@consiliency/agent-board-schema 1.56.0 → 1.58.0

package/tests/catalog/function_execute_privileges.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "GENERATED by scripts/build-function-privileges-snapshot.mjs from pg_catalog — do not hand-edit. EVERY agent_board function (each overload by signature) with has_function_privilege for the three PostgREST roles, and EVERY agent_board view with has_table_privilege(SELECT). Derived with NO name filter. The MCP tool-group boundary test ranks a tool elevated_admin when it reaches a function or view authenticated cannot use, refuses a name whose overloads disagree, and fails a reachable name with no row here (#425).",
+  "$comment": "GENERATED by scripts/build-function-privileges-snapshot.mjs from pg_catalog — do not hand-edit. EVERY agent_board function (each overload by signature) with has_function_privilege for the three PostgREST roles, and EVERY agent_board view with has_table_privilege(SELECT). Derived with NO name filter. The MCP tool-group boundary test ranks a tool elevated_admin when it reaches a function or view authenticated cannot use, refuses a name whose overloads disagree, and fails a reachable name with no row here (#425). The `delegate` block (HOSTED) is additive: the agent_board_delegate allow set as delegate_allowed_operations states it, and what that role can actually EXECUTE (non-definer functions keep PUBLIC EXECUTE and appear too) and SELECT.",
   "functions": [
     {
       "name": "_active_board_membership_id",
@@ -64,6 +64,15 @@
         "authenticated": false
       }
     },
+    {
+      "name": "_agents_is_delegate_immutable",
+      "signature": "_agents_is_delegate_immutable()",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
     {
       "name": "_append_task_event",
       "signature": "_append_task_event(p_origin_posture text, p_task_id uuid, p_actor_agent_id uuid, p_event_type text, p_payload jsonb, p_status text, p_assigned_agent_id uuid, p_completed_at timestamp with time zone)",
@@ -325,6 +334,42 @@
         "authenticated": false
       }
     },
+    {
+      "name": "_delegate_instance_slug",
+      "signature": "_delegate_instance_slug(p_issuer text, p_instance_id text)",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
+    {
+      "name": "_delegate_principal_agent_id",
+      "signature": "_delegate_principal_agent_id(p_agent_id uuid)",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
+    {
+      "name": "_delegate_visible_agent",
+      "signature": "_delegate_visible_agent(p_agent_id uuid)",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
+    {
+      "name": "_delegate_visible_board_ids",
+      "signature": "_delegate_visible_board_ids()",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
     {
       "name": "_emit_membership_event",
       "signature": "_emit_membership_event(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_event_kind text)",
@@ -658,6 +703,24 @@
         "authenticated": false
       }
     },
+    {
+      "name": "_refuse_delegate_addressee",
+      "signature": "_refuse_delegate_addressee(p_agent_id uuid, p_board_id uuid, p_what text)",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
+    {
+      "name": "_refuse_delegate_membership_target",
+      "signature": "_refuse_delegate_membership_target(p_agent_id uuid, p_operation text)",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
     {
       "name": "_require_platform_admin_user_id",
       "signature": "_require_platform_admin_user_id()",
@@ -784,6 +847,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "add_delegate_to_board",
+      "signature": "add_delegate_to_board(p_agent_id uuid, p_board_id uuid)",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": true
+      }
+    },
     {
       "name": "agent_liveness_summary",
       "signature": "agent_liveness_summary()",
@@ -991,6 +1063,15 @@
         "authenticated": false
       }
     },
+    {
+      "name": "exchange_delegate_credential",
+      "signature": "exchange_delegate_credential(p_claims jsonb)",
+      "executable_by": {
+        "anon": false,
+        "service_role": true,
+        "authenticated": false
+      }
+    },
     {
       "name": "expand_recipients_dry_run",
       "signature": "expand_recipients_dry_run(p_actor_agent_id uuid, p_recipient_descriptors jsonb, p_thread_idempotency_key text)",
@@ -1036,6 +1117,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "invite_board_for_display",
+      "signature": "invite_board_for_display(p_code_sha256 text)",
+      "executable_by": {
+        "anon": false,
+        "service_role": true,
+        "authenticated": false
+      }
+    },
     {
       "name": "invite_board_member",
       "signature": "invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)",
@@ -1090,6 +1180,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "list_my_board_requests",
+      "signature": "list_my_board_requests()",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": true
