@consiliency/agent-board-schema 1.57.0 → 1.59.0

package/tests/isolation/specs/hosted_delegate_first_exchange_race.spec

@@ -0,0 +1,72 @@
+# HOSTED (v11) SL-2, IF-0-HOSTED-7: concurrent FIRST exchanges of one instance id.
+#
+# Same owner (permutations 1, 2). The exchange takes an owner-keyed advisory lock before it
+# provisions the owner's auth user, so the second waits, then sees the first's committed owner
+# and instance, locks the row, finds the first's agent and takes the refresh path. One
+# instance, one agent, one auth user, two live credentials. Without the owner lock the second
+# provisioned a SECOND auth user for the same owner and was refused owner_mismatch -- the
+# defect this spec found (recorded in plans/evidence/hosted/mutation-receipts.md, SL-2).
+#
+# Different owners presenting the same instance id (permutation 3). The owner locks differ, so
+# here the INSERT-THEN-LOCK is what serialises: the second insert blocks on the primary key
+# until the first commits, then the second locks the committed row and is refused
+# owner_mismatch. With a bare `select ... for update` the second finds no row (the first is
+# uncommitted), tries to create the instance itself, and fails on the primary key instead --
+# the trace changes (the mutation receipt).
+
+teardown
+{
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_%';
+  delete from agent_board.agents where handle like 'delegate-%';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "a"
+step "a_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "a_exchange" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "a_commit" { COMMIT; }
+
+session "b"
+step "b_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "b_exchange" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "b_commit" { COMMIT; }
+
+session "intruder"
+step "i_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "i_exchange" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-other-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000009', 'generation', 1,
+      'owner_sub', 'iso-other-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "i_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_first_exchange_01') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%') as delegate_agents,
+         (select count(*) from auth.users where email like 'agent+delegate-%') as delegate_auth_users,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_first_exchange_01' and ac.revoked_at is null) as live_credentials;
+}
+
+permutation "a_begin" "a_exchange" "b_begin" "b_exchange" "a_commit" "b_commit" "check"
+permutation "b_begin" "b_exchange" "a_begin" "a_exchange" "b_commit" "a_commit" "check"
+permutation "a_begin" "a_exchange" "i_begin" "i_exchange" "a_commit" "i_commit" "check"

package/tests/isolation/specs/hosted_delegate_owner_provisioning_race.spec

@@ -0,0 +1,73 @@
+# HOSTED (v11) fix lane, PR #590 (Codex P2): a FIRST human enroll racing a FIRST delegate
+# exchange for the same (iss, sub), an owner the board has never seen.
+#
+# Both provision the owner's auth user through _ensure_agent_auth_user(_federated_identity_slug
+# (iss, sub)). The exchange's owner advisory lock does not cover enroll_federated_human, so before
+# this fix each transaction looked the slug up, found nothing, and inserted its own auth user: two
+# owners for one human, and the delegate's owner_user_id was not the human's. The fix serialises
+# the miss path inside _ensure_agent_auth_user (a slug-keyed advisory lock, then the lookup again),
+# so whichever provisions second waits, then finds the first's committed user.
+#
+# Both orders: exactly one fed-human auth user, the human row's auth_user_id equals the delegate
+# instance's owner_user_id, and both calls succeed.
+#
+# The "two auth users" observable depends on the isolation substrate's auth.users, which has no
+# unique index on email. A real GoTrue schema may carry one; there the unfixed race ends in a
+# 23505 on the second inserter instead. The lock removes both.
+
+setup
+{
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://iso-prov.test', 'message-board', true, true, ARRAY[]::text[], ARRAY[]::text[], ARRAY['human']
+  );
+}
+
+teardown
+{
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_prov\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_prov\_%';
+  delete from agent_board.enrollment_federation_audit where issuer = 'https://iso-prov.test';
+  delete from agent_board.agents where handle like 'delegate-%' or handle like 'fed-human-%';
+  delete from agent_board.identity_providers where issuer = 'https://iso-prov.test';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "human"
+step "h_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "h_enroll" {
+  select status from agent_board.enroll_federated_human(
+    'https://iso-prov.test', 'message-board', 'iso-prov-owner',
+    jsonb_build_object('sub', 'iso-prov-owner'), 'Iso Prov Owner');
+}
+step "h_commit" { COMMIT; }
+
+session "exchange"
+step "x_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "x_exchange" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-prov.test', 'sub', 'iso-prov-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_prov_instance_0001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-prov-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "x_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select (select count(*) from auth.users
+           where email = 'agent+' || agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+                         || '@agent-board.local') as owner_auth_users,
+         (select count(*) from agent_board.agents
+           where handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')) as human_rows,
+         (select h.auth_user_id = di.owner_user_id
+            from agent_board.agents h, agent_board.delegate_instances di
+           where h.handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+             and di.instance_id = 'iso_prov_instance_0001') as delegate_owned_by_human;
+}
+
+permutation "h_begin" "h_enroll" "x_begin" "x_exchange" "h_commit" "x_commit" "check"
+permutation "x_begin" "x_exchange" "h_begin" "h_enroll" "x_commit" "h_commit" "check"

