@consiliency/agent-board-schema 1.53.0 → 1.55.0

package/tests/agent_board_atomic_fleet_onboarding_runtime.test.sql

@@ -112,7 +112,7 @@ begin
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
       'raw_ed25519_base64url',
       'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
-      true, null, 'agent', '{board:send}', '{}', v_code, v_board, v_machine,
+      true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', '{board:send}', '{}', v_code, v_board, v_machine,
       'codex', 'phase-loop', 'message-board', 'sha256:atomic-runtime-repo',
       'worker', 'phase_worker', 'atomic-runtime-agent'
     ) r;
@@ -130,7 +130,7 @@ begin
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
       'raw_ed25519_base64url',
       'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
-      true, null, 'agent', '{board:send}', '{}', v_code, v_board, v_machine,
+      true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', '{board:send}', '{}', v_code, v_board, v_machine,
       'codex', 'phase-loop', 'message-board', 'sha256:atomic-runtime-repo',
       'worker', 'phase_worker', 'atomic-runtime-agent'
     ) r;
@@ -194,7 +194,7 @@ begin
     jsonb_build_object('iss','https://atomic-runtime.test','aud','message-board','sub','human-runtime','iat',p_iat),
     'atomic-runtime-agent',
     'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-    'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+    'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
     '{board:send}', '{}', (select invite_code from _atomic_cfg),
     (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
     'codex', 'phase-loop', 'message-board', 'sha256:atomic-runtime-repo',
@@ -290,7 +290,7 @@ select lives_ok(
         '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":250}'::jsonb,
         'atomic-runtime-agent',
         'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-        'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+        'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
         '{board:send}', '{}', (select invite_code from _atomic_cfg),
         (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
         'codex', 'phase-loop', 'message-board', 'sha256:atomic-runtime-repo',
@@ -318,7 +318,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":300}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg))$$,
   '42501', null,
   'legacy enrollment rejects the bounded invite before replay'
@@ -328,7 +328,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":300}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'substituted-label',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -341,7 +341,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":350}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       gen_random_uuid(), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -354,7 +354,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":351}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), gen_random_uuid(), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -366,7 +366,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":352}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'claude', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -378,7 +378,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":353}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'other-repo', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -390,7 +390,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":354}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:substituted-repo', 'worker', 'phase_worker',
@@ -402,7 +402,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":355}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'reviewer', 'reviewer',
@@ -414,7 +414,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":356}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -426,7 +426,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":357}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'reviewer',
@@ -475,7 +475,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":360}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -491,7 +491,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":361}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -511,7 +511,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":362}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -528,7 +528,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":363}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -547,7 +547,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":364}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -570,7 +570,7 @@ select lives_ok(
         '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":365}'::jsonb,
         'atomic-runtime-agent',
         'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-        'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+        'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
         '{board:send}', '{}', (select invite_code from _atomic_cfg),
         (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
         'codex', 'phase-loop', 'message-board', 'sha256:atomic-runtime-repo',
@@ -615,7 +615,7 @@ select throws_ok(
       'https://atomic-runtime.test', 'message-board', 'human-runtime',
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":400}'::jsonb, 'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg), 'codex', 'phase-loop',
       'message-board', 'sha256:atomic-runtime-repo', 'worker', 'phase_worker',
@@ -643,7 +643,7 @@ begin
       'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
       'raw_ed25519_base64url',
       'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-      true, null, 'agent', '{board:send}', '{}', null
+      true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', '{board:send}', '{}', null
     ) e;
 