+      }
+    },
     {
       "name": "mark_read",
       "signature": "mark_read(p_thread_id uuid, p_agent_id uuid, p_last_read_message_sequence bigint)",
@@ -1657,6 +1756,15 @@
         "authenticated": true
       }
     },
+    {
+      "name": "tombstone_delegate_instance",
+      "signature": "tombstone_delegate_instance(p_instance_id text, p_issuer text, p_owner_sub text, p_reason text)",
+      "executable_by": {
+        "anon": false,
+        "service_role": true,
+        "authenticated": false
+      }
+    },
     {
       "name": "unblock_board_inviter",
       "signature": "unblock_board_inviter(p_board_id uuid, p_inviter_agent_id uuid, p_target_agent_id uuid)",
@@ -1937,5 +2045,173 @@
         "authenticated": true
       }
     }
-  ]
+  ],
+  "delegate": {
+    "role": "agent_board_delegate",
+    "allowed_operations": [
+      {
+        "kind": "ambient_rpc",
+        "name": "get_schema_version",
+        "signature": "get_schema_version()"
+      },
+      {
+        "kind": "predicate",
+        "name": "_delegate_visible_agent",
+        "signature": "_delegate_visible_agent(uuid)"
+      },
+      {
+        "kind": "predicate",
+        "name": "_delegate_visible_board_ids",
+        "signature": "_delegate_visible_board_ids()"
+      },
+      {
+        "kind": "predicate",
+        "name": "current_agent_id",
+        "signature": "current_agent_id()"
+      },
+      {
+        "kind": "read_table",
+        "name": "agent_signing_keys",
+        "signature": "agent_signing_keys"
+      },
+      {
+        "kind": "read_table",
+        "name": "agents",
+        "signature": "agents"
+      },
+      {
+        "kind": "read_table",
+        "name": "board_memberships",
+        "signature": "board_memberships"
+      },
+      {
+        "kind": "read_table",
+        "name": "boards",
+        "signature": "boards"
+      },
+      {
+        "kind": "read_table",
+        "name": "claims",
+        "signature": "claims"
+      },
+      {
+        "kind": "read_table",
+        "name": "delivery_recipients",
+        "signature": "delivery_recipients"
+      },
+      {
+        "kind": "read_table",
+        "name": "escalations",
+        "signature": "escalations"
+      },
+      {
+        "kind": "read_table",
+        "name": "inbox_items",
+        "signature": "inbox_items"
+      },
+      {
+        "kind": "read_table",
+        "name": "messages",
+        "signature": "messages"
+      },
+      {
+        "kind": "read_table",
+        "name": "presence",
+        "signature": "presence"
+      },
+      {
+        "kind": "read_table",
+        "name": "signature_evidence",
+        "signature": "signature_evidence"
+      },
+      {
+        "kind": "read_table",
+        "name": "task_events",
+        "signature": "task_events"
+      },
+      {
+        "kind": "read_table",
+        "name": "tasks",
+        "signature": "tasks"
+      },
+      {
+        "kind": "read_view",
+        "name": "v_agent_dashboard",
+        "signature": "v_agent_dashboard"
+      },
+      {
+        "kind": "read_view",
+        "name": "v_agent_inbox",
+        "signature": "v_agent_inbox"
+      },
+      {
+        "kind": "read_view",
+        "name": "v_board_feed",
+        "signature": "v_board_feed"
+      },
+      {
+        "kind": "read_view",
+        "name": "v_board_memberships",
+        "signature": "v_board_memberships"
+      },
+      {
+        "kind": "read_view",
+        "name": "v_thread_feed",
+        "signature": "v_thread_feed"
+      },
+      {
+        "kind": "rpc",
+        "name": "create_or_find_thread",
+        "signature": "create_or_find_thread(uuid, text, text, text, jsonb)"
+      },
+      {
+        "kind": "rpc",
+        "name": "post_board_message",
+        "signature": "post_board_message(uuid, uuid, text, text, text, text, text, text, text, jsonb)"
+      },
+      {
+        "kind": "rpc",
+        "name": "post_board_message",
+        "signature": "post_board_message(uuid, uuid, uuid, text, text, text, text, text, jsonb)"
+      },
+      {
+        "kind": "rpc",
+        "name": "post_message",
+        "signature": "post_message(uuid, uuid, text, text, uuid, jsonb)"
+      }
+    ],
+    "executable_functions": [
+      "_addressing_descriptors_array(p_descriptors jsonb)",
+      "_board_membership_events_provenance_guard()",
+      "_delegate_visible_agent(p_agent_id uuid)",
+      "_delegate_visible_board_ids()",
+      "create_or_find_thread(p_created_by_agent_id uuid, p_subject text, p_idempotency_key text, p_thread_type text, p_metadata jsonb)",
+      "current_agent_id()",
+      "get_schema_version()",
+      "post_board_message(p_thread_id uuid, p_author_agent_id uuid, p_board_id uuid, p_subject text, p_body text, p_message_type text, p_priority text, p_idempotency_key text, p_metadata jsonb)",