package/tests/isolation/specs/hosted_delegate_owner_revoke_race.spec

@@ -0,0 +1,93 @@
+# HOSTED (v11) fix lane, PR #590 (N2): an exchange racing revoke_human_subtree of its owner.
+#
+# revoke_human_subtree takes the owner's auth.users row FOR UPDATE, writes the durable marker
+# (fleet_human_revocations), then revokes every agent it lists as owned by the human -- a list
+# read once, at its loop. The exchange refuses owner_inactive on the marker or a non-active human
+# row, and reads both under FOR KEY SHARE on that same auth.users row, so the two serialise:
+#
+#   P1 exchange first (a NEW instance): the revocation waits, then lists and revokes the new
+#      delegate too. No active delegate and no live credential survive.
+#   P2 revocation first, NEW instance: the exchange waits, then sees the marker and is refused
+#      owner_inactive. No instance is written.
+#   P3 revocation first, EXISTING instance: the same, and no credential is minted for the
+#      delegate the revocation just revoked.
+#
+# Without the row lock the exchange reads the marker and the human row before the revocation
+# commits (neither visible), and only blocks later, on a foreign-key lock: P2 then commits an
+# active delegate the revocation never listed, and P3 a live credential for a revoked agent.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16310000-0000-0000-0000-000000000001', 'agent', 'agent', 'iso-rev-revoker', 'Iso Rev Revoker', 'active');
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://iso-rev.test', 'message-board', true, true, ARRAY[]::text[], ARRAY[]::text[], ARRAY['human']
+  );
+  select count(*) from agent_board.enroll_federated_human(
+    'https://iso-rev.test', 'message-board', 'iso-rev-owner',
+    jsonb_build_object('sub', 'iso-rev-owner'), 'Iso Rev Owner');
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-rev.test', 'sub', 'iso-rev-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_rev_existing_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-rev-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+
+teardown
+{
+  delete from agent_board.fleet_revocation_events where revoked_by_agent_id = '16310000-0000-0000-0000-000000000001';
+  delete from agent_board.fleet_human_revocations where issuer = 'https://iso-rev.test';
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_rev\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_rev\_%';
+  delete from agent_board.enrollment_federation_audit where issuer = 'https://iso-rev.test';
+  delete from agent_board.agents
+   where handle like 'delegate-%' or handle like 'fed-human-%' or id = '16310000-0000-0000-0000-000000000001';
+  delete from agent_board.identity_providers where issuer = 'https://iso-rev.test';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "exchange"
+step "x_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "x_new" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-rev.test', 'sub', 'iso-rev-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_rev_new_000000001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-rev-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "x_existing" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-rev.test', 'sub', 'iso-rev-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_rev_existing_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-rev-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "x_commit" { COMMIT; }
+
+session "revoke"
+step "r_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "r_revoke" {
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-rev.test', 'iso-rev-owner')),
+    '16310000-0000-0000-0000-000000000001', 'iso owner revoke race');
+}
+step "r_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select (select count(*) from agent_board.fleet_human_revocations where issuer = 'https://iso-rev.test') as markers,
+         (select count(*) from agent_board.delegate_instances where instance_id like 'iso\_rev\_%') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%' and status = 'active') as active_delegates,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id like 'iso\_rev\_%' and ac.revoked_at is null) as live_delegate_credentials;
+}
+
+permutation "x_begin" "x_new" "r_begin" "r_revoke" "x_commit" "r_commit" "check"
+permutation "r_begin" "r_revoke" "x_begin" "x_new" "r_commit" "x_commit" "check"
+permutation "r_begin" "r_revoke" "x_begin" "x_existing" "r_commit" "x_commit" "check"

