@consiliency/agent-board-schema 1.57.0 → 1.59.0

package/tests/isolation/expected/hosted_delegate_tombstone_revoke_race.out

@@ -0,0 +1,170 @@
+Parsed test spec with 4 sessions
+
+starting permutation: h_begin t_begin t_tomb r_begin r_human h_commit t_commit r_commit check
+bare_owner
+----------
+t         
+(1 row)
+
+step h_begin: 
+  BEGIN;
+  select (bm.id is not null) as held from agent_board.board_memberships bm
+    join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+   where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state = 'joined'
+   for update of bm;
+
+held
+----
+t   
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_instance_00001', 'https://iso-tr.test', 'iso-tr-owner', 'owner_revoked');
+ <waiting ...>
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_human: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-owner')),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+ <waiting ...>
+step h_commit: COMMIT;
+step t_tomb: <... completed>
+first
+-----
+t    
+(1 row)
+
+step t_commit: COMMIT;
+step r_human: <... completed>
+revoked_agent_count
+-------------------
+                  2
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_tr_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_tr_instance_00001') as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state in ('joined', 'subscribed')) as active_memberships;
+
+tombstoned|delegate_status|live_credentials|active_memberships
+----------+---------------+----------------+------------------
+true      |revoked        |               0|                 0
+(1 row)
+
+
+starting permutation: h_begin t_begin t_tomb r_begin r_agent h_commit t_commit r_commit check
+bare_owner
+----------
+t         
+(1 row)
+
+step h_begin: 
+  BEGIN;
+  select (bm.id is not null) as held from agent_board.board_memberships bm
+    join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+   where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state = 'joined'
+   for update of bm;
+
+held
+----
+t   
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_instance_00001', 'https://iso-tr.test', 'iso-tr-owner', 'owner_revoked');
+ <waiting ...>
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_agent: 
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_tr_instance_00001'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+ <waiting ...>
+step h_commit: COMMIT;
+step t_tomb: <... completed>
+first
+-----
+t    
+(1 row)
+
+step t_commit: COMMIT;
+step r_agent: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_tr_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_tr_instance_00001') as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state in ('joined', 'subscribed')) as active_memberships;
+
+tombstoned|delegate_status|live_credentials|active_memberships
+----------+---------------+----------------+------------------
+true      |revoked        |               0|                 0
+(1 row)
+
+
+starting permutation: t_begin t_tomb_bare r_begin r_human_bare t_commit r_commit check_bare
+bare_owner
+----------
+t         
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb_bare: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_bare_instance_01', 'https://iso-tr.test', 'iso-tr-bare', 'owner_revoked');
+
+first
+-----
+t    
+(1 row)
+
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_human_bare: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select id from auth.users
+      where email = 'agent+' || agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-bare') || '@agent-board.local'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+
+revoked_agent_count
+-------------------
+                  0
+(1 row)
+
+step t_commit: COMMIT;
+step r_commit: COMMIT;
+step check_bare: 
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_tr_bare_instance_01'
+            and tombstoned_at is not null and owner_subject = 'iso-tr-bare') as tombstoned_recorded,
+         (select count(*) from agent_board.fleet_human_revocations
+           where issuer = 'https://iso-tr.test' and subject = 'iso-tr-bare') as markers;
+
+tombstoned_recorded|markers
+-------------------+-------
+                  1|      0
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_withdraw_evict_race.out

