@consiliency/agent-board-schema 1.56.0 → 1.58.0

package/tests/isolation/expected/hosted_delegate_owner_provisioning_race.out

@@ -0,0 +1,91 @@
+Parsed test spec with 3 sessions
+
+starting permutation: h_begin h_enroll x_begin x_exchange h_commit x_commit check
+step h_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step h_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://iso-prov.test', 'message-board', 'iso-prov-owner',
+    jsonb_build_object('sub', 'iso-prov-owner'), 'Iso Prov Owner');
+
+status
+------
+active
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-prov.test', 'sub', 'iso-prov-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_prov_instance_0001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-prov-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step h_commit: COMMIT;
+step x_exchange: <... completed>
+issued
+------
+     1
+(1 row)
+
+step x_commit: COMMIT;
+step check: 
+  select (select count(*) from auth.users
+           where email = 'agent+' || agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+                         || '@agent-board.local') as owner_auth_users,
+         (select count(*) from agent_board.agents
+           where handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')) as human_rows,
+         (select h.auth_user_id = di.owner_user_id
+            from agent_board.agents h, agent_board.delegate_instances di
+           where h.handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+             and di.instance_id = 'iso_prov_instance_0001') as delegate_owned_by_human;
+
+owner_auth_users|human_rows|delegate_owned_by_human
+----------------+----------+-----------------------
+               1|         1|t                      
+(1 row)
+
+
+starting permutation: x_begin x_exchange h_begin h_enroll x_commit h_commit check
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-prov.test', 'sub', 'iso-prov-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_prov_instance_0001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-prov-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step h_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step h_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://iso-prov.test', 'message-board', 'iso-prov-owner',
+    jsonb_build_object('sub', 'iso-prov-owner'), 'Iso Prov Owner');
+ <waiting ...>
+step x_commit: COMMIT;
+step h_enroll: <... completed>
+status
+------
+active
+(1 row)
+
+step h_commit: COMMIT;
+step check: 
+  select (select count(*) from auth.users
+           where email = 'agent+' || agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+                         || '@agent-board.local') as owner_auth_users,
+         (select count(*) from agent_board.agents
+           where handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')) as human_rows,
+         (select h.auth_user_id = di.owner_user_id
+            from agent_board.agents h, agent_board.delegate_instances di
+           where h.handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+             and di.instance_id = 'iso_prov_instance_0001') as delegate_owned_by_human;
+
+owner_auth_users|human_rows|delegate_owned_by_human
+----------------+----------+-----------------------
+               1|         1|t                      
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_owner_revoke_race.out

@@ -0,0 +1,137 @@
+Parsed test spec with 3 sessions
+
+starting permutation: x_begin x_new r_begin r_revoke x_commit r_commit check
+count
+-----
+    1
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_new: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-rev.test', 'sub', 'iso-rev-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_rev_new_000000001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-rev-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_revoke: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-rev.test', 'iso-rev-owner')),
+    '16310000-0000-0000-0000-000000000001', 'iso owner revoke race');
+ <waiting ...>
+step x_commit: COMMIT;
+step r_revoke: <... completed>
+revoked_agent_count
+-------------------
+                  3
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.fleet_human_revocations where issuer = 'https://iso-rev.test') as markers,
+         (select count(*) from agent_board.delegate_instances where instance_id like 'iso\_rev\_%') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%' and status = 'active') as active_delegates,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id like 'iso\_rev\_%' and ac.revoked_at is null) as live_delegate_credentials;
+
+markers|instances|active_delegates|live_delegate_credentials
+-------+---------+----------------+-------------------------
+      1|        2|               0|                        0
+(1 row)
+
+
+starting permutation: r_begin r_revoke x_begin x_new r_commit x_commit check
+count
+-----
+    1
+(1 row)
+
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_revoke: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-rev.test', 'iso-rev-owner')),
+    '16310000-0000-0000-0000-000000000001', 'iso owner revoke race');
+
+revoked_agent_count
+-------------------
+                  2
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_new: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-rev.test', 'sub', 'iso-rev-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_rev_new_000000001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-rev-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step r_commit: COMMIT;
+step x_new: <... completed>
+ERROR:  owner_inactive
+step x_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.fleet_human_revocations where issuer = 'https://iso-rev.test') as markers,
+         (select count(*) from agent_board.delegate_instances where instance_id like 'iso\_rev\_%') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%' and status = 'active') as active_delegates,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id like 'iso\_rev\_%' and ac.revoked_at is null) as live_delegate_credentials;
+
+markers|instances|active_delegates|live_delegate_credentials
+-------+---------+----------------+-------------------------
+      1|        1|               0|                        0
+(1 row)
+
+
+starting permutation: r_begin r_revoke x_begin x_existing r_commit x_commit check
+count
+-----
+    1
+(1 row)
+
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_revoke: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-rev.test', 'iso-rev-owner')),
+    '16310000-0000-0000-0000-000000000001', 'iso owner revoke race');
+
+revoked_agent_count
+-------------------
+                  2
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_existing: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-rev.test', 'sub', 'iso-rev-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_rev_existing_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-rev-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step r_commit: COMMIT;
+step x_existing: <... completed>
+ERROR:  owner_inactive
+step x_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.fleet_human_revocations where issuer = 'https://iso-rev.test') as markers,
+         (select count(*) from agent_board.delegate_instances where instance_id like 'iso\_rev\_%') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%' and status = 'active') as active_delegates,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id like 'iso\_rev\_%' and ac.revoked_at is null) as live_delegate_credentials;
+
+markers|instances|active_delegates|live_delegate_credentials
+-------+---------+----------------+-------------------------
+      1|        1|               0|                        0
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_revoke_race.out