package/tests/isolation/specs/hosted_delegate_revoke_race.spec

@@ -0,0 +1,59 @@
+# HOSTED (v11) SL-2, IF-0-HOSTED-7/8: an exchange racing a Portal revocation (tombstone) of
+# the same instance. Both take the instance row FOR UPDATE first, so they serialise:
+#
+#   exchange first: the generation-2 credential is issued; the tombstone, blocked on the row,
+#                   then revokes it with every other credential and revokes the agent.
+#   revoke first:   the tombstone commits; the exchange, blocked, then reads the tombstone and
+#                   is refused instance_revoked.
+#
+# Either way: tombstoned, no live credential, the agent revoked.
+
+setup
+{
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_revoke_race_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+
+teardown
+{
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_%';
+  delete from agent_board.agents where handle like 'delegate-%';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "exchange"
+step "ex_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "ex_exchange" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_revoke_race_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "ex_commit" { COMMIT; }
+
+session "revoke"
+step "rv_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "rv_tombstone" {
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_revoke_race_00001', 'https://iso-portal.test', 'iso-owner', 'owner_revoked');
+}
+step "rv_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select (di.tombstoned_at is not null) as tombstoned,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id) as all_credentials,
+         (select a.status from agent_board.agents a where a.id = di.agent_id) as agent_status
+    from agent_board.delegate_instances di where di.instance_id = 'iso_revoke_race_00001';
+}
+
+permutation "ex_begin" "ex_exchange" "rv_begin" "rv_tombstone" "ex_commit" "rv_commit" "check"
+permutation "rv_begin" "rv_tombstone" "ex_begin" "ex_exchange" "rv_commit" "ex_commit" "check"

