-4000-8000-000000000001') is null as advisory_taken;
7
+
8
+ advisory_taken
9
+ --------------
10
+ f
11
+ (1 row)
12
+
13
+ step onboard_agents:
14
+ select count(*)::int as locked_agents from (
15
+ select 1 from agent_board.agents a
16
+ where a.id = 'f4940000-0000-4000-8000-000000000001' for update) s;
17
+
18
+ locked_agents
19
+ -------------
20
+ 1
21
+ (1 row)
22
+
23
+ step auth_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
24
+ step auth_grant:
25
+ select w.role as granted_role
26
+ from agent_board.signed_grant_board_role(
27
+ jsonb_build_object(
28
+ 'p_board_id', 'f4950000-0000-4000-8000-000000000001',
29
+ 'p_agent_id', 'f4940000-0000-4000-8000-000000000002',
30
+ 'p_grantee_role', 'admin'),
31
+ jsonb_build_object(
32
+ 'agent_id', 'f4940000-0000-4000-8000-000000000001',
33
+ 'signing_key_id', 'f4960000-0000-4000-8000-000000000001',
34
+ 'key_id', 'primary',
35
+ 'key_version', 1,
36
+ 'algorithm', 'Ed25519',
37
+ 'verification_status', 'verified',
38
+ 'payload_digest', 'sha256:f4iso',
39
+ 'enforcement_mode', 'require_for_agent_writes')) w;
40
+ <waiting ...>
41
+ step onboard_membership:
42
+ select count(*)::int as locked_memberships from (
43
+ select 1 from agent_board.board_memberships bm
44
+ where bm.board_id = 'f4950000-0000-4000-8000-000000000001'
45
+ and bm.agent_id = 'f4940000-0000-4000-8000-000000000002'
46
+ order by bm.id for update) s;
47
+
48
+ locked_memberships
49
+ ------------------
50
+ 1
51
+ (1 row)
52
+
53
+ step onboard_commit: COMMIT;
54
+ step auth_grant: <... completed>
55
+ granted_role
56
+ ------------
57
+ admin
58
+ (1 row)
59
+
60
+ step auth_commit: COMMIT;
61
+ step check:
62
+ select
63
+ (select role from agent_board.board_memberships
64
+ where board_id = 'f4950000-0000-4000-8000-000000000001'
65
+ and agent_id = 'f4940000-0000-4000-8000-000000000002') as grantee_role,
66
+ (select count(*)::int from agent_board.signature_evidence
67
+ where operation = 'grant_board_role'
68
+ and agent_id = 'f4940000-0000-4000-8000-000000000001') as evidence_rows;
69
+
70
+ grantee_role|evidence_rows
71
+ ------------+-------------
72
+ admin | 1
73
+ (1 row)
74
+
75
+
76
+ starting permutation: auth_begin auth_grant onboard_begin onboard_advisory auth_commit onboard_agents onboard_membership onboard_commit check
77
+ step auth_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
78
+ step auth_grant:
79
+ select w.role as granted_role
80
+ from agent_board.signed_grant_board_role(
81
+ jsonb_build_object(
82
+ 'p_board_id', 'f4950000-0000-4000-8000-000000000001',
83
+ 'p_agent_id', 'f4940000-0000-4000-8000-000000000002',
84
+ 'p_grantee_role', 'admin'),
85
+ jsonb_build_object(
86
+ 'agent_id', 'f4940000-0000-4000-8000-000000000001',
87
+ 'signing_key_id', 'f4960000-0000-4000-8000-000000000001',
88
+ 'key_id', 'primary',
89
+ 'key_version', 1,
90
+ 'algorithm', 'Ed25519',
91
+ 'verification_status', 'verified',
92
+ 'payload_digest', 'sha256:f4iso',
93
+ 'enforcement_mode', 'require_for_agent_writes')) w;
94
+
95
+ granted_role
96
+ ------------
97
+ admin
98
+ (1 row)
99
+
100
+ step onboard_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
101
+ step onboard_advisory:
102
+ select agent_board._lock_board_authority_ceiling('f4950000-0000-4000-8000-000000000001') is null as advisory_taken;
103
+ <waiting ...>
104
+ step auth_commit: COMMIT;
