@consiliency/agent-board-schema 1.27.0 → 1.28.0

package/tests/agent_board_signer_lifecycle.test.sql

@@ -699,6 +699,12 @@ select is(
      from agg
     where locks_agents and locks_memberships),
   array[
+    -- Joined this class in #276 (20260909000100). The fleet-ledger gate row-locks the actor's
+    -- agents row, so the live grant chokepoint -- and therefore every caller of it -- now locks
+    -- both relations. It takes the advisory lock rather than arguing from its ordering: this
+    -- assertion deliberately requires mutual exclusion, which survives a lock being added
+    -- downstream, and NOT a re-derived order, which does not.
+    'grant_board_role => serialised by the board advisory lock',
     'onboard_federated_fleet_agent => serialised by the board advisory lock',
     'signed_grant_board_role => serialised by the board advisory lock'
   ]::text[],

package/tests/catalog/p_metadata_parameters.json

@@ -5,6 +5,10 @@
       "signature": "_active_board_membership_id(p_board_id uuid, p_agent_id uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_actor_fleet_revoked(p_actor_agent_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_addressing_agent_ids_or_raise(p_actor_agent_id uuid, p_recipient_descriptors jsonb)",
       "declares_p_metadata": false
@@ -17,6 +21,10 @@
       "signature": "_agent_principal_active(p_agent_id uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_assert_actor_not_fleet_revoked(p_actor_agent_id uuid, p_operation text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_assert_signed_authority_signer_live(p_actor_agent_id uuid, p_gateway_decision jsonb)",
       "declares_p_metadata": false

