@consiliency/agent-board-schema 1.54.0 → 1.55.0

package/tests/isolation/specs/enroll_token_route_race_fleet_first.spec

@@ -0,0 +1,119 @@
+# Consiliency/message-board#521 I-4b -- fleet route first, identity route second, same
+# token, different keys. The identity enrollment blocks at the owner lock the fleet
+# onboarding already holds; when the onboarding commits, the identity bind raises MBT01.
+# One agent (the fleet one), one key, one binding. No deadlock.
+#
+# The step expected to FAIL runs inside a DO block that re-raises with the SQLSTATE in the
+# message, because isolationtester prints only `ERROR:  <message>`: without it a raise with
+# the same text and a different errcode would leave this golden green.
+
+setup
+{
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://tok521-iso.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+
+  -- Materialize the owner auth.users row the enrollment derives, through the SAME helper,
+  -- so a contender blocks on the owner row lock (the serialisation under test) and not on
+  -- a racing INSERT inside _ensure_agent_auth_user.
+  create table tok521_owner as
+  select agent_board._ensure_agent_auth_user(
+    agent_board._federated_identity_slug('https://tok521-iso.test', 'tok521-human')) as uid;
+
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('52100000-0000-0000-0000-000000000001', 'agent', 'agent',
+          'tok521-creator', 'Tok521 Creator', 'active');
+  select count(*) from agent_board.create_board(
+    '52100000-0000-0000-0000-000000000001',
+    'tok521-board', 'Tok521 Board',
+    'Consiliency/message-board#521 token single-use isolation proof',
+    jsonb_build_object(), 'private'
+  );
+  insert into agent_board.fleet_trust_domains(
+    id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at
+  ) values (
+    '52100000-0000-0000-0000-000000000002', 'tok521-domain',
+    'Tok521 Domain', 'tailnet', '52100000-0000-0000-0000-000000000001',
+    'active', now()
+  );
+  insert into agent_board.fleet_machines(
+    id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+    lifecycle_state, enrollment_source, enrolled_at
+  ) values (
+    '52100000-0000-0000-0000-000000000003',
+    '52100000-0000-0000-0000-000000000002',
+    '52100000-0000-0000-0000-000000000001',
+    'claw', 'sha256:tok521-machine', 'active', 'portal', now()
+  );
+  select count(*) from agent_board.create_fleet_onboarding_invite(
+    (select id from agent_board.boards where slug='tok521-board'),
+    '52100000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:tok521-repo', 'worker', 'phase_worker',
+    'tok521-agent', 2, now() + interval '1 hour',
+    '52100000-0000-0000-0000-000000000001', jsonb_build_object()
+  );
+}
+
+session "fleet"
+step "fleet_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "fleet_onboard" {
+  select agent_handle, identity_disposition
+    from agent_board.onboard_federated_fleet_agent(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k1'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[],
+      (select code from agent_board.board_invite_tokens where created_by_agent_id='52100000-0000-0000-0000-000000000001'),
+      (select id from agent_board.boards where slug='tok521-board'),
+      '52100000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+      'message-board', 'sha256:tok521-repo', 'worker', 'phase_worker',
+      'tok521-agent'
+    );
+}
+step "fleet_commit" { COMMIT; }
+
+session "ident"
+step "ident_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "ident_enroll" {
+  do $$ begin
+  perform agent_board.enroll_federated_identity(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k2'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k2'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[], null
+    );
+  exception when others then
+    raise exception 'SQLSTATE %: %', sqlstate, sqlerrm using errcode = sqlstate;
+  end $$;
+}
+step "ident_rollback" { ROLLBACK; }
+
+session "check"
+step "check" {
+  select
+    (select count(*) from agent_board.agents where handle like 'tok521-agent%') as agents,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k1')) as k1_keys,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k2')) as k2_keys,
+    (select count(*) from agent_board.enroll_token_uses) as token_rows,
+    (select case u.agent_public_key_fingerprint
+              when public.test_key_fingerprint('tok521-k1') then 'K1'
+              when public.test_key_fingerprint('tok521-k2') then 'K2'
+              else 'other' end
+       from agent_board.enroll_token_uses u where u.token_sha256 = repeat('a', 64)) as token_bound_to,
+    (select count(*) from agent_board.fleet_harness_registrations where machine_id='52100000-0000-0000-0000-000000000003') as harnesses,
+    (select count(*) from agent_board.fleet_repo_scopes r join agent_board.fleet_harness_registrations h on h.id = r.harness_registration_id
+      where h.machine_id='52100000-0000-0000-0000-000000000003') as repo_scopes,
+    (select count(*) from agent_board.fleet_machine_agents where machine_id='52100000-0000-0000-0000-000000000003') as bindings;
+}
+
+permutation "fleet_begin" "fleet_onboard" "ident_begin" "ident_enroll" "fleet_commit" "ident_rollback" "check"

