@consiliency/agent-board-schema 1.27.0 → 1.35.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/fixtures/already-applied.json +32 -0
- package/migrations/20260909000100_agent_board_ledger_revoked_authority.sql +1036 -0
- package/migrations/20260910000100_agent_board_ceiling_lock_comment_truth.sql +89 -0
- package/migrations/20260911000100_agent_board_ledger_revoked_board_creation.sql +330 -0
- package/migrations/20260912000100_agent_board_receipt_subject_gate.sql +348 -0
- package/migrations/20260913000100_agent_board_task_thread_lock_order.sql +292 -0
- package/migrations/20260914000100_agent_board_claim_subject_gate.sql +500 -0
- package/migrations/20260915000100_agent_board_fedsession_stored_identity_gate.sql +353 -0
- package/migrations/20260916000100_agent_board_federated_identity_injective_slug.sql +1646 -0
- package/package.json +1 -1
- package/schema-manifest.json +75 -3
- package/src/tooling.test.mjs +47 -2
- package/tests/agent_board_atomic_fleet_onboarding.test.sql +161 -30
- package/tests/agent_board_claim_subject_gate.test.sql +1025 -0
- package/tests/agent_board_enroll_resumption.test.sql +7 -1
- package/tests/agent_board_federated_identity_injective_slug.test.sql +388 -0
- package/tests/agent_board_fedsession.test.sql +17 -2
- package/tests/agent_board_fedsession_stored_identity_gate.test.sql +606 -0
- package/tests/agent_board_fk_lock_edges.test.sql +422 -0
- package/tests/agent_board_ledger_authority.test.sql +1081 -0
- package/tests/agent_board_receipt_subject_gate.test.sql +624 -0
- package/tests/agent_board_signer_lifecycle.test.sql +29 -6
- package/tests/agent_board_source_strip_helper.test.sql +157 -1
- package/tests/agent_board_task_thread_lock_order.test.sql +337 -0
- package/tests/catalog/p_metadata_parameters.json +20 -0
- package/tests/fixtures/test-prereqs.sql +420 -11
- package/tests/isolation/expected/ledger_authority_revoke.out +701 -0
- package/tests/isolation/expected/signer_lifecycle_revoke.out +1 -1
- package/tests/isolation/expected/task_thread_lock_order.out +203 -0
- package/tests/isolation/specs/enroll_identity_board_owner_lock_order.spec +5 -4
- package/tests/isolation/specs/fedsession_provider_absent_owner_lock.spec +4 -4
- package/tests/isolation/specs/ledger_authority_revoke.spec +405 -0
- package/tests/isolation/specs/signer_lifecycle_revoke.spec +10 -0
- package/tests/isolation/specs/task_thread_lock_order.spec +197 -0
- package/tests/seeds/20260916000100_agent_board_federated_identity_injective_slug.sql.pre.sql +196 -0
|
@@ -0,0 +1,701 @@
|
|
|
1
|
+
Parsed test spec with 10 sessions
|
|
2
|
+
|
|
3
|
+
starting permutation: ugrant_begin ugrant_grant revoke_begin revoke_agent ugrant_commit revoke_commit check
|
|
4
|
+
step ugrant_begin:
|
|
5
|
+
BEGIN;
|
|
6
|
+
SET LOCAL ROLE authenticated;
|
|
7
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
8
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
|
|
9
|
+
|
|
10
|
+
step ugrant_grant:
|
|
11
|
+
select g.role as granted_role
|
|
12
|
+
from agent_board.grant_board_role(
|
|
13
|
+
'27720000-0000-4000-8000-000000000001',
|
|
14
|
+
'27710000-0000-4000-8000-000000000002',
|
|
15
|
+
'admin') g;
|
|
16
|
+
|
|
17
|
+
granted_role
|
|
18
|
+
------------
|
|
19
|
+
admin
|
|
20
|
+
(1 row)
|
|
21
|
+
|
|
22
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
23
|
+
step revoke_agent:
|
|
24
|
+
select subject_kind
|
|
25
|
+
from agent_board.revoke_fleet_subject(
|
|
26
|
+
'agent',
|
|
27
|
+
'27710000-0000-4000-8000-000000000001',
|
|
28
|
+
'27710000-0000-4000-8000-000000000003',
|
|
29
|
+
'k276 iso fleet revocation');
|
|
30
|
+
<waiting ...>
|
|
31
|
+
step ugrant_commit: COMMIT;
|
|
32
|
+
step revoke_agent: <... completed>
|
|
33
|
+
subject_kind
|
|
34
|
+
------------
|
|
35
|
+
agent
|
|
36
|
+
(1 row)
|
|
37
|
+
|
|
38
|
+
step revoke_commit: COMMIT;
|
|
39
|
+
step check:
|
|
40
|
+
select
|
|
41
|
+
(select role from agent_board.board_memberships
|
|
42
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
43
|
+
and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
|
|
44
|
+
(select status from agent_board.agents
|
|
45
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
46
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
47
|
+