package/tests/isolation/expected/ledger_authority_revoke.out

@@ -0,0 +1,483 @@
+Parsed test spec with 7 sessions
+
+starting permutation: ugrant_begin ugrant_grant revoke_begin revoke_agent ugrant_commit revoke_commit check
+step ugrant_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
+
+step ugrant_grant: 
+  select g.role as granted_role
+    from agent_board.grant_board_role(
+      '27720000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000002',
+      'admin') g;
+
+granted_role
+------------
+admin       
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+ <waiting ...>
+step ugrant_commit: COMMIT;
+step revoke_agent: <... completed>
+subject_kind
+------------
+agent       
+(1 row)
+
+step revoke_commit: COMMIT;
+step check: 
+  select
+    (select role from agent_board.board_memberships
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
+    (select count(*) from agent_board.fleet_machine_agents
+      where agent_id = '27710000-0000-4000-8000-000000000001'
+        and lifecycle_state = 'active') as active_bindings,
+    (select count(*) from agent_board.board_invite_tokens
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and code <> 'k276isolink') as minted_tokens,
+    (select uses_count from agent_board.board_invite_tokens
+      where code = 'k276isolink') as outstanding_link_uses;
+
+grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
+------------+------------+-----------------+---------------+-------------+---------------------
+admin       |active      |                1|              0|            0|                    0
+(1 row)
+
+
+starting permutation: revoke_begin revoke_agent ugrant_begin ugrant_grant revoke_commit ugrant_commit check
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+
+subject_kind
+------------
+agent       
+(1 row)
+
+step ugrant_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
+
+step ugrant_grant: 
+  select g.role as granted_role
+    from agent_board.grant_board_role(
+      '27720000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000002',
+      'admin') g;
+ <waiting ...>
+step revoke_commit: COMMIT;
+step ugrant_grant: <... completed>
+ERROR:  fleet_revoked: grant_board_role is not permitted for a fleet-revoked agent
+step ugrant_commit: COMMIT;
+step check: 
+  select
+    (select role from agent_board.board_memberships
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
+    (select count(*) from agent_board.fleet_machine_agents
+      where agent_id = '27710000-0000-4000-8000-000000000001'
+        and lifecycle_state = 'active') as active_bindings,
+    (select count(*) from agent_board.board_invite_tokens
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and code <> 'k276isolink') as minted_tokens,
+    (select uses_count from agent_board.board_invite_tokens
+      where code = 'k276isolink') as outstanding_link_uses;
+
+grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
+------------+------------+-----------------+---------------+-------------+---------------------
+member      |active      |                1|              0|            0|                    0
+(1 row)
+
+
+starting permutation: sgrant_begin sgrant_grant revoke_begin revoke_agent sgrant_commit revoke_commit check
+step sgrant_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step sgrant_grant: 
+  select w.role as granted_role
+    from agent_board.signed_grant_board_role(
+      jsonb_build_object(
+        'p_board_id', '27720000-0000-4000-8000-000000000001',
+        'p_agent_id', '27710000-0000-4000-8000-000000000002',
+        'p_grantee_role', 'admin'),
+      jsonb_build_object(
+        'agent_id', '27710000-0000-4000-8000-000000000001',
+        'signing_key_id', '27730000-0000-4000-8000-000000000001',
+        'key_id', 'primary',
+        'key_version', 1,
+        'algorithm', 'Ed25519',
+        'verification_status', 'verified',
+        'payload_digest', 'sha256:k276',
+        'enforcement_mode', 'require_for_agent_writes')) w;
+
+granted_role
+------------
+admin       
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+ <waiting ...>
+step sgrant_commit: COMMIT;
+step revoke_agent: <... completed>
+subject_kind
+------------
+agent       
+(1 row)
+
+step revoke_commit: COMMIT;
+step check: 
+  select
+    (select role from agent_board.board_memberships
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
+    (select count(*) from agent_board.fleet_machine_agents
+      where agent_id = '27710000-0000-4000-8000-000000000001'
+        and lifecycle_state = 'active') as active_bindings,
+    (select count(*) from agent_board.board_invite_tokens
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and code <> 'k276isolink') as minted_tokens,
+    (select uses_count from agent_board.board_invite_tokens
+      where code = 'k276isolink') as outstanding_link_uses;
+
+grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
+------------+------------+-----------------+---------------+-------------+---------------------
+admin       |active      |                1|              0|            0|                    0
+(1 row)
+
+
+starting permutation: revoke_begin revoke_agent sgrant_begin sgrant_grant revoke_commit sgrant_commit check
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+
+subject_kind
+------------
+agent       
+(1 row)
+
+step sgrant_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step sgrant_grant: 
+  select w.role as granted_role
+    from agent_board.signed_grant_board_role(
+      jsonb_build_object(
+        'p_board_id', '27720000-0000-4000-8000-000000000001',
+        'p_agent_id', '27710000-0000-4000-8000-000000000002',
+        'p_grantee_role', 'admin'),
+      jsonb_build_object(
+        'agent_id', '27710000-0000-4000-8000-000000000001',
+        'signing_key_id', '27730000-0000-4000-8000-000000000001',
+        'key_id', 'primary',
+        'key_version', 1,
+        'algorithm', 'Ed25519',
+        'verification_status', 'verified',
+        'payload_digest', 'sha256:k276',
+        'enforcement_mode', 'require_for_agent_writes')) w;
+ <waiting ...>
+step revoke_commit: COMMIT;
+step sgrant_grant: <... completed>
+ERROR:  fleet_revoked: grant_board_role is not permitted for a fleet-revoked agent
+step sgrant_commit: COMMIT;
+step check: 
+  select
+    (select role from agent_board.board_memberships
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
+    (select count(*) from agent_board.fleet_machine_agents
+      where agent_id = '27710000-0000-4000-8000-000000000001'
+        and lifecycle_state = 'active') as active_bindings,
+    (select count(*) from agent_board.board_invite_tokens
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and code <> 'k276isolink') as minted_tokens,
+    (select uses_count from agent_board.board_invite_tokens
+      where code = 'k276isolink') as outstanding_link_uses;
+
+grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
+------------+------------+-----------------+---------------+-------------+---------------------