package/tests/isolation/specs/enroll_token_route_race_identity_first.spec

@@ -0,0 +1,120 @@
+# Consiliency/message-board#521 I-4a -- identity route first, fleet route second, same
+# token, different keys. The fleet onboarding blocks at its own owner lock (taken before
+# its nested enroll_federated_identity call); when the identity enrollment commits, the
+# nested bind raises MBT01 and the WHOLE onboarding rolls back: no K2 key, no harness,
+# repo scope or binding rows. No deadlock, in this order or the other (I-4b).
+#
+# The step expected to FAIL runs inside a DO block that re-raises with the SQLSTATE in the
+# message, because isolationtester prints only `ERROR:  <message>`: without it a raise with
+# the same text and a different errcode would leave this golden green.
+
+setup
+{
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://tok521-iso.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+
+  -- Materialize the owner auth.users row the enrollment derives, through the SAME helper,
+  -- so a contender blocks on the owner row lock (the serialisation under test) and not on
+  -- a racing INSERT inside _ensure_agent_auth_user.
+  create table tok521_owner as
+  select agent_board._ensure_agent_auth_user(
+    agent_board._federated_identity_slug('https://tok521-iso.test', 'tok521-human')) as uid;
+
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('52100000-0000-0000-0000-000000000001', 'agent', 'agent',
+          'tok521-creator', 'Tok521 Creator', 'active');
+  select count(*) from agent_board.create_board(
+    '52100000-0000-0000-0000-000000000001',
+    'tok521-board', 'Tok521 Board',
+    'Consiliency/message-board#521 token single-use isolation proof',
+    jsonb_build_object(), 'private'
+  );
+  insert into agent_board.fleet_trust_domains(
+    id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at
+  ) values (
+    '52100000-0000-0000-0000-000000000002', 'tok521-domain',
+    'Tok521 Domain', 'tailnet', '52100000-0000-0000-0000-000000000001',
+    'active', now()
+  );
+  insert into agent_board.fleet_machines(
+    id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+    lifecycle_state, enrollment_source, enrolled_at
+  ) values (
+    '52100000-0000-0000-0000-000000000003',
+    '52100000-0000-0000-0000-000000000002',
+    '52100000-0000-0000-0000-000000000001',
+    'claw', 'sha256:tok521-machine', 'active', 'portal', now()
+  );
+  select count(*) from agent_board.create_fleet_onboarding_invite(
+    (select id from agent_board.boards where slug='tok521-board'),
+    '52100000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:tok521-repo', 'worker', 'phase_worker',
+    'tok521-agent', 2, now() + interval '1 hour',
+    '52100000-0000-0000-0000-000000000001', jsonb_build_object()
+  );
+}
+
+session "ident"
+step "ident_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "ident_enroll" {
+  select agent_handle
+    from agent_board.enroll_federated_identity(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k1'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[], null
+    );
+}
+step "ident_commit" { COMMIT; }
+
+session "fleet"
+step "fleet_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "fleet_onboard" {
+  do $$ begin
+  perform agent_board.onboard_federated_fleet_agent(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k2'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k2'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[],
+      (select code from agent_board.board_invite_tokens where created_by_agent_id='52100000-0000-0000-0000-000000000001'),
+      (select id from agent_board.boards where slug='tok521-board'),
+      '52100000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+      'message-board', 'sha256:tok521-repo', 'worker', 'phase_worker',
+      'tok521-agent'
+    );
+  exception when others then
+    raise exception 'SQLSTATE %: %', sqlstate, sqlerrm using errcode = sqlstate;
+  end $$;
+}
+step "fleet_rollback" { ROLLBACK; }
+
+session "check"
+step "check" {
+  select
+    (select count(*) from agent_board.agents where handle like 'tok521-agent%') as agents,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k1')) as k1_keys,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k2')) as k2_keys,
+    (select count(*) from agent_board.enroll_token_uses) as token_rows,
+    (select case u.agent_public_key_fingerprint
+              when public.test_key_fingerprint('tok521-k1') then 'K1'
+              when public.test_key_fingerprint('tok521-k2') then 'K2'
+              else 'other' end
+       from agent_board.enroll_token_uses u where u.token_sha256 = repeat('a', 64)) as token_bound_to,
+    (select count(*) from agent_board.fleet_harness_registrations where machine_id='52100000-0000-0000-0000-000000000003') as harnesses,
+    (select count(*) from agent_board.fleet_repo_scopes r join agent_board.fleet_harness_registrations h on h.id = r.harness_registration_id
+      where h.machine_id='52100000-0000-0000-0000-000000000003') as repo_scopes,
+    (select count(*) from agent_board.fleet_machine_agents where machine_id='52100000-0000-0000-0000-000000000003') as bindings;
+}
+
+permutation "ident_begin" "ident_enroll" "fleet_begin" "fleet_onboard" "ident_commit" "fleet_rollback" "check"