where subject_kind = 'agent'
|
|
48
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
|
|
49
|
+
(select count(*) from agent_board.fleet_machine_agents
|
|
50
|
+
where agent_id = '27710000-0000-4000-8000-000000000001'
|
|
51
|
+
and lifecycle_state = 'active') as active_bindings,
|
|
52
|
+
(select count(*) from agent_board.board_invite_tokens
|
|
53
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
54
|
+
and code <> 'k276isolink') as minted_tokens,
|
|
55
|
+
(select uses_count from agent_board.board_invite_tokens
|
|
56
|
+
where code = 'k276isolink') as outstanding_link_uses;
|
|
57
|
+
|
|
58
|
+
grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
|
|
59
|
+
------------+------------+-----------------+---------------+-------------+---------------------
|
|
60
|
+
admin |active | 1| 0| 0| 0
|
|
61
|
+
(1 row)
|
|
62
|
+
|
|
63
|
+
|
|
64
|
+
starting permutation: revoke_begin revoke_agent ugrant_begin ugrant_grant revoke_commit ugrant_commit check
|
|
65
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
66
|
+
step revoke_agent:
|
|
67
|
+
select subject_kind
|
|
68
|
+
from agent_board.revoke_fleet_subject(
|
|
69
|
+
'agent',
|
|
70
|
+
'27710000-0000-4000-8000-000000000001',
|
|
71
|
+
'27710000-0000-4000-8000-000000000003',
|
|
72
|
+
'k276 iso fleet revocation');
|
|
73
|
+
|
|
74
|
+
subject_kind
|
|
75
|
+
------------
|
|
76
|
+
agent
|
|
77
|
+
(1 row)
|
|
78
|
+
|
|
79
|
+
step ugrant_begin:
|
|
80
|
+
BEGIN;
|
|
81
|
+
SET LOCAL ROLE authenticated;
|
|
82
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
83
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
|
|
84
|
+
|
|
85
|
+
step ugrant_grant:
|
|
86
|
+
select g.role as granted_role
|
|
87
|
+
from agent_board.grant_board_role(
|
|
88
|
+
'27720000-0000-4000-8000-000000000001',
|
|
89
|
+
'27710000-0000-4000-8000-000000000002',
|
|
90
|
+
'admin') g;
|
|
91
|
+
<waiting ...>
|
|
92
|
+
step revoke_commit: COMMIT;
|
|
93
|
+
step ugrant_grant: <... completed>
|
|
94
|
+
ERROR: fleet_revoked: grant_board_role is not permitted for a fleet-revoked agent
|
|
95
|
+
step ugrant_commit: COMMIT;
|
|
96
|
+
step check:
|
|
97
|
+
select
|
|
98
|
+
(select role from agent_board.board_memberships
|
|
99
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
100
|
+
and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
|
|
101
|
+
(select status from agent_board.agents
|
|
102
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
103
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
104
|
+
where subject_kind = 'agent'
|
|
105
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
|
|
106
|
+
(select count(*) from agent_board.fleet_machine_agents
|
|
107
|
+
where agent_id = '27710000-0000-4000-8000-000000000001'
|
|
108
|
+
and lifecycle_state = 'active') as active_bindings,
|
|
109
|
+
(select count(*) from agent_board.board_invite_tokens
|
|
110
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
111
|
+
and code <> 'k276isolink') as minted_tokens,
|
|
112
|
+
(select uses_count from agent_board.board_invite_tokens
|
|
113
|
+
where code = 'k276isolink') as outstanding_link_uses;
|
|
114
|
+
|
|
115
|
+
grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
|
|
116
|
+
------------+------------+-----------------+---------------+-------------+---------------------
|
|
117
|
+
member |active | 1| 0| 0| 0
|
|
118
|
+
(1 row)
|
|
119
|
+
|
|
120
|
+
|
|
121
|
+
starting permutation: sgrant_begin sgrant_grant revoke_begin revoke_agent sgrant_commit revoke_commit check
|
|
122
|
+
step sgrant_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
123
|
+
step sgrant_grant:
|
|
124
|
+
select w.role as granted_role
|
|
125
|
+
from agent_board.signed_grant_board_role(
|
|
126
|
+
jsonb_build_object(
|
|
127
|
+
'p_board_id', '27720000-0000-4000-8000-000000000001',
|
|
128
|
+
'p_agent_id', '27710000-0000-4000-8000-000000000002',
|
|
129
|
+
'p_grantee_role', 'admin'),
|
|
130
|
+
jsonb_build_object(
|
|
131
|
+
'agent_id', '27710000-0000-4000-8000-000000000001',
|
|
132
|
+
'signing_key_id', '27730000-0000-4000-8000-000000000001',
|
|
133
|
+
'key_id', 'primary',
|
|
134
|
+
'key_version', 1,
|
|
135
|
+
'algorithm', 'Ed25519',
|
|
136
|
+
'verification_status', 'verified',
|
|
137
|
+