+member      |active      |                1|              0|            0|                    0
+(1 row)
+
+
+starting permutation: revoke_begin revoke_agent mint_begin mint_link revoke_commit mint_commit check
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+
+subject_kind
+------------
+agent       
+(1 row)
+
+step mint_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
+
+step mint_link: 
+  select m.preset_role
+    from agent_board.create_invite_link(
+      '27720000-0000-4000-8000-000000000001', 'admin', 'joined', 5,
+      now() + interval '2 days') m;
+ <waiting ...>
+step revoke_commit: COMMIT;
+step mint_link: <... completed>
+ERROR:  fleet_revoked: create_invite_link is not permitted for a fleet-revoked agent
+step mint_commit: COMMIT;
+step check: 
+  select
+    (select role from agent_board.board_memberships
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
+    (select count(*) from agent_board.fleet_machine_agents
+      where agent_id = '27710000-0000-4000-8000-000000000001'
+        and lifecycle_state = 'active') as active_bindings,
+    (select count(*) from agent_board.board_invite_tokens
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and code <> 'k276isolink') as minted_tokens,
+    (select uses_count from agent_board.board_invite_tokens
+      where code = 'k276isolink') as outstanding_link_uses;
+
+grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
+------------+------------+-----------------+---------------+-------------+---------------------
+member      |active      |                1|              0|            0|                    0
+(1 row)
+
+
+starting permutation: revoke_begin revoke_agent redeem_begin redeem_link redeem_commit revoke_commit check
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+
+subject_kind
+------------
+agent       
+(1 row)
+
+step redeem_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a2';
+
+step redeem_link: 
+  select r.role as redeemed_role
+    from agent_board.redeem_invite_link('k276isolink') r;
+
+redeemed_role
+-------------
+admin        
+(1 row)
+
+step redeem_commit: COMMIT;
+step revoke_commit: COMMIT;
+step check: 
+  select
+    (select role from agent_board.board_memberships
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
+    (select count(*) from agent_board.fleet_machine_agents
+      where agent_id = '27710000-0000-4000-8000-000000000001'
+        and lifecycle_state = 'active') as active_bindings,
+    (select count(*) from agent_board.board_invite_tokens
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and code <> 'k276isolink') as minted_tokens,
+    (select uses_count from agent_board.board_invite_tokens
+      where code = 'k276isolink') as outstanding_link_uses;
+
+grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
+------------+------------+-----------------+---------------+-------------+---------------------
+admin       |active      |                1|              0|            0|                    1
+(1 row)
+
+
+starting permutation: revoke_begin revoke_agent revoke_commit redeem_begin redeem_link redeem_commit check
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+
+subject_kind
+------------
+agent       
+(1 row)
+
+step revoke_commit: COMMIT;
+step redeem_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a2';
+
+step redeem_link: 
+  select r.role as redeemed_role
+    from agent_board.redeem_invite_link('k276isolink') r;
+
+ERROR:  invite is not usable
+step redeem_commit: COMMIT;
+step check: 
+  select
+    (select role from agent_board.board_memberships
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
+    (select count(*) from agent_board.fleet_machine_agents
+      where agent_id = '27710000-0000-4000-8000-000000000001'
+        and lifecycle_state = 'active') as active_bindings,
+    (select count(*) from agent_board.board_invite_tokens
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and code <> 'k276isolink') as minted_tokens,
+    (select uses_count from agent_board.board_invite_tokens
+      where code = 'k276isolink') as outstanding_link_uses;
+
+grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
+------------+------------+-----------------+---------------+-------------+---------------------
+member      |active      |                1|              0|            0|                    0
+(1 row)
+
+
+starting permutation: revoke_begin revoke_agent redeem_begin redeem_link redeem2_begin redeem2_link revoke_commit redeem_commit redeem2_commit check
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_agent: 
+  select subject_kind
+    from agent_board.revoke_fleet_subject(
+      'agent',
+      '27710000-0000-4000-8000-000000000001',
+      '27710000-0000-4000-8000-000000000003',
+      'k276 iso fleet revocation');
+
+subject_kind
+------------
+agent       
+(1 row)
+
+step redeem_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a2';
+
+step redeem_link: 
+  select r.role as redeemed_role
+    from agent_board.redeem_invite_link('k276isolink') r;
+
+redeemed_role
+-------------
+admin        
+(1 row)
+
+step redeem2_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a3';
+
+step redeem2_link: 
+  select r.role as redeemed_role
+    from agent_board.redeem_invite_link('k276isolink') r;
+ <waiting ...>
+step revoke_commit: COMMIT;
+step redeem_commit: COMMIT;
+step redeem2_link: <... completed>
+ERROR:  invite is not usable
+step redeem2_commit: COMMIT;
+step check: 
+  select
+    (select role from agent_board.board_memberships
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
+    (select status from agent_board.agents
+      where id = '27710000-0000-4000-8000-000000000001') as owner_status,
+    (select count(*) from agent_board.fleet_revocation_events
+      where subject_kind = 'agent'
+        and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
+    (select count(*) from agent_board.fleet_machine_agents
+      where agent_id = '27710000-0000-4000-8000-000000000001'
+        and lifecycle_state = 'active') as active_bindings,
+    (select count(*) from agent_board.board_invite_tokens
+      where board_id = '27720000-0000-4000-8000-000000000001'
+        and code <> 'k276isolink') as minted_tokens,
+    (select uses_count from agent_board.board_invite_tokens
+      where code = 'k276isolink') as outstanding_link_uses;
+
+grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
+------------+------------+-----------------+---------------+-------------+---------------------
+admin       |active      |                1|              0|            0|                    1
+(1 row)
+

package/tests/isolation/expected/signer_lifecycle_revoke.out

@@ -92,7 +92,7 @@ step auth_grant:
  <waiting ...>
 step revoke_commit: COMMIT;
 step auth_grant: <... completed>
-ERROR:  signer_not_active: signed authority write signer is revoked, not active
+ERROR:  fleet_revoked: grant_board_role is not permitted for a fleet-revoked agent
 step auth_commit: COMMIT;
 step check: 
   select