@@ -0,0 +1,235 @@
+Parsed test spec with 4 sessions
+
+starting permutation: a_begin a_evict o_begin o_withdraw a_commit o_commit check o_readd check
+step a_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000001')::text, true) is not null as admin_session;
+
+admin_session
+-------------
+t            
+(1 row)
+
+step a_evict: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'removed');
+
+membership_state
+----------------
+removed         
+(1 row)
+
+step o_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, true) is not null as owner_session;
+
+owner_session
+-------------
+t            
+(1 row)
+
+step o_withdraw: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'left');
+ <waiting ...>
+step a_commit: COMMIT;
+step o_withdraw: <... completed>
+ERROR:  a principal may withdraw its delegate only from an active or pending membership
+step o_commit: COMMIT;
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+removed       |joined      
+(1 row)
+
+step o_readd: 
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, false) is not null as owner_session;
+  select membership_state from agent_board.add_delegate_to_board(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    '16322000-0000-4000-8000-000000000001');
+
+owner_session
+-------------
+t            
+(1 row)
+
+ERROR:  a removed delegate stays removed; a board admin must lift the removal
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+removed       |joined      
+(1 row)
+
+
+starting permutation: o_begin o_withdraw a_begin a_evict o_commit a_commit check o_readd check
+step o_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, true) is not null as owner_session;
+
+owner_session
+-------------
+t            
+(1 row)
+
+step o_withdraw: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'left');
+
+membership_state
+----------------
+left            
+(1 row)
+
+step a_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000001')::text, true) is not null as admin_session;
+
+admin_session
+-------------
+t            
+(1 row)
+
+step a_evict: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'removed');
+ <waiting ...>
+step o_commit: COMMIT;
+step a_evict: <... completed>
+membership_state
+----------------
+removed         
+(1 row)
+
+step a_commit: COMMIT;
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+removed       |joined      
+(1 row)
+
+step o_readd: 
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, false) is not null as owner_session;
+  select membership_state from agent_board.add_delegate_to_board(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    '16322000-0000-4000-8000-000000000001');
+
+owner_session
+-------------
+t            
+(1 row)
+
+ERROR:  a removed delegate stays removed; a board admin must lift the removal
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+removed       |joined      
+(1 row)
+
+
+starting permutation: a_begin a_evict_member m_begin m_leave a_commit m_commit check
+step a_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000001')::text, true) is not null as admin_session;
+
+admin_session
+-------------
+t            
+(1 row)
+
+step a_evict_member: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001', '16321000-0000-4000-8000-000000000002', 'removed');
+
+membership_state
+----------------
+removed         
+(1 row)
+
+step m_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000002')::text, true) is not null as member_session;
+
+member_session
+--------------
+t             
+(1 row)
+
+step m_leave: 
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001', '16321000-0000-4000-8000-000000000002', 'left');
+ <waiting ...>
+step a_commit: COMMIT;
+step m_leave: <... completed>
+ERROR:  self membership change not permitted; use the join/approval path
+step m_commit: COMMIT;
+step check: 
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+
+delegate_state|member_state
+--------------+------------
+joined        |removed     
+(1 row)
+