'payload_digest', 'sha256:k276',
|
|
138
|
+
'enforcement_mode', 'require_for_agent_writes')) w;
|
|
139
|
+
|
|
140
|
+
granted_role
|
|
141
|
+
------------
|
|
142
|
+
admin
|
|
143
|
+
(1 row)
|
|
144
|
+
|
|
145
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
146
|
+
step revoke_agent:
|
|
147
|
+
select subject_kind
|
|
148
|
+
from agent_board.revoke_fleet_subject(
|
|
149
|
+
'agent',
|
|
150
|
+
'27710000-0000-4000-8000-000000000001',
|
|
151
|
+
'27710000-0000-4000-8000-000000000003',
|
|
152
|
+
'k276 iso fleet revocation');
|
|
153
|
+
<waiting ...>
|
|
154
|
+
step sgrant_commit: COMMIT;
|
|
155
|
+
step revoke_agent: <... completed>
|
|
156
|
+
subject_kind
|
|
157
|
+
------------
|
|
158
|
+
agent
|
|
159
|
+
(1 row)
|
|
160
|
+
|
|
161
|
+
step revoke_commit: COMMIT;
|
|
162
|
+
step check:
|
|
163
|
+
select
|
|
164
|
+
(select role from agent_board.board_memberships
|
|
165
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
166
|
+
and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
|
|
167
|
+
(select status from agent_board.agents
|
|
168
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
169
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
170
|
+
where subject_kind = 'agent'
|
|
171
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
|
|
172
|
+
(select count(*) from agent_board.fleet_machine_agents
|
|
173
|
+
where agent_id = '27710000-0000-4000-8000-000000000001'
|
|
174
|
+
and lifecycle_state = 'active') as active_bindings,
|
|
175
|
+
(select count(*) from agent_board.board_invite_tokens
|
|
176
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
177
|
+
and code <> 'k276isolink') as minted_tokens,
|
|
178
|
+
(select uses_count from agent_board.board_invite_tokens
|
|
179
|
+
where code = 'k276isolink') as outstanding_link_uses;
|
|
180
|
+
|
|
181
|
+
grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
|
|
182
|
+
------------+------------+-----------------+---------------+-------------+---------------------
|
|
183
|
+
admin |active | 1| 0| 0| 0
|
|
184
|
+
(1 row)
|
|
185
|
+
|
|
186
|
+
|
|
187
|
+
starting permutation: revoke_begin revoke_agent sgrant_begin sgrant_grant revoke_commit sgrant_commit check
|
|
188
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
189
|
+
step revoke_agent:
|
|
190
|
+
select subject_kind
|
|
191
|
+
from agent_board.revoke_fleet_subject(
|
|
192
|
+
'agent',
|
|
193
|
+
'27710000-0000-4000-8000-000000000001',
|
|
194
|
+
'27710000-0000-4000-8000-000000000003',
|
|
195
|
+
'k276 iso fleet revocation');
|
|
196
|
+
|
|
197
|
+
subject_kind
|
|
198
|
+
------------
|
|
199
|
+
agent
|
|
200
|
+
(1 row)
|
|
201
|
+
|
|
202
|
+
step sgrant_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
203
|
+
step sgrant_grant:
|
|
204
|
+
select w.role as granted_role
|
|
205
|
+
from agent_board.signed_grant_board_role(
|
|
206
|
+
jsonb_build_object(
|
|
207
|
+
'p_board_id', '27720000-0000-4000-8000-000000000001',
|
|
208
|
+
'p_agent_id', '27710000-0000-4000-8000-000000000002',
|
|
209
|
+
'p_grantee_role', 'admin'),
|
|
210
|
+
jsonb_build_object(
|
|
211
|
+
'agent_id', '27710000-0000-4000-8000-000000000001',
|
|
212
|
+
'signing_key_id', '27730000-0000-4000-8000-000000000001',
|
|
213
|
+
'key_id', 'primary',
|
|
214
|
+
'key_version', 1,
|
|
215
|
+
'algorithm', 'Ed25519',
|
|
216
|
+
'verification_status', 'verified',
|
|
217
|
+
'payload_digest', 'sha256:k276',
|
|
218
|
+
'enforcement_mode', 'require_for_agent_writes')) w;
|
|
219
|
+
<waiting ...>
|
|
220
|
+
step revoke_commit: COMMIT;
|
|
221
|
+
step sgrant_grant: <... completed>
|
|
222
|
+
ERROR: fleet_revoked: grant_board_role is not permitted for a fleet-revoked agent
|
|
223
|
+
step sgrant_commit: COMMIT;
|
|
224
|
+
step check:
|
|
225
|
+
select
|
|
226
|
+
(select role from agent_board.board_memberships
|
|
227
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
228
|
+
and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
|
|
229
|
+
(select status from agent_board.agents
|
|
230
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
231
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
232
|
+
where subject_kind = 'agent'
|
|
233
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
|
|
234
|
+