   select invite_id, code into v_invite, v_code
@@ -667,7 +667,7 @@ select lives_ok(
         '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-recovery","iat":501,"jti":"rotated"}'::jsonb,
         'atomic-recovery-agent',
         'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk', 'raw_ed25519_base64url',
-        'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA', true, null, 'agent',
+        'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
         '{board:send}', '{}', (select invite_code from _recovery_cfg),
         (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
         'codex', 'recovery-harness', 'message-board', 'sha256:recovery-repo',
@@ -718,7 +718,7 @@ select throws_ok(
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-collision","iat":600}'::jsonb,
       'atomic-collision-agent',
       '4KAcBIlVxExOCkFemWSjOREACgi90CE_2-EFbmRYAzM', 'raw_ed25519_base64url',
-      'sha256:M-L7uu74kuf1rPVyZcW9Ar-LD1ZULN3E36HKqy93O3Q', true, null, 'agent',
+      'sha256:M-L7uu74kuf1rPVyZcW9Ar-LD1ZULN3E36HKqy93O3Q', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _collision_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
       'codex', 'collision-harness', 'message-board', 'sha256:collision-repo',
@@ -822,7 +822,7 @@ select throws_ok(
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":700}'::jsonb,
       'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _matrix_invites where case_name='generic'),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
       'codex', 'phase-loop', 'message-board', 'sha256:atomic-runtime-repo',
@@ -848,7 +848,7 @@ select throws_ok(
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":701}'::jsonb,
       'atomic-runtime-agent',
       'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0', 'raw_ed25519_base64url',
-      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, null, 'agent',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _atomic_cfg),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
       'codex', 'phase-loop', 'message-board', 'sha256:atomic-runtime-repo',
@@ -894,7 +894,7 @@ select throws_ok(
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-conflict","iat":702}'::jsonb,
       'atomic-conflict-agent',
       '5TG73fnNhqeYkoSvPf9QwmWkvKWe0yA7B8YinAWQ8m4', 'raw_ed25519_base64url',
-      'sha256:qhjEQe9R_x26TBZyBsd-LrpR1fh7Mvnz86rbsCKtjz8', true, null, 'agent',
+      'sha256:qhjEQe9R_x26TBZyBsd-LrpR1fh7Mvnz86rbsCKtjz8', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _matrix_invites where case_name='conflict'),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
       'codex', 'conflict-harness', 'message-board', 'sha256:conflict-repo',
@@ -920,7 +920,7 @@ begin
     '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-blocked","iat":703}'::jsonb,
     'atomic-blocked-agent',
     'HdUqLbj-jcUwvwE4rf9WXeDQrjrAtYUT6YmnsGMKcNQ', 'raw_ed25519_base64url',
-    'sha256:d115bUBikhOk-QFOCc-lItU2nRZMKf79kAHmvgLsKng', true, null, 'agent',
+    'sha256:d115bUBikhOk-QFOCc-lItU2nRZMKf79kAHmvgLsKng', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
     '{board:send}', '{}', null
   );
   insert into agent_board.board_memberships(
@@ -945,7 +945,7 @@ select throws_ok(
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-blocked","iat":704}'::jsonb,
       'atomic-blocked-agent',
       'HdUqLbj-jcUwvwE4rf9WXeDQrjrAtYUT6YmnsGMKcNQ', 'raw_ed25519_base64url',
-      'sha256:d115bUBikhOk-QFOCc-lItU2nRZMKf79kAHmvgLsKng', true, null, 'agent',
+      'sha256:d115bUBikhOk-QFOCc-lItU2nRZMKf79kAHmvgLsKng', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _matrix_invites where case_name='blocked'),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
       'codex', 'blocked-harness', 'message-board', 'sha256:blocked-repo',
@@ -985,7 +985,7 @@ select throws_ok(
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-late-failure","iat":705}'::jsonb,
       'atomic-late-failure-agent',
       'TDyof3w0SMg4SDYuj-qenolHC_n05cZbrLSckKVGtMo', 'raw_ed25519_base64url',
-      'sha256:lSBZnHvmPvQONy8aoygp-fmTg26iZenrZC-L5LN9m7M', true, null, 'agent',
+      'sha256:lSBZnHvmPvQONy8aoygp-fmTg26iZenrZC-L5LN9m7M', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _matrix_invites where case_name='late-failure'),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
       'codex', 'late-failure-harness', 'message-board', 'sha256:late-failure-repo',
@@ -1089,7 +1089,7 @@ select throws_ok(
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":801}'::jsonb,
       'atomic-revoked-future',
       'TDyof3w0SMg4SDYuj-qenolHC_n05cZbrLSckKVGtMo', 'raw_ed25519_base64url',
-      'sha256:lSBZnHvmPvQONy8aoygp-fmTg26iZenrZC-L5LN9m7M', true, null, 'agent',
+      'sha256:lSBZnHvmPvQONy8aoygp-fmTg26iZenrZC-L5LN9m7M', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _matrix_invites where case_name='human-revoked'),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
       'codex', 'human-revoked', 'message-board', 'sha256:human-revoked',
@@ -1233,7 +1233,7 @@ select throws_ok(
       '{"iss":"https://atomic-runtime.test","aud":"message-board","sub":"human-runtime","iat":802}'::jsonb,
       'atomic-revoked-future',
       '8lbFi0KooZCbgv7LYQzJ455CsFFnoeOK9qkcsEwUBZg', 'raw_ed25519_base64url',
-      'sha256:SiF8ib634OSMsAhUlMQk44VFekSV1EcRHzkdhv-R8vc', true, null, 'agent',
+      'sha256:SiF8ib634OSMsAhUlMQk44VFekSV1EcRHzkdhv-R8vc', true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent',
       '{board:send}', '{}', (select invite_code from _matrix_invites where case_name='human-revoked'),
       (select board_id from _atomic_cfg), (select machine_id from _atomic_cfg),
       'codex', 'human-revoked', 'message-board', 'sha256:human-revoked',

package/tests/agent_board_enroll_federated_identity.test.sql

@@ -15,11 +15,12 @@ begin;
 
 select plan(28);
 