package/tests/isolation/specs/enroll_token_same_key_fleet_then_identity.spec

@@ -0,0 +1,112 @@
+# Consiliency/message-board#521 I-8b -- the same token and the SAME key across routes,
+# fleet first. The identity enrollment waits (at the fingerprint advisory lock), then its
+# bind is a no-op and it resumes the fleet-created identity: same handle, no MBT01, no
+# second key, no second agent.
+
+setup
+{
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://tok521-iso.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+
+  -- Materialize the owner auth.users row the enrollment derives, through the SAME helper,
+  -- so a contender blocks on the owner row lock (the serialisation under test) and not on
+  -- a racing INSERT inside _ensure_agent_auth_user.
+  create table tok521_owner as
+  select agent_board._ensure_agent_auth_user(
+    agent_board._federated_identity_slug('https://tok521-iso.test', 'tok521-human')) as uid;
+
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('52100000-0000-0000-0000-000000000001', 'agent', 'agent',
+          'tok521-creator', 'Tok521 Creator', 'active');
+  select count(*) from agent_board.create_board(
+    '52100000-0000-0000-0000-000000000001',
+    'tok521-board', 'Tok521 Board',
+    'Consiliency/message-board#521 token single-use isolation proof',
+    jsonb_build_object(), 'private'
+  );
+  insert into agent_board.fleet_trust_domains(
+    id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at
+  ) values (
+    '52100000-0000-0000-0000-000000000002', 'tok521-domain',
+    'Tok521 Domain', 'tailnet', '52100000-0000-0000-0000-000000000001',
+    'active', now()
+  );
+  insert into agent_board.fleet_machines(
+    id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+    lifecycle_state, enrollment_source, enrolled_at
+  ) values (
+    '52100000-0000-0000-0000-000000000003',
+    '52100000-0000-0000-0000-000000000002',
+    '52100000-0000-0000-0000-000000000001',
+    'claw', 'sha256:tok521-machine', 'active', 'portal', now()
+  );
+  select count(*) from agent_board.create_fleet_onboarding_invite(
+    (select id from agent_board.boards where slug='tok521-board'),
+    '52100000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:tok521-repo', 'worker', 'phase_worker',
+    'tok521-agent', 2, now() + interval '1 hour',
+    '52100000-0000-0000-0000-000000000001', jsonb_build_object()
+  );
+}
+
+session "fleet"
+step "fleet_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "fleet_onboard" {
+  select agent_handle, identity_disposition
+    from agent_board.onboard_federated_fleet_agent(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k1'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[],
+      (select code from agent_board.board_invite_tokens where created_by_agent_id='52100000-0000-0000-0000-000000000001'),
+      (select id from agent_board.boards where slug='tok521-board'),
+      '52100000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+      'message-board', 'sha256:tok521-repo', 'worker', 'phase_worker',
+      'tok521-agent'
+    );
+}
+step "fleet_commit" { COMMIT; }
+
+session "ident"
+step "ident_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "ident_enroll" {
+  select agent_handle
+    from agent_board.enroll_federated_identity(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k1'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[], null
+    );
+}
+step "ident_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select
+    (select count(*) from agent_board.agents where handle like 'tok521-agent%') as agents,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k1')) as k1_keys,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k2')) as k2_keys,
+    (select count(*) from agent_board.enroll_token_uses) as token_rows,
+    (select case u.agent_public_key_fingerprint
+              when public.test_key_fingerprint('tok521-k1') then 'K1'
+              when public.test_key_fingerprint('tok521-k2') then 'K2'
+              else 'other' end
+       from agent_board.enroll_token_uses u where u.token_sha256 = repeat('a', 64)) as token_bound_to,
+    (select count(*) from agent_board.fleet_harness_registrations where machine_id='52100000-0000-0000-0000-000000000003') as harnesses,
+    (select count(*) from agent_board.fleet_repo_scopes r join agent_board.fleet_harness_registrations h on h.id = r.harness_registration_id
+      where h.machine_id='52100000-0000-0000-0000-000000000003') as repo_scopes,
+    (select count(*) from agent_board.fleet_machine_agents where machine_id='52100000-0000-0000-0000-000000000003') as bindings;
+}
+
+permutation "fleet_begin" "fleet_onboard" "ident_begin" "ident_enroll" "fleet_commit" "ident_commit" "check"