+      "post_board_message(p_thread_id uuid, p_author_agent_id uuid, p_board_slug text, p_addressing_mode text, p_subject text, p_body text, p_message_type text, p_priority text, p_idempotency_key text, p_metadata jsonb)",
+      "post_message(p_thread_id uuid, p_author_agent_id uuid, p_body text, p_message_type text, p_task_id uuid, p_metadata jsonb)",
+      "sync_agent_principal_columns()"
+    ],
+    "selectable_relations": [
+      "agent_signing_keys",
+      "agents",
+      "board_memberships",
+      "boards",
+      "claims",
+      "delivery_recipients",
+      "escalations",
+      "inbox_items",
+      "messages",
+      "presence",
+      "signature_evidence",
+      "task_events",
+      "tasks",
+      "v_agent_dashboard",
+      "v_agent_inbox",
+      "v_board_feed",
+      "v_board_memberships",
+      "v_thread_feed"
+    ]
+  }
 }

package/tests/catalog/p_metadata_parameters.json

@@ -29,6 +29,10 @@
       "signature": "_agent_principal_active(p_agent_id uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_agents_is_delegate_immutable()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_append_task_event(p_origin_posture text, p_task_id uuid, p_actor_agent_id uuid, p_event_type text, p_payload jsonb, p_status text, p_assigned_agent_id uuid, p_completed_at timestamp with time zone)",
       "declares_p_metadata": false
@@ -145,6 +149,22 @@
       "signature": "_default_provision_display_name(p_slug text)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_delegate_instance_slug(p_issuer text, p_instance_id text)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_delegate_principal_agent_id(p_agent_id uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_delegate_visible_agent(p_agent_id uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_delegate_visible_board_ids()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_emit_membership_event(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_event_kind text)",
       "declares_p_metadata": false
@@ -293,6 +313,14 @@
       "signature": "_redeem_unbounded_invite_for_agent(p_code text, p_agent_id uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_refuse_delegate_addressee(p_agent_id uuid, p_board_id uuid, p_what text)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_refuse_delegate_membership_target(p_agent_id uuid, p_operation text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_require_platform_admin_user_id()",
       "declares_p_metadata": false
@@ -349,6 +377,10 @@
       "signature": "add_artifact(p_created_by_agent_id uuid, p_uri text, p_artifact_type text, p_storage_kind text, p_thread_id uuid, p_task_id uuid, p_message_id uuid, p_task_event_id uuid, p_metadata jsonb)",
       "declares_p_metadata": true
     },
+    {
+      "signature": "add_delegate_to_board(p_agent_id uuid, p_board_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "agent_liveness_summary()",
       "declares_p_metadata": false
@@ -441,6 +473,10 @@
       "signature": "evaluate_signed_write_fleet_policy(p_operation text, p_payload jsonb, p_gateway_decision jsonb)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "exchange_delegate_credential(p_claims jsonb)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "expand_recipients_dry_run(p_actor_agent_id uuid, p_recipient_descriptors jsonb, p_thread_idempotency_key text)",
       "declares_p_metadata": false
@@ -461,6 +497,10 @@
       "signature": "heartbeat(p_agent_id uuid, p_thread_id uuid, p_availability text, p_activity_summary text, p_expires_in interval, p_metadata jsonb)",
       "declares_p_metadata": true
     },
+    {
+      "signature": "invite_board_for_display(p_code_sha256 text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "invite_board_member(p_board_id uuid, p_agent_id uuid, p_created_by_agent_id uuid, p_metadata jsonb)",
       "declares_p_metadata": true
@@ -485,6 +525,10 @@
       "signature": "list_board_pending_memberships(p_board_id uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "list_my_board_requests()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "mark_read(p_thread_id uuid, p_agent_id uuid, p_last_read_message_sequence bigint)",
       "declares_p_metadata": false
@@ -737,6 +781,10 @@
       "signature": "sync_agent_principal_columns()",
       "declares_p_metadata": false
     },
+    {
+      "signature": "tombstone_delegate_instance(p_instance_id text, p_issuer text, p_owner_sub text, p_reason text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "unblock_board_inviter(p_board_id uuid, p_inviter_agent_id uuid, p_target_agent_id uuid)",
       "declares_p_metadata": false

package/tests/isolation/expected/hosted_delegate_exchange_race.out

@@ -0,0 +1,93 @@
+Parsed test spec with 3 sessions
+
+starting permutation: new_begin new_exchange old_begin old_exchange new_commit old_commit check
+count
+-----
+    1
+(1 row)
+
+step new_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step new_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000003', 'generation', 3,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step old_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step old_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step new_commit: COMMIT;