package/tests/isolation/specs/hosted_delegate_tombstone_revoke_race.spec

@@ -0,0 +1,158 @@
+# HOSTED follow-ups (Consiliency/message-board#591, items 8 and 4): tombstone_delegate_instance
+# racing the revokers of the same delegate.
+#
+# The tombstone used to take the delegate's credentials first (its revoke UPDATE) and the
+# delegate's agents row last (the membership event's foreign key, then its status UPDATE).
+# _revoke_agent_principal -- the per-agent step of revoke_human_subtree and revoke_agent_subtree --
+# takes the agents row FOR UPDATE first and the credentials after: ABBA. The tombstone now does its
+# status UPDATE of the agents row (FOR NO KEY UPDATE) right after the instance row, before any
+# credential. It takes NO lock on the owner's auth.users row: it reaches boards, and a board+owner
+# route must take the board first (agent_board_federated_lock_order_class EC-3).
+#
+# P1 and P2 park the tombstone mid-function deterministically: the "hold" session holds the
+# delegate's board_memberships row FOR UPDATE, which update_board_membership (called by the
+# tombstone after it has revoked the credentials) waits for. The revoker is started while the
+# tombstone is parked, then the hold is released.
+#
+#   P1 revoke_human_subtree of the owner. Unfixed: the revocation takes the delegate's agents row
+#      and waits on the credentials the tombstone holds; released, the tombstone waits on that
+#      agents row: deadlock, the tombstone is the victim (its deadlock_timeout is the shorter) and
+#      rolls back. Fixed: the revocation waits on the agents row, and both commit: the instance
+#      is tombstoned AND the delegate revoked.
+#   P2 revoke_agent_subtree of the delegate itself. The same deadlock unfixed; the same wait fixed.
+#   P3 RECORDS A STATED RESIDUAL (AB15), it does not pin a fix: a pre-exchange tombstone (a NEW
+#      instance) racing revoke_human_subtree of an owner with no other evidence. The revocation
+#      does not wait for the tombstone, reads delegate_instances before the insert commits, and
+#      writes no marker (markers = 0). Reachable only for an owner whose auth user exists with no
+#      audit row, no human agents row and no recorded pair -- i.e. pre-1.59.0 evidence only -- so
+#      setup provisions the auth user directly. Closing it needs an owner-row lock in the
+#      tombstone, which EC-3 forbids (it would deadlock against enroll_federated_human). If a
+#      change makes this read 1, the residual closed: update AB15 and this golden together.
+#
+# What each permutation discriminates (measured, plans/evidence/hosted/mutation-receipts.md,
+# section "#591 follow-ups"): P1 and P2 deadlock with the status UPDATE moved back after the
+# memberships.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16591000-0000-4000-8000-000000000001', 'agent', 'agent', 'iso-tr-revoker', 'Iso Tr Revoker', 'active');
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://iso-tr.test', 'message-board', true, true, ARRAY[]::text[], ARRAY[]::text[], ARRAY['human']
+  );
+  select count(*) from agent_board.enroll_federated_human(
+    'https://iso-tr.test', 'message-board', 'iso-tr-owner',
+    jsonb_build_object('sub', 'iso-tr-owner'), 'Iso Tr Owner');
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-tr.test', 'sub', 'iso-tr-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_tr_instance_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-tr-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+  values ('16591200-0000-4000-8000-000000000001', 'iso-tr-board', 'Iso Tr Board',
+          '16591000-0000-4000-8000-000000000001', 'private', 'active');
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  select '16591200-0000-4000-8000-000000000001'::uuid, a.id, 'member', 'joined', '16591000-0000-4000-8000-000000000001'::uuid
+    from agent_board.agents a where a.handle = agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-owner');
+  do $$
+  begin