@@ -0,0 +1,87 @@
+Parsed test spec with 3 sessions
+
+starting permutation: ex_begin ex_exchange rv_begin rv_tombstone ex_commit rv_commit check
+count
+-----
+    1
+(1 row)
+
+step ex_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ex_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_revoke_race_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step rv_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rv_tombstone: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_revoke_race_00001', 'https://iso-portal.test', 'iso-owner', 'owner_revoked');
+ <waiting ...>
+step ex_commit: COMMIT;
+step rv_tombstone: <... completed>
+first
+-----
+t    
+(1 row)
+
+step rv_commit: COMMIT;
+step check: 
+  select (di.tombstoned_at is not null) as tombstoned,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id) as all_credentials,
+         (select a.status from agent_board.agents a where a.id = di.agent_id) as agent_status
+    from agent_board.delegate_instances di where di.instance_id = 'iso_revoke_race_00001';
+
+tombstoned|live_credentials|all_credentials|agent_status
+----------+----------------+---------------+------------
+t         |               0|              2|revoked     
+(1 row)
+
+
+starting permutation: rv_begin rv_tombstone ex_begin ex_exchange rv_commit ex_commit check
+count
+-----
+    1
+(1 row)
+
+step rv_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rv_tombstone: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_revoke_race_00001', 'https://iso-portal.test', 'iso-owner', 'owner_revoked');
+
+first
+-----
+t    
+(1 row)
+
+step ex_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ex_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_revoke_race_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step rv_commit: COMMIT;
+step ex_exchange: <... completed>
+ERROR:  instance_revoked
+step ex_commit: COMMIT;
+step check: 
+  select (di.tombstoned_at is not null) as tombstoned,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id) as all_credentials,
+         (select a.status from agent_board.agents a where a.id = di.agent_id) as agent_status
+    from agent_board.delegate_instances di where di.instance_id = 'iso_revoke_race_00001';
+
+tombstoned|live_credentials|all_credentials|agent_status
+----------+----------------+---------------+------------
+t         |               0|              1|revoked     
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_withdraw_evict_race.out