105
+ step onboard_advisory: <... completed>
106
+ advisory_taken
107
+ --------------
108
+ f
109
+ (1 row)
110
+
111
+ step onboard_agents:
112
+ select count(*)::int as locked_agents from (
113
+ select 1 from agent_board.agents a
114
+ where a.id = 'f4940000-0000-4000-8000-000000000001' for update) s;
115
+
116
+ locked_agents
117
+ -------------
118
+ 1
119
+ (1 row)
120
+
121
+ step onboard_membership:
122
+ select count(*)::int as locked_memberships from (
123
+ select 1 from agent_board.board_memberships bm
124
+ where bm.board_id = 'f4950000-0000-4000-8000-000000000001'
125
+ and bm.agent_id = 'f4940000-0000-4000-8000-000000000002'
126
+ order by bm.id for update) s;
127
+
128
+ locked_memberships
129
+ ------------------
130
+ 1
131
+ (1 row)
132
+
133
+ step onboard_commit: COMMIT;
134
+ step check:
135
+ select
136
+ (select role from agent_board.board_memberships
137
+ where board_id = 'f4950000-0000-4000-8000-000000000001'
138
+ and agent_id = 'f4940000-0000-4000-8000-000000000002') as grantee_role,
139
+ (select count(*)::int from agent_board.signature_evidence
140
+ where operation = 'grant_board_role'
141
+ and agent_id = 'f4940000-0000-4000-8000-000000000001') as evidence_rows;
142
+
143
+ grantee_role|evidence_rows
144
+ ------------+-------------
145
+ admin | 1
146
+ (1 row)
147
+
148
+
149
+ starting permutation: onboard_begin onboard_advisory auth_begin auth_grant onboard_agents onboard_membership onboard_commit auth_commit check
150
+ step onboard_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
151
+ step onboard_advisory:
152
+ select agent_board._lock_board_authority_ceiling('f4950000-0000-4000-8000-000000000001') is null as advisory_taken;
153
+
154
+ advisory_taken
155
+ --------------
156
+ f
157
+ (1 row)
158
+
159
+ step auth_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
160
+ step auth_grant:
161
+ select w.role as granted_role
162
+ from agent_board.signed_grant_board_role(
163
+ jsonb_build_object(
164
+ 'p_board_id', 'f4950000-0000-4000-8000-000000000001',
165
+ 'p_agent_id', 'f4940000-0000-4000-8000-000000000002',
166
+ 'p_grantee_role', 'admin'),
167
+ jsonb_build_object(
168
+ 'agent_id', 'f4940000-0000-4000-8000-000000000001',
169
+ 'signing_key_id', 'f4960000-0000-4000-8000-000000000001',
170
+ 'key_id', 'primary',
171
+ 'key_version', 1,
172
+ 'algorithm', 'Ed25519',
173
+ 'verification_status', 'verified',
174
+ 'payload_digest', 'sha256:f4iso',
175
+ 'enforcement_mode', 'require_for_agent_writes')) w;
176
+ <waiting ...>
177
+ step onboard_agents:
178
+ select count(*)::int as locked_agents from (
179
+ select 1 from agent_board.agents a
180
+ where a.id = 'f4940000-0000-4000-8000-000000000001' for update) s;
181
+
182
+ locked_agents
183
+ -------------
184
+ 1
185
+ (1 row)
186
+
187
+ step onboard_membership:
188
+ select count(*)::int as locked_memberships from (
189
+ select 1 from agent_board.board_memberships bm
190
+ where bm.board_id = 'f4950000-0000-4000-8000-000000000001'
191
+ and bm.agent_id = 'f4940000-0000-4000-8000-000000000002'
192
+ order by bm.id for update) s;
193
+
194
+ locked_memberships
195
+ ------------------
196
+ 1
197
+ (1 row)
198
+
199
+ step onboard_commit: COMMIT;
200
+ step auth_grant: <... completed>
201
+ granted_role
202
+ ------------
203
+ admin
204
+ (1 row)
205
+
206
+ step auth_commit: COMMIT;