--- New 14-arg signature exists (ROOMLINK 20260724000200 added a trailing invite code). -
+-- 16-arg signature exists (ROOMLINK 20260724000200 added a trailing invite code; #521
+-- added p_token_sha256 + p_token_expires_at after p_pop_verified, with no default). -----
 select has_function(
   'agent_board', 'enroll_federated_identity',
-  array['text','text','text','jsonb','text','text','text','text','boolean','text','text','text[]','text[]','text'],
-  'enroll_federated_identity exists with the ROOMLINK-extended 14-arg PoP signature');
+  array['text','text','text','jsonb','text','text','text','text','boolean','text','timestamp with time zone','text','text','text[]','text[]','text'],
+  'enroll_federated_identity exists with the ROOMLINK-extended, #521 token-bound 16-arg PoP signature');
 select hasnt_function(
   'agent_board', 'enroll_federated_identity',
   array['text','text','text','jsonb','text','text','text[]','text[]'],
@@ -59,7 +60,7 @@ begin
     into v_agent_id, v_auth, v_prov, v_key, v_granted
     from _p p, agent_board.enroll_federated_identity(
       p.iss, p.aud, p.sub, p.claim, p.slug, p.pub1, 'raw_ed25519_base64url', p.fp1,
-      true, 'act|'||s, 'agent', '{board:send}', '{board:x}') e;
+      true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), 'act|'||s, 'agent', '{board:send}', '{board:x}') e;
   insert into _r
     select 'A', v_agent_id, v_auth, v_prov, v_key, v_granted, a.owner_user_id
       from agent_board.agents a where a.id = v_agent_id;
@@ -69,7 +70,7 @@ begin
     into v_agent_id, v_auth, v_prov, v_key, v_granted
     from _p p, agent_board.enroll_federated_identity(
       p.iss, p.aud, p.sub, p.claim, p.slug, p.pub2, 'raw_ed25519_base64url', p.fp2,
-      true, 'act|'||s, 'agent', '{board:send}', '{board:x}') e;
+      true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), 'act|'||s, 'agent', '{board:send}', '{board:x}') e;
   insert into _r
     select 'B', v_agent_id, v_auth, v_prov, v_key, v_granted, a.owner_user_id
       from agent_board.agents a where a.id = v_agent_id;
@@ -161,21 +162,21 @@ select is(
 
 -- Provider / scope / kind rejection matrix still raises ------------------------------
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity('https://nope.test',%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity('https://nope.test',%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      aud, sub, (claim || jsonb_build_object('iss','https://nope.test'))::text, 'x-'||slug, pub1, fp1) from _p),
   '42501', null, 'unknown (issuer,audience) is rejected');
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,NULL,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,NULL,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, claim::text, 'y-'||slug, pub1, fp1) from _p),
   '22023', null, 'a null verified subject is rejected');
 -- requested scope outside the provider allowed_scopes ceiling
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:admin}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:admin}','{}')$q$,
      iss, aud, sub, claim::text, 'z-'||slug, pub1, fp1) from _p),
   '42501', null, 'a requested scope outside allowed_scopes is rejected');
 -- the 'system' kind is never federatable
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'system','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'system','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'w-'||slug, pub1, fp1) from _p),
   '42501', null, 'the system kind cannot be federated');
 
@@ -199,7 +200,7 @@ begin
     from agent_board.enroll_federated_identity(
       'https://fed-b1-'||s||'.test','message-board','portal|'||s,
       jsonb_build_object('iss','https://fed-b1-'||s||'.test','aud','message-board','sub','portal|'||s), 'b1-'||s, v_pub,'raw_ed25519_base64url', v_fp,
-      true, null, 'agent', '{board:send}', '{}') e;
+      true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', '{board:send}', '{}') e;
   insert into _b1 values (v_agent, v_kid, v_kver, v_handle);
 end $$;
 select is(

package/tests/agent_board_enroll_pop_binding.test.sql

@@ -49,7 +49,7 @@ $$;
 
 -- Happy path with a present, non-empty actor_sub -> succeeds and is audited (key 1).
 select lives_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,%L,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),%L,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-ok', pub1, fp1, 'act|present') from _p),
   'enroll with a present non-empty actor_sub and verified PoP succeeds');
 select is(
@@ -60,7 +60,7 @@ select is(
 