@@ -0,0 +1,235 @@
+Parsed test spec with 4 sessions
+
+starting permutation: a_begin a_evict o_begin o_withdraw a_commit o_commit check o_readd check
+step a_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000001')::text, true) is not null as admin_session;
+
+admin_session
+-------------
+t            
+(1 row)
+
+step a_evict: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'removed');
+
+membership_state
+----------------
+removed         
+(1 row)
+
+step o_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, true) is not null as owner_session;
+
+owner_session
+-------------
+t            
+(1 row)
+
+step o_withdraw: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'left');
+ <waiting ...>
+step a_commit: COMMIT;
+step o_withdraw: <... completed>
+ERROR:  a principal may withdraw its delegate only from an active or pending membership
+step o_commit: COMMIT;
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+removed       |joined      
+(1 row)
+
+step o_readd: 
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, false) is not null as owner_session;
+  select membership_state from agent_board.add_delegate_to_board(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    '16322000-0000-4000-8000-000000000001');
+
+owner_session
+-------------
+t            
+(1 row)
+
+ERROR:  a removed delegate stays removed; a board admin must lift the removal
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+removed       |joined      
+(1 row)
+
+
+starting permutation: o_begin o_withdraw a_begin a_evict o_commit a_commit check o_readd check
+step o_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, true) is not null as owner_session;
+
+owner_session
+-------------
+t            
+(1 row)
+
+step o_withdraw: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'left');
+
+membership_state
+----------------
+left            
+(1 row)
+
+step a_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000001')::text, true) is not null as admin_session;
+
+admin_session
+-------------
+t            
+(1 row)
+
+step a_evict: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'removed');
+ <waiting ...>
+step o_commit: COMMIT;
+step a_evict: <... completed>
+membership_state
+----------------
+removed         
+(1 row)
+
+step a_commit: COMMIT;
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+removed       |joined      
+(1 row)
+
+step o_readd: 
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, false) is not null as owner_session;
+  select membership_state from agent_board.add_delegate_to_board(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    '16322000-0000-4000-8000-000000000001');
+
+owner_session
+-------------
+t            
+(1 row)
+
+ERROR:  a removed delegate stays removed; a board admin must lift the removal
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+removed       |joined      
+(1 row)
+
+
+starting permutation: a_begin a_evict_member m_begin m_leave a_commit m_commit check
+step a_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000001')::text, true) is not null as admin_session;
+
+admin_session
+-------------
+t            
+(1 row)
+
+step a_evict_member: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001', '16321000-0000-4000-8000-000000000002', 'removed');
+
+membership_state
+----------------
+removed         
+(1 row)
+
+step m_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000002')::text, true) is not null as member_session;
+
+member_session
+--------------
+t             
+(1 row)
+
+step m_leave: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001', '16321000-0000-4000-8000-000000000002', 'left');
+ <waiting ...>
+step a_commit: COMMIT;
+step m_leave: <... completed>
+ERROR:  self membership change not permitted; use the join/approval path
+step m_commit: COMMIT;
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+joined        |removed     
+(1 row)
+

package/tests/isolation/specs/hosted_delegate_exchange_race.spec

@@ -0,0 +1,64 @@
+# HOSTED (v11) SL-2, IF-0-HOSTED-7: two concurrent exchanges of ONE instance at different
+# generations serialise on the instance row lock (`select ... for update`), in both orders.
+#
+#   new first: the generation-3 exchange commits; the generation-2 exchange, blocked on the
+#              row, then sees r = 3 and is refused generation_superseded.
+#   old first: the generation-2 exchange commits; the generation-3 exchange, blocked, then
+#              sees r = 2, records 3 and revokes every lower-generation credential.
+#
+# Either way the recorded generation is 3 and the only live credential is generation 3.
+# Without the row lock the generation-2 exchange does not wait for the read, decides against
+# r = 1, and the trace and the final generation both change (the mutation receipt).
+
+setup
+{
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+
+teardown
+{
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_%';
+  delete from agent_board.agents where handle like 'delegate-%';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "new"
+step "new_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "new_exchange" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000003', 'generation', 3,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "new_commit" { COMMIT; }
+
+session "old"
+step "old_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "old_exchange" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "old_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select di.generation as recorded_generation, di.grant_id as recorded_grant,
+         (select string_agg(ac.generation::text, ',' order by ac.generation)
+            from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_generations,
+         (select count(*) from agent_board.agents a where a.handle like 'delegate-%') as delegate_agents
+    from agent_board.delegate_instances di where di.instance_id = 'iso_exchange_race_0001';
+}
+
+permutation "new_begin" "new_exchange" "old_begin" "old_exchange" "new_commit" "old_commit" "check"
+permutation "old_begin" "old_exchange" "new_begin" "new_exchange" "old_commit" "new_commit" "check"