(select count(*) from agent_board.fleet_machine_agents
|
|
235
|
+
where agent_id = '27710000-0000-4000-8000-000000000001'
|
|
236
|
+
and lifecycle_state = 'active') as active_bindings,
|
|
237
|
+
(select count(*) from agent_board.board_invite_tokens
|
|
238
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
239
|
+
and code <> 'k276isolink') as minted_tokens,
|
|
240
|
+
(select uses_count from agent_board.board_invite_tokens
|
|
241
|
+
where code = 'k276isolink') as outstanding_link_uses;
|
|
242
|
+
|
|
243
|
+
grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
|
|
244
|
+
------------+------------+-----------------+---------------+-------------+---------------------
|
|
245
|
+
member |active | 1| 0| 0| 0
|
|
246
|
+
(1 row)
|
|
247
|
+
|
|
248
|
+
|
|
249
|
+
starting permutation: revoke_begin revoke_agent mint_begin mint_link revoke_commit mint_commit check
|
|
250
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
251
|
+
step revoke_agent:
|
|
252
|
+
select subject_kind
|
|
253
|
+
from agent_board.revoke_fleet_subject(
|
|
254
|
+
'agent',
|
|
255
|
+
'27710000-0000-4000-8000-000000000001',
|
|
256
|
+
'27710000-0000-4000-8000-000000000003',
|
|
257
|
+
'k276 iso fleet revocation');
|
|
258
|
+
|
|
259
|
+
subject_kind
|
|
260
|
+
------------
|
|
261
|
+
agent
|
|
262
|
+
(1 row)
|
|
263
|
+
|
|
264
|
+
step mint_begin:
|
|
265
|
+
BEGIN;
|
|
266
|
+
SET LOCAL ROLE authenticated;
|
|
267
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
268
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
|
|
269
|
+
|
|
270
|
+
step mint_link:
|
|
271
|
+
select m.preset_role
|
|
272
|
+
from agent_board.create_invite_link(
|
|
273
|
+
'27720000-0000-4000-8000-000000000001', 'admin', 'joined', 5,
|
|
274
|
+
now() + interval '2 days') m;
|
|
275
|
+
<waiting ...>
|
|
276
|
+
step revoke_commit: COMMIT;
|
|
277
|
+
step mint_link: <... completed>
|
|
278
|
+
ERROR: fleet_revoked: create_invite_link is not permitted for a fleet-revoked agent
|
|
279
|
+
step mint_commit: COMMIT;
|
|
280
|
+
step check:
|
|
281
|
+
select
|
|
282
|
+
(select role from agent_board.board_memberships
|
|
283
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
284
|
+
and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
|
|
285
|
+
(select status from agent_board.agents
|
|
286
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
287
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
288
|
+
where subject_kind = 'agent'
|
|
289
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
|
|
290
|
+
(select count(*) from agent_board.fleet_machine_agents
|
|
291
|
+
where agent_id = '27710000-0000-4000-8000-000000000001'
|
|
292
|
+
and lifecycle_state = 'active') as active_bindings,
|
|
293
|
+
(select count(*) from agent_board.board_invite_tokens
|
|
294
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
295
|
+
and code <> 'k276isolink') as minted_tokens,
|
|
296
|
+
(select uses_count from agent_board.board_invite_tokens
|
|
297
|
+
where code = 'k276isolink') as outstanding_link_uses;
|
|
298
|
+
|
|
299
|
+
grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
|
|
300
|
+
------------+------------+-----------------+---------------+-------------+---------------------
|
|
301
|
+
member |active | 1| 0| 0| 0
|
|
302
|
+
(1 row)
|
|
303
|
+
|
|
304
|
+
|
|
305
|
+
starting permutation: revoke_begin revoke_agent redeem_begin redeem_link redeem_commit revoke_commit check
|
|
306
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
307
|
+
step revoke_agent:
|
|
308
|
+
select subject_kind
|
|
309
|
+
from agent_board.revoke_fleet_subject(
|
|
310
|
+
'agent',
|
|
311
|
+
'27710000-0000-4000-8000-000000000001',
|
|
312
|
+
'27710000-0000-4000-8000-000000000003',
|
|
313
|
+
'k276 iso fleet revocation');
|
|
314
|
+
|
|
315
|
+
subject_kind
|
|
316
|
+
------------
|
|
317
|
+
agent
|
|
318
|
+
(1 row)
|
|
319
|
+
|
|
320
|
+
step redeem_begin:
|
|
321
|
+
BEGIN;
|
|
322
|
+
SET LOCAL ROLE authenticated;
|
|
323
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
324
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a2';
|
|
325
|
+
|
|
326
|
+
step redeem_link:
|
|
327
|
+
select r.role as redeemed_role
|
|
328
|
+
from agent_board.redeem_invite_link('k276isolink') r;
|