package/tests/isolation/specs/enroll_token_same_key_identity_then_fleet.spec

@@ -0,0 +1,113 @@
+# Consiliency/message-board#521 I-8a -- the same token and the SAME key across routes,
+# identity first. The fleet onboarding waits (at the fingerprint advisory lock), then its
+# nested call's bind is a no-op and it falls through into the unchanged resumption:
+# identity_disposition = reused, no MBT01, no second key, no second agent -- exactly what
+# the same-key retry got before #521.
+
+setup
+{
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://tok521-iso.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+
+  -- Materialize the owner auth.users row the enrollment derives, through the SAME helper,
+  -- so a contender blocks on the owner row lock (the serialisation under test) and not on
+  -- a racing INSERT inside _ensure_agent_auth_user.
+  create table tok521_owner as
+  select agent_board._ensure_agent_auth_user(
+    agent_board._federated_identity_slug('https://tok521-iso.test', 'tok521-human')) as uid;
+
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('52100000-0000-0000-0000-000000000001', 'agent', 'agent',
+          'tok521-creator', 'Tok521 Creator', 'active');
+  select count(*) from agent_board.create_board(
+    '52100000-0000-0000-0000-000000000001',
+    'tok521-board', 'Tok521 Board',
+    'Consiliency/message-board#521 token single-use isolation proof',
+    jsonb_build_object(), 'private'
+  );
+  insert into agent_board.fleet_trust_domains(
+    id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at
+  ) values (
+    '52100000-0000-0000-0000-000000000002', 'tok521-domain',
+    'Tok521 Domain', 'tailnet', '52100000-0000-0000-0000-000000000001',
+    'active', now()
+  );
+  insert into agent_board.fleet_machines(
+    id, trust_domain_id, owner_agent_id, machine_label, machine_fingerprint,
+    lifecycle_state, enrollment_source, enrolled_at
+  ) values (
+    '52100000-0000-0000-0000-000000000003',
+    '52100000-0000-0000-0000-000000000002',
+    '52100000-0000-0000-0000-000000000001',
+    'claw', 'sha256:tok521-machine', 'active', 'portal', now()
+  );
+  select count(*) from agent_board.create_fleet_onboarding_invite(
+    (select id from agent_board.boards where slug='tok521-board'),
+    '52100000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+    'message-board', 'sha256:tok521-repo', 'worker', 'phase_worker',
+    'tok521-agent', 2, now() + interval '1 hour',
+    '52100000-0000-0000-0000-000000000001', jsonb_build_object()
+  );
+}
+
+session "ident"
+step "ident_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "ident_enroll" {
+  select agent_handle
+    from agent_board.enroll_federated_identity(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k1'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[], null
+    );
+}
+step "ident_commit" { COMMIT; }
+
+session "fleet"
+step "fleet_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "fleet_onboard" {
+  select agent_handle, identity_disposition
+    from agent_board.onboard_federated_fleet_agent(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k1'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[],
+      (select code from agent_board.board_invite_tokens where created_by_agent_id='52100000-0000-0000-0000-000000000001'),
+      (select id from agent_board.boards where slug='tok521-board'),
+      '52100000-0000-0000-0000-000000000003', 'codex', 'phase-loop',
+      'message-board', 'sha256:tok521-repo', 'worker', 'phase_worker',
+      'tok521-agent'
+    );
+}
+step "fleet_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select
+    (select count(*) from agent_board.agents where handle like 'tok521-agent%') as agents,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k1')) as k1_keys,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k2')) as k2_keys,
+    (select count(*) from agent_board.enroll_token_uses) as token_rows,
+    (select case u.agent_public_key_fingerprint
+              when public.test_key_fingerprint('tok521-k1') then 'K1'
+              when public.test_key_fingerprint('tok521-k2') then 'K2'
+              else 'other' end
+       from agent_board.enroll_token_uses u where u.token_sha256 = repeat('a', 64)) as token_bound_to,
+    (select count(*) from agent_board.fleet_harness_registrations where machine_id='52100000-0000-0000-0000-000000000003') as harnesses,
+    (select count(*) from agent_board.fleet_repo_scopes r join agent_board.fleet_harness_registrations h on h.id = r.harness_registration_id
+      where h.machine_id='52100000-0000-0000-0000-000000000003') as repo_scopes,
+    (select count(*) from agent_board.fleet_machine_agents where machine_id='52100000-0000-0000-0000-000000000003') as bindings;
+}
+
+permutation "ident_begin" "ident_enroll" "fleet_begin" "fleet_onboard" "ident_commit" "fleet_commit" "check"