 -- Exact replay: rotating presentation claims do not create a second identity.
 select lives_ok(
-  (select format($q$create temp table _exact_replay as select * from agent_board.enroll_federated_identity(%L,%L,%L,(%L::jsonb || '{"iat":200,"exp":9999999999,"jti":"rotated"}'::jsonb),%L,%L,'raw_ed25519_base64url',%L,true,%L,'agent','{board:send}','{}')$q$,
+  (select format($q$create temp table _exact_replay as select * from agent_board.enroll_federated_identity(%L,%L,%L,(%L::jsonb || '{"iat":200,"exp":9999999999,"jti":"rotated"}'::jsonb),%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),%L,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-ok', pub1, fp1, 'act|present') from _p),
   'an exact stable-input replay with rotating JWT presentation claims succeeds');
 select is(
@@ -70,7 +70,7 @@ select is(
 
 -- A replay mutation (slug and independent actor_sub) fails closed with 23505.
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-dup', pub1, fp1) from _p),
   '23505', null, 'a duplicate fingerprint (key already enrolled) is rejected');
 select is(
@@ -82,11 +82,11 @@ select is(
 -- check — so one private key can NEVER back multiple agents (the 4-strings-one-key
 -- aliasing attack that broke revocation isolation).
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-alias1', 'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f1', fp1) from _p),
   '22023', null, 'a non-canonical base64url alias of an enrolled key is rejected (aliasing attack blocked)');
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-alias2', 'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f2', fp1) from _p),
   '22023', null, 'a second non-canonical alias of the same key is also rejected');
 select is(
@@ -95,20 +95,20 @@ select is(
 
 -- PoP gate: p_pop_verified false / null -> raise, and NO agent is written.
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,false,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,false, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-false', pub2, fp2) from _p),
   '42501', null, 'p_pop_verified=false is refused');
 select is(
   (select count(*)::int from agent_board.agents a where a.handle = 'pop-false'),
   0, 'a refused (pop=false) enrollment wrote no agent (no partial write)');
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,NULL,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,NULL, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-null', pub2, fp2) from _p),
   '42501', null, 'p_pop_verified=null is refused');
 
 -- Fingerprint tamper: supplied fingerprint != in-DB recompute -> raise, no write.
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-tamper', pub2, 'sha256:'||repeat('B',43)) from _p),
   '22023', null, 'a tampered fingerprint (!= in-DB derive of the key) is rejected');
 select is(
@@ -117,22 +117,22 @@ select is(
 
 -- Malformed / placeholder / wrong-format keys -> raise.
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,'not-a-valid-43char-key','raw_ed25519_base64url','sha256:'||%L,true,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,'not-a-valid-43char-key','raw_ed25519_base64url','sha256:'||%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-malformed', repeat('C',43)) from _p),
   '22023', null, 'a malformed (non-43-base64url) public key is rejected');
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-zero', repeat('A',43),
      'sha256:'||rtrim(translate(encode(extensions.digest(convert_to(repeat('A',43),'UTF8'),'sha256'),'base64'),'+/','-_'),'=')) from _p),
   '22023', null, 'the all-zero small-order placeholder key is rejected');
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'spki_pem',%L,true,null,'agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'spki_pem',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-fmt', pub2, fp2) from _p),
   '22023', null, 'a non-raw_ed25519_base64url public_key_format is rejected');
 
 -- actor_sub present-but-empty -> raise (present means a real delegated actor).
 select throws_ok(
-  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,'','agent','{board:send}','{}')$q$,
+  (select format($q$select agent_board.enroll_federated_identity(%L,%L,%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),'','agent','{board:send}','{}')$q$,
      iss, aud, sub, claim::text, 'pop-emptyact', pub2, fp2) from _p),
   '22023', null, 'a present-but-empty actor_sub is rejected');
 

package/tests/agent_board_enroll_resumption.test.sql

@@ -65,7 +65,7 @@ create function pg_temp.enroll_sql(
 ) returns text language sql stable as
 $$
   select format(
-    $q$select * from agent_board.enroll_federated_identity(%L,'message-board',%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true,null,'agent',%L,'{}')$q$,
+    $q$select * from agent_board.enroll_federated_identity(%L,'message-board',%L,%L::jsonb,%L,%L,'raw_ed25519_base64url',%L,true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1),null,'agent',%L,'{}')$q$,
     p_iss, p_sub,
     jsonb_build_object('iss', p_iss, 'aud', 'message-board', 'sub', p_sub)::text,
     p_slug, p_pub, p_fp, p_scopes)