+    perform set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+      (select auth_user_id from agent_board.agents
+        where handle = agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-owner')))::text, true);
+    perform agent_board.add_delegate_to_board(
+      (select agent_id from agent_board.delegate_instances where instance_id = 'iso_tr_instance_00001'),
+      '16591200-0000-4000-8000-000000000001');
+  end $$;
+  -- P3's owner: an auth user and nothing else (see the header).
+  select agent_board._ensure_agent_auth_user(agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-bare')) is not null as bare_owner;
+}
+
+teardown
+{
+  delete from agent_board.fleet_revocation_events where revoked_by_agent_id = '16591000-0000-4000-8000-000000000001';
+  delete from agent_board.fleet_human_revocations where issuer = 'https://iso-tr.test';
+  delete from agent_board.board_membership_events where board_id = '16591200-0000-4000-8000-000000000001';
+  delete from agent_board.board_memberships where board_id = '16591200-0000-4000-8000-000000000001';
+  delete from agent_board.boards where id = '16591200-0000-4000-8000-000000000001';
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_tr\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_tr\_%';
+  delete from agent_board.enrollment_federation_audit where issuer = 'https://iso-tr.test';
+  delete from agent_board.agents
+   where handle like 'delegate-%' or handle like 'fed-human-%' or id = '16591000-0000-4000-8000-000000000001';
+  delete from agent_board.identity_providers where issuer = 'https://iso-tr.test';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "hold"
+step "h_begin" {
+  BEGIN;
+  select (bm.id is not null) as held from agent_board.board_memberships bm
+    join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+   where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state = 'joined'
+   for update of bm;
+}
+step "h_commit" { COMMIT; }
+
+session "tomb"
+setup { SET deadlock_timeout = '100ms'; }
+step "t_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "t_tomb" {
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_instance_00001', 'https://iso-tr.test', 'iso-tr-owner', 'owner_revoked');
+}
+step "t_tomb_bare" {
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_bare_instance_01', 'https://iso-tr.test', 'iso-tr-bare', 'owner_revoked');
+}
+step "t_commit" { COMMIT; }
+
+session "revoke"
+setup { SET deadlock_timeout = '60s'; }
+step "r_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "r_human" {
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-owner')),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+}
+step "r_agent" {
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_tr_instance_00001'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+}
+step "r_human_bare" {
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select id from auth.users
+      where email = 'agent+' || agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-bare') || '@agent-board.local'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+}
+step "r_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_tr_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_tr_instance_00001') as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state in ('joined', 'subscribed')) as active_memberships;
+}
+step "check_bare" {
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_tr_bare_instance_01'
+            and tombstoned_at is not null and owner_subject = 'iso-tr-bare') as tombstoned_recorded,
+         (select count(*) from agent_board.fleet_human_revocations
+           where issuer = 'https://iso-tr.test' and subject = 'iso-tr-bare') as markers;
+}
+
+permutation "h_begin" "t_begin" "t_tomb" "r_begin" "r_human" "h_commit" "t_commit" "r_commit" "check"
+permutation "h_begin" "t_begin" "t_tomb" "r_begin" "r_agent" "h_commit" "t_commit" "r_commit" "check"
+permutation "t_begin" "t_tomb_bare" "r_begin" "r_human_bare" "t_commit" "r_commit" "check_bare"