package/tests/isolation/specs/enroll_token_same_key_resume.spec

@@ -0,0 +1,70 @@
+# Consiliency/message-board#521 I-3 -- the same token with the SAME key, concurrently: a
+# retry. B blocks (at the fingerprint advisory lock, which precedes the owner lock), and
+# when A commits, B's bind is a no-op and B falls through into the unchanged #176
+# resumption, returning the same handle. One agent, one key, one token row.
+
+setup
+{
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://tok521-iso.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+
+  -- Materialize the owner auth.users row the enrollment derives, through the SAME helper,
+  -- so a contender blocks on the owner row lock (the serialisation under test) and not on
+  -- a racing INSERT inside _ensure_agent_auth_user.
+  create table tok521_owner as
+  select agent_board._ensure_agent_auth_user(
+    agent_board._federated_identity_slug('https://tok521-iso.test', 'tok521-human')) as uid;
+}
+
+session "a"
+step "a_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "a_enroll" {
+  select agent_handle
+    from agent_board.enroll_federated_identity(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k1'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[], null
+    );
+}
+step "a_commit" { COMMIT; }
+
+session "b"
+step "b_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "b_enroll" {
+  select agent_handle
+    from agent_board.enroll_federated_identity(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k1'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[], null
+    );
+}
+step "b_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select
+    (select count(*) from agent_board.agents where handle like 'tok521-agent%') as agents,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k1')) as k1_keys,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k2')) as k2_keys,
+    (select count(*) from agent_board.enroll_token_uses) as token_rows,
+    (select case u.agent_public_key_fingerprint
+              when public.test_key_fingerprint('tok521-k1') then 'K1'
+              when public.test_key_fingerprint('tok521-k2') then 'K2'
+              else 'other' end
+       from agent_board.enroll_token_uses u where u.token_sha256 = repeat('a', 64)) as token_bound_to;
+}
+
+permutation "a_begin" "a_enroll" "b_begin" "b_enroll" "a_commit" "b_commit" "check"