|
329
|
+
|
|
330
|
+
redeemed_role
|
|
331
|
+
-------------
|
|
332
|
+
admin
|
|
333
|
+
(1 row)
|
|
334
|
+
|
|
335
|
+
step redeem_commit: COMMIT;
|
|
336
|
+
step revoke_commit: COMMIT;
|
|
337
|
+
step check:
|
|
338
|
+
select
|
|
339
|
+
(select role from agent_board.board_memberships
|
|
340
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
341
|
+
and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
|
|
342
|
+
(select status from agent_board.agents
|
|
343
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
344
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
345
|
+
where subject_kind = 'agent'
|
|
346
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
|
|
347
|
+
(select count(*) from agent_board.fleet_machine_agents
|
|
348
|
+
where agent_id = '27710000-0000-4000-8000-000000000001'
|
|
349
|
+
and lifecycle_state = 'active') as active_bindings,
|
|
350
|
+
(select count(*) from agent_board.board_invite_tokens
|
|
351
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
352
|
+
and code <> 'k276isolink') as minted_tokens,
|
|
353
|
+
(select uses_count from agent_board.board_invite_tokens
|
|
354
|
+
where code = 'k276isolink') as outstanding_link_uses;
|
|
355
|
+
|
|
356
|
+
grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
|
|
357
|
+
------------+------------+-----------------+---------------+-------------+---------------------
|
|
358
|
+
admin |active | 1| 0| 0| 1
|
|
359
|
+
(1 row)
|
|
360
|
+
|
|
361
|
+
|
|
362
|
+
starting permutation: revoke_begin revoke_agent revoke_commit redeem_begin redeem_link redeem_commit check
|
|
363
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
364
|
+
step revoke_agent:
|
|
365
|
+
select subject_kind
|
|
366
|
+
from agent_board.revoke_fleet_subject(
|
|
367
|
+
'agent',
|
|
368
|
+
'27710000-0000-4000-8000-000000000001',
|
|
369
|
+
'27710000-0000-4000-8000-000000000003',
|
|
370
|
+
'k276 iso fleet revocation');
|
|
371
|
+
|
|
372
|
+
subject_kind
|
|
373
|
+
------------
|
|
374
|
+
agent
|
|
375
|
+
(1 row)
|
|
376
|
+
|
|
377
|
+
step revoke_commit: COMMIT;
|
|
378
|
+
step redeem_begin:
|
|
379
|
+
BEGIN;
|
|
380
|
+
SET LOCAL ROLE authenticated;
|
|
381
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
382
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a2';
|
|
383
|
+
|
|
384
|
+
step redeem_link:
|
|
385
|
+
select r.role as redeemed_role
|
|
386
|
+
from agent_board.redeem_invite_link('k276isolink') r;
|
|
387
|
+
|
|
388
|
+
ERROR: invite is not usable
|
|
389
|
+
step redeem_commit: COMMIT;
|
|
390
|
+
step check:
|
|
391
|
+
select
|
|
392
|
+
(select role from agent_board.board_memberships
|
|
393
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
394
|
+
and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
|
|
395
|
+
(select status from agent_board.agents
|
|
396
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
397
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
398
|
+
where subject_kind = 'agent'
|
|
399
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
|
|
400
|
+
(select count(*) from agent_board.fleet_machine_agents
|
|
401
|
+
where agent_id = '27710000-0000-4000-8000-000000000001'
|
|
402
|
+
and lifecycle_state = 'active') as active_bindings,
|
|
403
|
+
(select count(*) from agent_board.board_invite_tokens
|
|
404
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
405
|
+
and code <> 'k276isolink') as minted_tokens,
|
|
406
|
+
(select uses_count from agent_board.board_invite_tokens
|
|
407
|
+
where code = 'k276isolink') as outstanding_link_uses;
|
|
408
|
+
|
|
409
|
+
grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
|
|
410
|
+
------------+------------+-----------------+---------------+-------------+---------------------
|
|
411
|
+
member |active | 1| 0| 0| 0
|
|
412
|
+
(1 row)
|
|
413
|
+
|
|
414
|
+
|
|
415
|
+
starting permutation: revoke_begin revoke_agent redeem_begin redeem_link redeem2_begin redeem2_link revoke_commit redeem_commit redeem2_commit check
|
|
416
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
417
|
+
step revoke_agent:
|
|
418
|
+
select subject_kind
|
|
419
|
+
from agent_board.revoke_fleet_subject(
|
|
420
|
+
'agent',
|
|
421
|
+
'27710000-0000-4000-8000-000000000001',
|
|
422