package/tests/isolation/specs/hosted_delegate_withdraw_evict_race.spec

@@ -0,0 +1,145 @@
+# HOSTED (v11) fix lane, PR #590 (Codex P1): an owner's withdrawal of its delegate (D7) racing
+# a board admin's eviction of that delegate, and the pre-existing same-shape self-leave race.
+#
+# update_board_membership decides the transition from the target's CURRENT state, then writes
+# through the sink. The D7 branch refuses `removed -> left` so an eviction is never laundered
+# into a departure the owner can undo (R-LINK-7). That read was unlocked: with the admin's
+# `removed` uncommitted, the owner read `joined`, passed, blocked on the sink's row lock, and
+# after the admin committed wrote `left` over `removed` -- then re-added the evicted delegate.
+# The read is now FOR UPDATE, so the decision is made on the state the write replaces.
+#
+#   P1 admin evicts first: the owner's withdrawal waits, then sees `removed` and is refused; the
+#      delegate stays removed and the owner's re-add is refused.
+#   P2 owner withdraws first: the admin's eviction waits, then moves `left` to `removed`; same
+#      final state, same refusal.
+#   P3 the same race for an ordinary member's self-leave (the branch that shares the read): the
+#      self-leave waits, then is refused; the member stays removed.
+
+setup
+{
+  insert into auth.users(id, instance_id, aud, role, email) values
+    ('16320000-0000-4000-8000-000000000001', '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'iso-wd-admin@t.test'),
+    ('16320000-0000-4000-8000-000000000002', '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'iso-wd-member@t.test');
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id) values
+    ('16321000-0000-4000-8000-000000000001', 'agent', 'agent', 'iso-wd-admin', 'Iso Wd Admin', 'active', '16320000-0000-4000-8000-000000000001'),
+    ('16321000-0000-4000-8000-000000000002', 'agent', 'agent', 'iso-wd-member', 'Iso Wd Member', 'active', '16320000-0000-4000-8000-000000000002');
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://iso-wd.test', 'message-board', true, true, ARRAY[]::text[], ARRAY[]::text[], ARRAY['human']
+  );
+  select count(*) from agent_board.enroll_federated_human(
+    'https://iso-wd.test', 'message-board', 'iso-wd-owner',
+    jsonb_build_object('sub', 'iso-wd-owner'), 'Iso Wd Owner');
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-wd.test', 'sub', 'iso-wd-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_wd_instance_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-wd-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+  values ('16322000-0000-4000-8000-000000000001', 'iso-wd-board', 'Iso Wd Board',
+          '16321000-0000-4000-8000-000000000001', 'private', 'active');
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  select '16322000-0000-4000-8000-000000000001'::uuid, a.id, r.role, 'joined', '16321000-0000-4000-8000-000000000001'::uuid
+    from (values ('iso-wd-admin', 'owner'), ('iso-wd-member', 'member')) r(handle, role)
+    join agent_board.agents a on a.handle = r.handle
+  union all
+  select '16322000-0000-4000-8000-000000000001'::uuid, a.id, 'member', 'joined', '16321000-0000-4000-8000-000000000001'::uuid
+    from agent_board.agents a where a.handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner');
+  do $$
+  begin
+    perform set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+      (select auth_user_id from agent_board.agents
+        where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, true);
+    perform agent_board.add_delegate_to_board(
+      (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+      '16322000-0000-4000-8000-000000000001');
+  end $$;
+}
+
+teardown
+{
+  delete from agent_board.board_membership_events where board_id = '16322000-0000-4000-8000-000000000001';
+  delete from agent_board.board_memberships where board_id = '16322000-0000-4000-8000-000000000001';
+  delete from agent_board.boards where id = '16322000-0000-4000-8000-000000000001';
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_wd\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_wd\_%';
+  delete from agent_board.enrollment_federation_audit where issuer = 'https://iso-wd.test';
+  delete from agent_board.agents
+   where handle like 'delegate-%' or handle like 'fed-human-%' or handle in ('iso-wd-admin', 'iso-wd-member');
+  delete from agent_board.identity_providers where issuer = 'https://iso-wd.test';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users
+   where email like 'agent+delegate-%' or email like 'agent+fed-human-%'
+      or id in ('16320000-0000-4000-8000-000000000001', '16320000-0000-4000-8000-000000000002');
+}
+
+session "admin"
+step "a_begin" {
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000001')::text, true) is not null as admin_session;
+}
+step "a_evict" {
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'removed');
+}
+step "a_evict_member" {
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001', '16321000-0000-4000-8000-000000000002', 'removed');
+}
+step "a_commit" { COMMIT; }
+
+session "owner"
+step "o_begin" {
+  BEGIN;
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, true) is not null as owner_session;
+}
+step "o_withdraw" {
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001',
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    'left');
+}
+step "o_commit" { COMMIT; }
+step "o_readd" {
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-wd.test', 'iso-wd-owner')))::text, false) is not null as owner_session;
+  select membership_state from agent_board.add_delegate_to_board(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_wd_instance_00001'),
+    '16322000-0000-4000-8000-000000000001');
+}
+
+session "member"
+step "m_begin" {
+  BEGIN;
+  select set_config('request.jwt.claims',
+    json_build_object('role', 'authenticated', 'sub', '16320000-0000-4000-8000-000000000002')::text, true) is not null as member_session;
+}
+step "m_leave" {
+  select membership_state from agent_board.update_board_membership(
+    '16322000-0000-4000-8000-000000000001', '16321000-0000-4000-8000-000000000002', 'left');
+}
+step "m_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select (select bm.membership_state from agent_board.board_memberships bm
+           join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+          where bm.board_id = '16322000-0000-4000-8000-000000000001' and di.instance_id = 'iso_wd_instance_00001'
+          order by bm.created_at desc, bm.id desc limit 1) as delegate_state,
+         (select bm.membership_state from agent_board.board_memberships bm
+          where bm.board_id = '16322000-0000-4000-8000-000000000001'
+            and bm.agent_id = '16321000-0000-4000-8000-000000000002'
+          order by bm.created_at desc, bm.id desc limit 1) as member_state;
+}
+
+permutation "a_begin" "a_evict" "o_begin" "o_withdraw" "a_commit" "o_commit" "check" "o_readd" "check"
+permutation "o_begin" "o_withdraw" "a_begin" "a_evict" "o_commit" "a_commit" "check" "o_readd" "check"
+permutation "a_begin" "a_evict_member" "m_begin" "m_leave" "a_commit" "m_commit" "check"