package/tests/isolation/specs/enroll_token_same_token_race.spec

@@ -0,0 +1,80 @@
+# Consiliency/message-board#521 I-1 -- one verified token, two keys, concurrently, on the
+# identity route. A holds the token's derived owner row (it has not committed); B presents
+# the SAME token with a DIFFERENT key and blocks at enroll_federated_identity's owner lock,
+# which is the serialisation the bind relies on (no lock of its own). When A commits, B's
+# bind reads A's committed row and raises MBT01. Exactly one agent, one key, one token row.
+#
+# The token is fixed (repeat('a',64)) so both sessions present the same token_sha256.
+#
+# The step expected to FAIL runs inside a DO block that re-raises with the SQLSTATE in the
+# message, because isolationtester prints only `ERROR:  <message>`: without it a raise with
+# the same text and a different errcode would leave this golden green.
+
+setup
+{
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved,
+    allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://tok521-iso.test', 'message-board', true, true,
+    ARRAY['board:send'], ARRAY[]::text[], ARRAY['agent']
+  );
+
+  -- Materialize the owner auth.users row the enrollment derives, through the SAME helper,
+  -- so a contender blocks on the owner row lock (the serialisation under test) and not on
+  -- a racing INSERT inside _ensure_agent_auth_user.
+  create table tok521_owner as
+  select agent_board._ensure_agent_auth_user(
+    agent_board._federated_identity_slug('https://tok521-iso.test', 'tok521-human')) as uid;
+}
+
+session "a"
+step "a_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "a_enroll" {
+  select agent_handle
+    from agent_board.enroll_federated_identity(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k1'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k1'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[], null
+    );
+}
+step "a_commit" { COMMIT; }
+
+session "b"
+step "b_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "b_enroll" {
+  do $$ begin
+  perform agent_board.enroll_federated_identity(
+      'https://tok521-iso.test', 'message-board', 'tok521-human',
+      jsonb_build_object('iss','https://tok521-iso.test','aud','message-board','sub','tok521-human'),
+      'tok521-agent',
+      public.test_pubkey('tok521-k2'), 'raw_ed25519_base64url',
+      public.test_key_fingerprint('tok521-k2'),
+      true, repeat('a', 64), now() + interval '1 hour', null, 'agent',
+      ARRAY['board:send'], ARRAY[]::text[], null
+    );
+  exception when others then
+    raise exception 'SQLSTATE %: %', sqlstate, sqlerrm using errcode = sqlstate;
+  end $$;
+}
+step "b_rollback" { ROLLBACK; }
+
+session "check"
+step "check" {
+  select
+    (select count(*) from agent_board.agents where handle like 'tok521-agent%') as agents,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k1')) as k1_keys,
+    (select count(*) from agent_board.agent_signing_keys where fingerprint = public.test_key_fingerprint('tok521-k2')) as k2_keys,
+    (select count(*) from agent_board.enroll_token_uses) as token_rows,
+    (select case u.agent_public_key_fingerprint
+              when public.test_key_fingerprint('tok521-k1') then 'K1'
+              when public.test_key_fingerprint('tok521-k2') then 'K2'
+              else 'other' end
+       from agent_board.enroll_token_uses u where u.token_sha256 = repeat('a', 64)) as token_bound_to;
+}
+
+permutation "a_begin" "a_enroll" "b_begin" "b_enroll" "a_commit" "b_rollback" "check"

package/tests/isolation/specs/onboarding_ceiling_lock_order.spec

@@ -143,7 +143,7 @@ step "onboard_call" {
     'yd_DIFGWGusVg3SbktDJQ1bE5UWvtR33xln4b05JIhk',
     'raw_ed25519_base64url',
     'sha256:NeVC2vx1MbTY56jUwJcLLr6YwB4IKCERsXWbUwhf5pA',
-    true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+    true, md5(random()::text) || md5(random()::text), now() + make_interval(hours => 1), null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
     (select code from agent_board.board_invite_tokens where created_by_agent_id='19610000-0000-0000-0000-000000000001'),
     (select id from agent_board.boards where slug='onboard-ceiling-board'),
     '19610000-0000-0000-0000-000000000003', 'codex', 'phase-loop',