207
+ step check:
208
+ select
209
+ (select role from agent_board.board_memberships
210
+ where board_id = 'f4950000-0000-4000-8000-000000000001'
211
+ and agent_id = 'f4940000-0000-4000-8000-000000000002') as grantee_role,
212
+ (select count(*)::int from agent_board.signature_evidence
213
+ where operation = 'grant_board_role'
214
+ and agent_id = 'f4940000-0000-4000-8000-000000000001') as evidence_rows;
215
+
216
+ grantee_role|evidence_rows
217
+ ------------+-------------
218
+ admin | 1
219
+ (1 row)
220
+
package/tests/isolation/expected/signer_lifecycle_revoke.out ADDED
@@ -0,0 +1,307 @@
1
+ Parsed test spec with 5 sessions
2
+
3
+ starting permutation: auth_begin auth_grant revoke_begin revoke_signer auth_commit revoke_commit check
4
+ step auth_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
5
+ step auth_grant:
6
+ select w.role as granted_role
7
+ from agent_board.signed_grant_board_role(
8
+ jsonb_build_object(
9
+ 'p_board_id', '26950000-0000-4000-8000-000000000001',
10
+ 'p_agent_id', '26940000-0000-4000-8000-000000000002',
11
+ 'p_grantee_role', 'admin'),
12
+ jsonb_build_object(
13
+ 'agent_id', '26940000-0000-4000-8000-000000000001',
14
+ 'signing_key_id', '26960000-0000-4000-8000-000000000001',
15
+ 'key_id', 'primary',
16
+ 'key_version', 1,
17
+ 'algorithm', 'Ed25519',
18
+ 'verification_status', 'verified',
19
+ 'payload_digest', 'sha256:k269',
20
+ 'enforcement_mode', 'require_for_agent_writes')) w;
21
+
22
+ granted_role
23
+ ------------
24
+ admin
25
+ (1 row)
26
+
27
+ step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
28
+ step revoke_signer:
29
+ select revoked_agent_count, revoked_key_count
30
+ from agent_board.revoke_agent_subtree(
31
+ '26940000-0000-4000-8000-000000000001',
32
+ '26940000-0000-4000-8000-000000000003',
33
+ 'k269 iso revoke');
34
+ <waiting ...>
35
+ step auth_commit: COMMIT;
36
+ step revoke_signer: <... completed>
37
+ revoked_agent_count|revoked_key_count
38
+ -------------------+-----------------
39
+ 1| 1
40
+ (1 row)
41
+
42
+ step revoke_commit: COMMIT;
43
+ step check:
44
+ select
45
+ (select role from agent_board.board_memberships
46
+ where board_id = '26950000-0000-4000-8000-000000000001'
47
+ and agent_id = '26940000-0000-4000-8000-000000000002') as grantee_role,
48
+ (select status from agent_board.agents
49
+ where id = '26940000-0000-4000-8000-000000000001') as signer_status,
50
+ (select status from agent_board.agent_signing_keys
51
+ where id = '26960000-0000-4000-8000-000000000001') as key_status,
52
+ (select count(*) from agent_board.signature_evidence
53
+ where operation = 'grant_board_role') as evidence_rows;
54
+
55
+ grantee_role|signer_status|key_status|evidence_rows
56
+ ------------+-------------+----------+-------------
57
+ admin |revoked |revoked | 1
58
+ (1 row)
59
+
60
+
61
+ starting permutation: revoke_begin revoke_signer auth_begin auth_grant revoke_commit auth_commit check
62
+ step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
63
+ step revoke_signer:
64
+ select revoked_agent_count, revoked_key_count
65
+ from agent_board.revoke_agent_subtree(
66
+ '26940000-0000-4000-8000-000000000001',
67
+ '26940000-0000-4000-8000-000000000003',
68
+ 'k269 iso revoke');
69
+
70
+ revoked_agent_count|revoked_key_count
71
+ -------------------+-----------------
72
+ 1| 1
73
+ (1 row)
74
+