package/tests/isolation/specs/hosted_delegate_add_tombstone_race.spec

@@ -0,0 +1,102 @@
+# HOSTED follow-ups (Consiliency/message-board#591, item 3b): add_delegate_to_board racing
+# tombstone_delegate_instance of the same instance.
+#
+# add_delegate_to_board reads the instance row FOR SHARE (after the board advisory lock and the
+# owner's agents row) and refuses a tombstoned one; the tombstone holds that row FOR UPDATE while
+# it tombstones the instance and ends every active membership it then lists. The instance row is
+# the one lock the two contend on, so they serialise, and a tombstoned instance is never left with
+# an active membership:
+#
+#   P1 the owner's add first: the tombstone waits on the instance row, then lists the new
+#      membership and ends it (`left`). Tombstoned, revoked, no active membership.
+#   P2 the tombstone first: the add waits on the instance row, then reads the tombstone and is
+#      refused. Tombstoned, revoked, no membership at all.
+#
+# Without the FOR SHARE (measured, mutation T4 in plans/evidence/hosted/mutation-receipts.md) both
+# orders leave a tombstoned instance joined to the board: in P1 the tombstone no longer waits and
+# lists no membership to end; in P2 the add reads the instance before the tombstone commits and
+# writes its membership without waiting (the sink's foreign-key FOR KEY SHARE on the delegate's
+# agents row does not conflict with the tombstone's FOR NO KEY UPDATE). Removing the tombstone's
+# own FOR UPDATE alone is NOT caught (T5): its UPDATE of the instance row takes the same lock
+# before it lists memberships.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16591100-0000-4000-8000-000000000001', 'agent', 'agent', 'iso-at-admin', 'Iso At Admin', 'active');
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://iso-at.test', 'message-board', true, true, ARRAY[]::text[], ARRAY[]::text[], ARRAY['human']
+  );
+  select count(*) from agent_board.enroll_federated_human(
+    'https://iso-at.test', 'message-board', 'iso-at-owner',
+    jsonb_build_object('sub', 'iso-at-owner'), 'Iso At Owner');
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-at.test', 'sub', 'iso-at-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_at_instance_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-at-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+  values ('16591300-0000-4000-8000-000000000001', 'iso-at-board', 'Iso At Board',
+          '16591100-0000-4000-8000-000000000001', 'private', 'active');
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  select '16591300-0000-4000-8000-000000000001'::uuid, a.id, 'member', 'joined', '16591100-0000-4000-8000-000000000001'::uuid
+    from agent_board.agents a where a.handle = agent_board._federated_identity_slug('https://iso-at.test', 'iso-at-owner');
+}
+
+teardown
+{
+  delete from agent_board.board_membership_events where board_id = '16591300-0000-4000-8000-000000000001';
+  delete from agent_board.board_memberships where board_id = '16591300-0000-4000-8000-000000000001';
+  delete from agent_board.boards where id = '16591300-0000-4000-8000-000000000001';
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_at\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_at\_%';
+  delete from agent_board.enrollment_federation_audit where issuer = 'https://iso-at.test';
+  delete from agent_board.agents
+   where handle like 'delegate-%' or handle like 'fed-human-%' or id = '16591100-0000-4000-8000-000000000001';
+  delete from agent_board.identity_providers where issuer = 'https://iso-at.test';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "owner"
+step "o_begin" {
+  BEGIN;
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-at.test', 'iso-at-owner')))::text, true) is not null as owner_session;
+}
+step "o_add" {
+  select membership_state from agent_board.add_delegate_to_board(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_at_instance_00001'),
+    '16591300-0000-4000-8000-000000000001');
+}
+step "o_commit" { COMMIT; }
+
+session "tomb"
+step "t_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "t_tomb" {
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_at_instance_00001', 'https://iso-at.test', 'iso-at-owner', 'owner_revoked');
+}
+step "t_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_at_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_at_instance_00001') as delegate_status,
+         (select string_agg(bm.membership_state, ',' order by bm.created_at, bm.id) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_at_instance_00001') as delegate_memberships,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.tombstoned_at is not null and bm.membership_state in ('joined', 'subscribed')) as tombstoned_and_active;
+}
+
+permutation "o_begin" "o_add" "t_begin" "t_tomb" "o_commit" "t_commit" "check"
+permutation "t_begin" "t_tomb" "o_begin" "o_add" "t_commit" "o_commit" "check"