|
+
'27710000-0000-4000-8000-000000000003',
|
|
423
|
+
'k276 iso fleet revocation');
|
|
424
|
+
|
|
425
|
+
subject_kind
|
|
426
|
+
------------
|
|
427
|
+
agent
|
|
428
|
+
(1 row)
|
|
429
|
+
|
|
430
|
+
step redeem_begin:
|
|
431
|
+
BEGIN;
|
|
432
|
+
SET LOCAL ROLE authenticated;
|
|
433
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
434
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a2';
|
|
435
|
+
|
|
436
|
+
step redeem_link:
|
|
437
|
+
select r.role as redeemed_role
|
|
438
|
+
from agent_board.redeem_invite_link('k276isolink') r;
|
|
439
|
+
|
|
440
|
+
redeemed_role
|
|
441
|
+
-------------
|
|
442
|
+
admin
|
|
443
|
+
(1 row)
|
|
444
|
+
|
|
445
|
+
step redeem2_begin:
|
|
446
|
+
BEGIN;
|
|
447
|
+
SET LOCAL ROLE authenticated;
|
|
448
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
449
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a3';
|
|
450
|
+
|
|
451
|
+
step redeem2_link:
|
|
452
|
+
select r.role as redeemed_role
|
|
453
|
+
from agent_board.redeem_invite_link('k276isolink') r;
|
|
454
|
+
<waiting ...>
|
|
455
|
+
step revoke_commit: COMMIT;
|
|
456
|
+
step redeem_commit: COMMIT;
|
|
457
|
+
step redeem2_link: <... completed>
|
|
458
|
+
ERROR: invite is not usable
|
|
459
|
+
step redeem2_commit: COMMIT;
|
|
460
|
+
step check:
|
|
461
|
+
select
|
|
462
|
+
(select role from agent_board.board_memberships
|
|
463
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
464
|
+
and agent_id = '27710000-0000-4000-8000-000000000002') as grantee_role,
|
|
465
|
+
(select status from agent_board.agents
|
|
466
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
467
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
468
|
+
where subject_kind = 'agent'
|
|
469
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows,
|
|
470
|
+
(select count(*) from agent_board.fleet_machine_agents
|
|
471
|
+
where agent_id = '27710000-0000-4000-8000-000000000001'
|
|
472
|
+
and lifecycle_state = 'active') as active_bindings,
|
|
473
|
+
(select count(*) from agent_board.board_invite_tokens
|
|
474
|
+
where board_id = '27720000-0000-4000-8000-000000000001'
|
|
475
|
+
and code <> 'k276isolink') as minted_tokens,
|
|
476
|
+
(select uses_count from agent_board.board_invite_tokens
|
|
477
|
+
where code = 'k276isolink') as outstanding_link_uses;
|
|
478
|
+
|
|
479
|
+
grantee_role|owner_status|agent_ledger_rows|active_bindings|minted_tokens|outstanding_link_uses
|
|
480
|
+
------------+------------+-----------------+---------------+-------------+---------------------
|
|
481
|
+
admin |active | 1| 0| 0| 1
|
|
482
|
+
(1 row)
|
|
483
|
+
|
|
484
|
+
|
|
485
|
+
starting permutation: cboard_begin cboard_create revoke_begin revoke_agent cboard_commit revoke_commit cbcheck
|
|
486
|
+
step cboard_begin:
|
|
487
|
+
BEGIN;
|
|
488
|
+
SET LOCAL ROLE authenticated;
|
|
489
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
490
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
|
|
491
|
+
|
|
492
|
+
step cboard_create:
|
|
493
|
+
select c.slug
|
|
494
|
+
from agent_board.create_board(
|
|
495
|
+
'27710000-0000-4000-8000-000000000001', 'k280-iso-fresh', 'K280 ISO Fresh') c;
|
|
496
|
+
|
|
497
|
+
slug
|
|
498
|
+
--------------
|
|
499
|
+
k280-iso-fresh
|
|
500
|
+
(1 row)
|
|
501
|
+
|
|
502
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
503
|
+
step revoke_agent:
|
|
504
|
+
select subject_kind
|
|
505
|
+
from agent_board.revoke_fleet_subject(
|
|
506
|
+
'agent',
|
|
507
|
+
'27710000-0000-4000-8000-000000000001',
|
|
508
|
+
'27710000-0000-4000-8000-000000000003',
|
|
509
|
+
'k276 iso fleet revocation');
|
|
510
|
+
<waiting ...>
|
|
511
|
+
step cboard_commit: COMMIT;
|
|
512
|
+
step revoke_agent: <... completed>
|
|
513
|
+
subject_kind
|
|
514
|
+
------------
|
|
515
|
+
agent
|
|
516
|
+
(1 row)
|
|
517
|
+
|
|
518
|
+
step revoke_commit: COMMIT;
|
|
519
|
+
step cbcheck:
|
|
520
|
+
select
|
|
521
|
+
(select count(*) from agent_board.boards where slug = 'k280-iso-fresh') as fresh_boards,
|
|
522
|
+
(select count(*) from agent_board.board_memberships bm
|
|
523
|
+
join agent_board.boards b on b.id = bm.board_id
|
|
524
|
+
where b.slug = 'k280-iso-fresh') as fresh_seats,
|
|
525
|
+
(select name from agent_board.boards