75
+ step auth_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
76
+ step auth_grant:
77
+ select w.role as granted_role
78
+ from agent_board.signed_grant_board_role(
79
+ jsonb_build_object(
80
+ 'p_board_id', '26950000-0000-4000-8000-000000000001',
81
+ 'p_agent_id', '26940000-0000-4000-8000-000000000002',
82
+ 'p_grantee_role', 'admin'),
83
+ jsonb_build_object(
84
+ 'agent_id', '26940000-0000-4000-8000-000000000001',
85
+ 'signing_key_id', '26960000-0000-4000-8000-000000000001',
86
+ 'key_id', 'primary',
87
+ 'key_version', 1,
88
+ 'algorithm', 'Ed25519',
89
+ 'verification_status', 'verified',
90
+ 'payload_digest', 'sha256:k269',
91
+ 'enforcement_mode', 'require_for_agent_writes')) w;
92
+ <waiting ...>
93
+ step revoke_commit: COMMIT;
94
+ step auth_grant: <... completed>
95
+ ERROR: signer_not_active: signed authority write signer is revoked, not active
96
+ step auth_commit: COMMIT;
97
+ step check:
98
+ select
99
+ (select role from agent_board.board_memberships
100
+ where board_id = '26950000-0000-4000-8000-000000000001'
101
+ and agent_id = '26940000-0000-4000-8000-000000000002') as grantee_role,
102
+ (select status from agent_board.agents
103
+ where id = '26940000-0000-4000-8000-000000000001') as signer_status,
104
+ (select status from agent_board.agent_signing_keys
105
+ where id = '26960000-0000-4000-8000-000000000001') as key_status,
106
+ (select count(*) from agent_board.signature_evidence
107
+ where operation = 'grant_board_role') as evidence_rows;
108
+
109
+ grantee_role|signer_status|key_status|evidence_rows
110
+ ------------+-------------+----------+-------------
111
+ member |revoked |revoked | 0
112
+ (1 row)
113
+
114
+
115
+ starting permutation: suspend_begin suspend_signer auth_begin auth_grant suspend_commit auth_commit check
116
+ step suspend_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
117
+ step suspend_signer:
118
+ update agent_board.agents set status = 'suspended', updated_at = now()
119
+ where id = '26940000-0000-4000-8000-000000000001';
120
+
121
+ step auth_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
122
+ step auth_grant:
123
+ select w.role as granted_role
124
+ from agent_board.signed_grant_board_role(
125
+ jsonb_build_object(
126
+ 'p_board_id', '26950000-0000-4000-8000-000000000001',
127
+ 'p_agent_id', '26940000-0000-4000-8000-000000000002',
128
+ 'p_grantee_role', 'admin'),
129
+ jsonb_build_object(
130
+ 'agent_id', '26940000-0000-4000-8000-000000000001',
131
+ 'signing_key_id', '26960000-0000-4000-8000-000000000001',
132
+ 'key_id', 'primary',
133
+ 'key_version', 1,
134
+ 'algorithm', 'Ed25519',
135
+ 'verification_status', 'verified',
136
+ 'payload_digest', 'sha256:k269',
137
+ 'enforcement_mode', 'require_for_agent_writes')) w;
138
+ <waiting ...>
139
+ step suspend_commit: COMMIT;
140
+ step auth_grant: <... completed>
141
+ ERROR: signer_not_active: signed authority write signer is suspended, not active
142
+ step auth_commit: COMMIT;
143
+ step check:
144
+ select
145
+ (select role from agent_board.board_memberships
146
+ where board_id = '26950000-0000-4000-8000-000000000001'
147
+ and agent_id = '26940000-0000-4000-8000-000000000002') as grantee_role,
148
+ (select status from agent_board.agents
149
+ where id = '26940000-0000-4000-8000-000000000001') as signer_status,
150