package/tests/isolation/specs/hosted_delegate_exchange_agent_revoke_race.spec

@@ -0,0 +1,92 @@
+# HOSTED follow-ups (Consiliency/message-board#591, the class of item 8): an exchange that
+# supersedes a generation racing revoke_agent_subtree of the same delegate.
+#
+# The exchange revokes every lower-generation credential (an UPDATE that locks those rows) and
+# then inserts the new credential, whose foreign key takes FOR KEY SHARE on the delegate's agents
+# row. _revoke_agent_principal takes that agents row FOR UPDATE and then the credentials: ABBA,
+# the same shape as the tombstone's (hosted_delegate_tombstone_revoke_race P2). The exchange now
+# takes the FOR KEY SHARE when it reads the agent's status, before any credential.
+#
+# The "hold" session parks the exchange mid-UPDATE deterministically: it holds the delegate's
+# newest credential FOR UPDATE, so the exchange's superseding UPDATE locks the older one and waits.
+#
+#   P1 Unfixed: the revocation takes the agents row, revokes the agent, and waits on the
+#      credential the exchange holds; released, the exchange's insert waits on the agents row:
+#      deadlock, the exchange is the victim (its deadlock_timeout is the shorter). Fixed: the
+#      revocation waits on the agents row; the exchange commits its generation-2 credential, and
+#      the revocation then revokes the agent and every credential, that one included.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16591400-0000-4000-8000-000000000001', 'agent', 'agent', 'iso-xa-revoker', 'Iso Xa Revoker', 'active');
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-xa.test', 'sub', 'iso-xa-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_xa_instance_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-xa-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-xa.test', 'sub', 'iso-xa-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_xa_instance_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-xa-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+
+teardown
+{
+  delete from agent_board.fleet_revocation_events where revoked_by_agent_id = '16591400-0000-4000-8000-000000000001';
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_xa\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_xa\_%';
+  delete from agent_board.agents where handle like 'delegate-%' or id = '16591400-0000-4000-8000-000000000001';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "hold"
+step "h_begin" {
+  BEGIN;
+  select (ac.id is not null) as held
+    from agent_board.agent_credentials ac
+    join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+   where di.instance_id = 'iso_xa_instance_00001'
+   order by ac.created_at desc, ac.id desc
+   limit 1
+   for update of ac;
+}
+step "h_commit" { COMMIT; }
+
+session "exch"
+setup { SET deadlock_timeout = '100ms'; }
+step "x_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "x_gen2" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-xa.test', 'sub', 'iso-xa-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_xa_instance_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-xa-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "x_commit" { COMMIT; }
+
+session "revoke"
+setup { SET deadlock_timeout = '60s'; }
+step "r_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "r_agent" {
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_xa_instance_00001'),
+    '16591400-0000-4000-8000-000000000001', 'iso exchange revoke race');
+}
+step "r_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select a.status as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id) as credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.generation = 2) as generation_2,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.revoked_at is null) as live
+    from agent_board.agents a
+    join agent_board.delegate_instances di on di.agent_id = a.id
+   where di.instance_id = 'iso_xa_instance_00001';
+}
+
+permutation "h_begin" "x_begin" "x_gen2" "r_begin" "r_agent" "h_commit" "x_commit" "r_commit" "check"

package/tests/isolation/specs/hosted_delegate_exchange_race.spec

@@ -0,0 +1,64 @@
+# HOSTED (v11) SL-2, IF-0-HOSTED-7: two concurrent exchanges of ONE instance at different
+# generations serialise on the instance row lock (`select ... for update`), in both orders.
+#
+#   new first: the generation-3 exchange commits; the generation-2 exchange, blocked on the
+#              row, then sees r = 3 and is refused generation_superseded.
+#   old first: the generation-2 exchange commits; the generation-3 exchange, blocked, then
+#              sees r = 2, records 3 and revokes every lower-generation credential.
+#
+# Either way the recorded generation is 3 and the only live credential is generation 3.
+# Without the row lock the generation-2 exchange does not wait for the read, decides against
+# r = 1, and the trace and the final generation both change (the mutation receipt).
+
+setup
+{
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+
+teardown
+{
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_%';
+  delete from agent_board.agents where handle like 'delegate-%';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "new"
+step "new_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "new_exchange" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000003', 'generation', 3,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "new_commit" { COMMIT; }
+
+session "old"
+step "old_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "old_exchange" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "old_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select di.generation as recorded_generation, di.grant_id as recorded_grant,
+         (select string_agg(ac.generation::text, ',' order by ac.generation)
+            from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_generations,
+         (select count(*) from agent_board.agents a where a.handle like 'delegate-%') as delegate_agents
+    from agent_board.delegate_instances di where di.instance_id = 'iso_exchange_race_0001';
+}
+
+permutation "new_begin" "new_exchange" "old_begin" "old_exchange" "new_commit" "old_commit" "check"
+permutation "old_begin" "old_exchange" "new_begin" "new_exchange" "old_commit" "new_commit" "check"