|
|
526
|
+
where id = '27720000-0000-4000-8000-000000000001') as existing_board_name,
|
|
527
|
+
(select visibility from agent_board.boards
|
|
528
|
+
where id = '27720000-0000-4000-8000-000000000001') as existing_board_visibility,
|
|
529
|
+
(select status from agent_board.agents
|
|
530
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
531
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
532
|
+
where subject_kind = 'agent'
|
|
533
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows;
|
|
534
|
+
|
|
535
|
+
fresh_boards|fresh_seats|existing_board_name|existing_board_visibility|owner_status|agent_ledger_rows
|
|
536
|
+
------------+-----------+-------------------+-------------------------+------------+-----------------
|
|
537
|
+
1| 1|K276 ISO Board |private |active | 1
|
|
538
|
+
(1 row)
|
|
539
|
+
|
|
540
|
+
|
|
541
|
+
starting permutation: revoke_begin revoke_agent cboard_begin cboard_create revoke_commit cboard_commit cbcheck
|
|
542
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
543
|
+
step revoke_agent:
|
|
544
|
+
select subject_kind
|
|
545
|
+
from agent_board.revoke_fleet_subject(
|
|
546
|
+
'agent',
|
|
547
|
+
'27710000-0000-4000-8000-000000000001',
|
|
548
|
+
'27710000-0000-4000-8000-000000000003',
|
|
549
|
+
'k276 iso fleet revocation');
|
|
550
|
+
|
|
551
|
+
subject_kind
|
|
552
|
+
------------
|
|
553
|
+
agent
|
|
554
|
+
(1 row)
|
|
555
|
+
|
|
556
|
+
step cboard_begin:
|
|
557
|
+
BEGIN;
|
|
558
|
+
SET LOCAL ROLE authenticated;
|
|
559
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
560
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
|
|
561
|
+
|
|
562
|
+
step cboard_create:
|
|
563
|
+
select c.slug
|
|
564
|
+
from agent_board.create_board(
|
|
565
|
+
'27710000-0000-4000-8000-000000000001', 'k280-iso-fresh', 'K280 ISO Fresh') c;
|
|
566
|
+
<waiting ...>
|
|
567
|
+
step revoke_commit: COMMIT;
|
|
568
|
+
step cboard_create: <... completed>
|
|
569
|
+
ERROR: fleet_revoked: create_board is not permitted for a fleet-revoked agent
|
|
570
|
+
step cboard_commit: COMMIT;
|
|
571
|
+
step cbcheck:
|
|
572
|
+
select
|
|
573
|
+
(select count(*) from agent_board.boards where slug = 'k280-iso-fresh') as fresh_boards,
|
|
574
|
+
(select count(*) from agent_board.board_memberships bm
|
|
575
|
+
join agent_board.boards b on b.id = bm.board_id
|
|
576
|
+
where b.slug = 'k280-iso-fresh') as fresh_seats,
|
|
577
|
+
(select name from agent_board.boards
|
|
578
|
+
where id = '27720000-0000-4000-8000-000000000001') as existing_board_name,
|
|
579
|
+
(select visibility from agent_board.boards
|
|
580
|
+
where id = '27720000-0000-4000-8000-000000000001') as existing_board_visibility,
|
|
581
|
+
(select status from agent_board.agents
|
|
582
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
583
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
584
|
+
where subject_kind = 'agent'
|
|
585
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows;
|
|
586
|
+
|
|
587
|
+
fresh_boards|fresh_seats|existing_board_name|existing_board_visibility|owner_status|agent_ledger_rows
|
|
588
|
+
------------+-----------+-------------------+-------------------------+------------+-----------------
|
|
589
|
+
0| 0|K276 ISO Board |private |active | 1
|
|
590
|
+
(1 row)
|
|
591
|
+
|
|
592
|
+
|
|
593
|
+
starting permutation: revoke_begin revoke_agent creopen_begin creopen_call revoke_commit creopen_commit cbcheck
|
|
594
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
595
|
+
step revoke_agent:
|
|
596
|
+
select subject_kind
|
|
597
|
+
from agent_board.revoke_fleet_subject(
|
|
598
|
+
'agent',
|
|
599
|
+
'27710000-0000-4000-8000-000000000001',
|
|
600
|
+
'27710000-0000-4000-8000-000000000003',
|
|
601
|
+
'k276 iso fleet revocation');
|
|
602
|
+
|
|
603
|
+
subject_kind
|
|
604
|
+
------------
|
|
605
|
+
agent
|
|
606
|
+
(1 row)
|
|
607
|
+
|
|
608
|
+
step creopen_begin:
|
|
609
|
+
BEGIN;
|
|
610
|
+
SET LOCAL ROLE authenticated;
|
|
611
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
612
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
|
|
613
|
+
|
|
614
|
+
step creopen_call:
|
|
615
|
+
select c.name, c.visibility
|
|
616
|
+
from agent_board.create_board(
|
|
617