+ (select status from agent_board.agent_signing_keys
151
+ where id = '26960000-0000-4000-8000-000000000001') as key_status,
152
+ (select count(*) from agent_board.signature_evidence
153
+ where operation = 'grant_board_role') as evidence_rows;
154
+
155
+ grantee_role|signer_status|key_status|evidence_rows
156
+ ------------+-------------+----------+-------------
157
+ member |suspended |active | 0
158
+ (1 row)
159
+
160
+
161
+ starting permutation: auth_begin auth_grant suspend_begin suspend_signer auth_commit suspend_commit check
162
+ step auth_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
163
+ step auth_grant:
164
+ select w.role as granted_role
165
+ from agent_board.signed_grant_board_role(
166
+ jsonb_build_object(
167
+ 'p_board_id', '26950000-0000-4000-8000-000000000001',
168
+ 'p_agent_id', '26940000-0000-4000-8000-000000000002',
169
+ 'p_grantee_role', 'admin'),
170
+ jsonb_build_object(
171
+ 'agent_id', '26940000-0000-4000-8000-000000000001',
172
+ 'signing_key_id', '26960000-0000-4000-8000-000000000001',
173
+ 'key_id', 'primary',
174
+ 'key_version', 1,
175
+ 'algorithm', 'Ed25519',
176
+ 'verification_status', 'verified',
177
+ 'payload_digest', 'sha256:k269',
178
+ 'enforcement_mode', 'require_for_agent_writes')) w;
179
+
180
+ granted_role
181
+ ------------
182
+ admin
183
+ (1 row)
184
+
185
+ step suspend_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
186
+ step suspend_signer:
187
+ update agent_board.agents set status = 'suspended', updated_at = now()
188
+ where id = '26940000-0000-4000-8000-000000000001';
189
+ <waiting ...>
190
+ step auth_commit: COMMIT;
191
+ step suspend_signer: <... completed>
192
+ step suspend_commit: COMMIT;
193
+ step check:
194
+ select
195
+ (select role from agent_board.board_memberships
196
+ where board_id = '26950000-0000-4000-8000-000000000001'
197
+ and agent_id = '26940000-0000-4000-8000-000000000002') as grantee_role,
198
+ (select status from agent_board.agents
199
+ where id = '26940000-0000-4000-8000-000000000001') as signer_status,
200
+ (select status from agent_board.agent_signing_keys
201
+ where id = '26960000-0000-4000-8000-000000000001') as key_status,
202
+ (select count(*) from agent_board.signature_evidence
203
+ where operation = 'grant_board_role') as evidence_rows;
204
+
205
+ grantee_role|signer_status|key_status|evidence_rows
206
+ ------------+-------------+----------+-------------
207
+ admin |suspended |active | 1
208
+ (1 row)
209
+
210
+
211
+ starting permutation: auth_begin auth_grant keyrevoke_begin keyrevoke_key auth_commit keyrevoke_commit check
212
+ step auth_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
213
+ step auth_grant:
214
+ select w.role as granted_role
215
+ from agent_board.signed_grant_board_role(
216
+ jsonb_build_object(
217
+ 'p_board_id', '26950000-0000-4000-8000-000000000001',
218
+ 'p_agent_id', '26940000-0000-4000-8000-000000000002',
219
+ 'p_grantee_role', 'admin'),
220
+ jsonb_build_object(
221
+ 'agent_id', '26940000-0000-4000-8000-000000000001',
222
+ 'signing_key_id', '26960000-0000-4000-8000-000000000001',
223
+ 'key_id', 'primary',
224
+ 'key_version', 1,
225
+ 'algorithm', 'Ed25519',
226
+ 'verification_status', 'verified',
227
+ 'payload_digest', 'sha256:k269',
228
+ 'enforcement_mode', 'require_for_agent_writes')) w;
229
+
230
+ granted_role
231
+ ------------
232
+ admin