+step old_exchange: <... completed>
+ERROR:  generation_superseded
+step old_commit: COMMIT;
+step check: 
+  select di.generation as recorded_generation, di.grant_id as recorded_grant,
+         (select string_agg(ac.generation::text, ',' order by ac.generation)
+            from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_generations,
+         (select count(*) from agent_board.agents a where a.handle like 'delegate-%') as delegate_agents
+    from agent_board.delegate_instances di where di.instance_id = 'iso_exchange_race_0001';
+
+recorded_generation|recorded_grant      |live_generations|delegate_agents
+-------------------+--------------------+----------------+---------------
+                  3|iso_grant_0000000003|               3|              1
+(1 row)
+
+
+starting permutation: old_begin old_exchange new_begin new_exchange old_commit new_commit check
+count
+-----
+    1
+(1 row)
+
+step old_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step old_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step new_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step new_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000003', 'generation', 3,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step old_commit: COMMIT;
+step new_exchange: <... completed>
+issued
+------
+     1
+(1 row)
+
+step new_commit: COMMIT;
+step check: 
+  select di.generation as recorded_generation, di.grant_id as recorded_grant,
+         (select string_agg(ac.generation::text, ',' order by ac.generation)
+            from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_generations,
+         (select count(*) from agent_board.agents a where a.handle like 'delegate-%') as delegate_agents
+    from agent_board.delegate_instances di where di.instance_id = 'iso_exchange_race_0001';
+
+recorded_generation|recorded_grant      |live_generations|delegate_agents
+-------------------+--------------------+----------------+---------------
+                  3|iso_grant_0000000003|               3|              1
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_first_exchange_race.out

@@ -0,0 +1,129 @@
+Parsed test spec with 4 sessions
+
+starting permutation: a_begin a_exchange b_begin b_exchange a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step a_commit: COMMIT;
+step b_exchange: <... completed>
+issued
+------
+     1
+(1 row)
+
+step b_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_first_exchange_01') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%') as delegate_agents,
+         (select count(*) from auth.users where email like 'agent+delegate-%') as delegate_auth_users,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_first_exchange_01' and ac.revoked_at is null) as live_credentials;
+
+instances|delegate_agents|delegate_auth_users|live_credentials
+---------+---------------+-------------------+----------------
+        1|              1|                  1|               2
+(1 row)
+
+
+starting permutation: b_begin b_exchange a_begin a_exchange b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step b_commit: COMMIT;
+step a_exchange: <... completed>
+issued
+------
+     1
+(1 row)
+
+step a_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_first_exchange_01') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%') as delegate_agents,
+         (select count(*) from auth.users where email like 'agent+delegate-%') as delegate_auth_users,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_first_exchange_01' and ac.revoked_at is null) as live_credentials;
+
+instances|delegate_agents|delegate_auth_users|live_credentials
+---------+---------------+-------------------+----------------
+        1|              1|                  1|               2
+(1 row)
+
+
+starting permutation: a_begin a_exchange i_begin i_exchange a_commit i_commit check
+step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step i_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step i_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-other-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000009', 'generation', 1,
+      'owner_sub', 'iso-other-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step a_commit: COMMIT;
+step i_exchange: <... completed>
+ERROR:  owner_mismatch
+step i_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_first_exchange_01') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%') as delegate_agents,
+         (select count(*) from auth.users where email like 'agent+delegate-%') as delegate_auth_users,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_first_exchange_01' and ac.revoked_at is null) as live_credentials;
+
+instances|delegate_agents|delegate_auth_users|live_credentials
+---------+---------------+-------------------+----------------
+        1|              1|                  1|               1
+(1 row)
+