|
+
'27710000-0000-4000-8000-000000000001', 'k276-iso-board', 'K280 ISO REOPENED',
|
|
618
|
+
null, null, 'open') c;
|
|
619
|
+
<waiting ...>
|
|
620
|
+
step revoke_commit: COMMIT;
|
|
621
|
+
step creopen_call: <... completed>
|
|
622
|
+
ERROR: fleet_revoked: create_board is not permitted for a fleet-revoked agent
|
|
623
|
+
step creopen_commit: COMMIT;
|
|
624
|
+
step cbcheck:
|
|
625
|
+
select
|
|
626
|
+
(select count(*) from agent_board.boards where slug = 'k280-iso-fresh') as fresh_boards,
|
|
627
|
+
(select count(*) from agent_board.board_memberships bm
|
|
628
|
+
join agent_board.boards b on b.id = bm.board_id
|
|
629
|
+
where b.slug = 'k280-iso-fresh') as fresh_seats,
|
|
630
|
+
(select name from agent_board.boards
|
|
631
|
+
where id = '27720000-0000-4000-8000-000000000001') as existing_board_name,
|
|
632
|
+
(select visibility from agent_board.boards
|
|
633
|
+
where id = '27720000-0000-4000-8000-000000000001') as existing_board_visibility,
|
|
634
|
+
(select status from agent_board.agents
|
|
635
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
636
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
637
|
+
where subject_kind = 'agent'
|
|
638
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows;
|
|
639
|
+
|
|
640
|
+
fresh_boards|fresh_seats|existing_board_name|existing_board_visibility|owner_status|agent_ledger_rows
|
|
641
|
+
------------+-----------+-------------------+-------------------------+------------+-----------------
|
|
642
|
+
0| 0|K276 ISO Board |private |active | 1
|
|
643
|
+
(1 row)
|
|
644
|
+
|
|
645
|
+
|
|
646
|
+
starting permutation: creopen_begin creopen_call revoke_begin revoke_agent creopen_commit revoke_commit cbcheck
|
|
647
|
+
step creopen_begin:
|
|
648
|
+
BEGIN;
|
|
649
|
+
SET LOCAL ROLE authenticated;
|
|
650
|
+
SET LOCAL "request.jwt.claim.role" = 'authenticated';
|
|
651
|
+
SET LOCAL "request.jwt.claim.sub" = '27700000-0000-0000-0000-0000000000a1';
|
|
652
|
+
|
|
653
|
+
step creopen_call:
|
|
654
|
+
select c.name, c.visibility
|
|
655
|
+
from agent_board.create_board(
|
|
656
|
+
'27710000-0000-4000-8000-000000000001', 'k276-iso-board', 'K280 ISO REOPENED',
|
|
657
|
+
null, null, 'open') c;
|
|
658
|
+
|
|
659
|
+
name |visibility
|
|
660
|
+
-----------------+----------
|
|
661
|
+
K280 ISO REOPENED|open
|
|
662
|
+
(1 row)
|
|
663
|
+
|
|
664
|
+
step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
|
|
665
|
+
step revoke_agent:
|
|
666
|
+
select subject_kind
|
|
667
|
+
from agent_board.revoke_fleet_subject(
|
|
668
|
+
'agent',
|
|
669
|
+
'27710000-0000-4000-8000-000000000001',
|
|
670
|
+
'27710000-0000-4000-8000-000000000003',
|
|
671
|
+
'k276 iso fleet revocation');
|
|
672
|
+
<waiting ...>
|
|
673
|
+
step creopen_commit: COMMIT;
|
|
674
|
+
step revoke_agent: <... completed>
|
|
675
|
+
subject_kind
|
|
676
|
+
------------
|
|
677
|
+
agent
|
|
678
|
+
(1 row)
|
|
679
|
+
|
|
680
|
+
step revoke_commit: COMMIT;
|
|
681
|
+
step cbcheck:
|
|
682
|
+
select
|
|
683
|
+
(select count(*) from agent_board.boards where slug = 'k280-iso-fresh') as fresh_boards,
|
|
684
|
+
(select count(*) from agent_board.board_memberships bm
|
|
685
|
+
join agent_board.boards b on b.id = bm.board_id
|
|
686
|
+
where b.slug = 'k280-iso-fresh') as fresh_seats,
|
|
687
|
+
(select name from agent_board.boards
|
|
688
|
+
where id = '27720000-0000-4000-8000-000000000001') as existing_board_name,
|
|
689
|
+
(select visibility from agent_board.boards
|
|
690
|
+
where id = '27720000-0000-4000-8000-000000000001') as existing_board_visibility,
|
|
691
|
+
(select status from agent_board.agents
|
|
692
|
+
where id = '27710000-0000-4000-8000-000000000001') as owner_status,
|
|
693
|
+
(select count(*) from agent_board.fleet_revocation_events
|
|
694
|
+
where subject_kind = 'agent'
|
|
695
|
+
and subject_id = '27710000-0000-4000-8000-000000000001') as agent_ledger_rows;
|
|
696
|
+
|
|
697
|
+
fresh_boards|fresh_seats|existing_board_name|existing_board_visibility|owner_status|agent_ledger_rows
|
|
698
|
+
------------+-----------+-------------------+-------------------------+------------+-----------------
|
|
699
|
+
0| 0|K280 ISO REOPENED |open |active | 1
|
|
700
|
+
(1 row)
|
|
701
|
+
|