233
+ (1 row)
234
+
235
+ step keyrevoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
236
+ step keyrevoke_key:
237
+ update agent_board.agent_signing_keys
238
+ set status = 'revoked', proof_state = 'revoked', revoked_at = now(), updated_at = now()
239
+ where id = '26960000-0000-4000-8000-000000000001';
240
+ <waiting ...>
241
+ step auth_commit: COMMIT;
242
+ step keyrevoke_key: <... completed>
243
+ step keyrevoke_commit: COMMIT;
244
+ step check:
245
+ select
246
+ (select role from agent_board.board_memberships
247
+ where board_id = '26950000-0000-4000-8000-000000000001'
248
+ and agent_id = '26940000-0000-4000-8000-000000000002') as grantee_role,
249
+ (select status from agent_board.agents
250
+ where id = '26940000-0000-4000-8000-000000000001') as signer_status,
251
+ (select status from agent_board.agent_signing_keys
252
+ where id = '26960000-0000-4000-8000-000000000001') as key_status,
253
+ (select count(*) from agent_board.signature_evidence
254
+ where operation = 'grant_board_role') as evidence_rows;
255
+
256
+ grantee_role|signer_status|key_status|evidence_rows
257
+ ------------+-------------+----------+-------------
258
+ admin |active |revoked | 1
259
+ (1 row)
260
+
261
+
262
+ starting permutation: keyrevoke_begin keyrevoke_key auth_begin auth_grant keyrevoke_commit auth_commit check
263
+ step keyrevoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
264
+ step keyrevoke_key:
265
+ update agent_board.agent_signing_keys
266
+ set status = 'revoked', proof_state = 'revoked', revoked_at = now(), updated_at = now()
267
+ where id = '26960000-0000-4000-8000-000000000001';
268
+
269
+ step auth_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
270
+ step auth_grant:
271
+ select w.role as granted_role
272
+ from agent_board.signed_grant_board_role(
273
+ jsonb_build_object(
274
+ 'p_board_id', '26950000-0000-4000-8000-000000000001',
275
+ 'p_agent_id', '26940000-0000-4000-8000-000000000002',
276
+ 'p_grantee_role', 'admin'),
277
+ jsonb_build_object(
278
+ 'agent_id', '26940000-0000-4000-8000-000000000001',
279
+ 'signing_key_id', '26960000-0000-4000-8000-000000000001',
280
+ 'key_id', 'primary',
281
+ 'key_version', 1,
282
+ 'algorithm', 'Ed25519',
283
+ 'verification_status', 'verified',
284
+ 'payload_digest', 'sha256:k269',
285
+ 'enforcement_mode', 'require_for_agent_writes')) w;
286
+ <waiting ...>
287
+ step keyrevoke_commit: COMMIT;
288
+ step auth_grant: <... completed>
289
+ ERROR: signer_key_not_live: signed authority write signing key is revoked, not active
290
+ step auth_commit: COMMIT;
291
+ step check:
292
+ select
293
+ (select role from agent_board.board_memberships
294
+ where board_id = '26950000-0000-4000-8000-000000000001'
295
+ and agent_id = '26940000-0000-4000-8000-000000000002') as grantee_role,
296
+ (select status from agent_board.agents
297
+ where id = '26940000-0000-4000-8000-000000000001') as signer_status,
298
+ (select status from agent_board.agent_signing_keys
299
+ where id = '26960000-0000-4000-8000-000000000001') as key_status,
300
+ (select count(*) from agent_board.signature_evidence
301
+ where operation = 'grant_board_role') as evidence_rows;
302
+
303
+ grantee_role|signer_status|key_status|evidence_rows
304
+ ------------+-------------+----------+-------------
305
+ member |active |revoked | 0
306
+ (1 row)
307
+