@consiliency/agent-board-schema 1.57.0 → 1.59.0

package/tests/isolation/expected/hosted_delegate_exchange_agent_revoke_race.out

@@ -0,0 +1,66 @@
+Parsed test spec with 4 sessions
+
+starting permutation: h_begin x_begin x_gen2 r_begin r_agent h_commit x_commit r_commit check
+count
+-----
+    1
+(1 row)
+
+step h_begin: 
+  BEGIN;
+  select (ac.id is not null) as held
+    from agent_board.agent_credentials ac
+    join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+   where di.instance_id = 'iso_xa_instance_00001'
+   order by ac.created_at desc, ac.id desc
+   limit 1
+   for update of ac;
+
+held
+----
+t   
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_gen2: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-xa.test', 'sub', 'iso-xa-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_xa_instance_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-xa-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_agent: 
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_xa_instance_00001'),
+    '16591400-0000-4000-8000-000000000001', 'iso exchange revoke race');
+ <waiting ...>
+step h_commit: COMMIT;
+step x_gen2: <... completed>
+issued
+------
+     1
+(1 row)
+
+step x_commit: COMMIT;
+step r_agent: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select a.status as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id) as credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.generation = 2) as generation_2,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.revoked_at is null) as live
+    from agent_board.agents a
+    join agent_board.delegate_instances di on di.agent_id = a.id
+   where di.instance_id = 'iso_xa_instance_00001';
+
+delegate_status|credentials|generation_2|live
+---------------+-----------+------------+----
+revoked        |          3|           1|   0
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_exchange_race.out

@@ -0,0 +1,93 @@
+Parsed test spec with 3 sessions
+
+starting permutation: new_begin new_exchange old_begin old_exchange new_commit old_commit check
+count
+-----
+    1
+(1 row)
+
+step new_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step new_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000003', 'generation', 3,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step old_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step old_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step new_commit: COMMIT;
+step old_exchange: <... completed>
+ERROR:  generation_superseded
+step old_commit: COMMIT;
+step check: 
+  select di.generation as recorded_generation, di.grant_id as recorded_grant,
+         (select string_agg(ac.generation::text, ',' order by ac.generation)
+            from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_generations,
+         (select count(*) from agent_board.agents a where a.handle like 'delegate-%') as delegate_agents
+    from agent_board.delegate_instances di where di.instance_id = 'iso_exchange_race_0001';
+
+recorded_generation|recorded_grant      |live_generations|delegate_agents
+-------------------+--------------------+----------------+---------------
+                  3|iso_grant_0000000003|               3|              1
+(1 row)
+
+
+starting permutation: old_begin old_exchange new_begin new_exchange old_commit new_commit check
+count
+-----
+    1
+(1 row)
+
+step old_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step old_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step new_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step new_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_exchange_race_0001', 'grant_id', 'iso_grant_0000000003', 'generation', 3,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step old_commit: COMMIT;
+step new_exchange: <... completed>
+issued
+------
+     1
+(1 row)
+
+step new_commit: COMMIT;
+step check: 
+  select di.generation as recorded_generation, di.grant_id as recorded_grant,
+         (select string_agg(ac.generation::text, ',' order by ac.generation)
+            from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_generations,
+         (select count(*) from agent_board.agents a where a.handle like 'delegate-%') as delegate_agents
+    from agent_board.delegate_instances di where di.instance_id = 'iso_exchange_race_0001';
+
+recorded_generation|recorded_grant      |live_generations|delegate_agents
+-------------------+--------------------+----------------+---------------
+                  3|iso_grant_0000000003|               3|              1
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_first_exchange_race.out

@@ -0,0 +1,129 @@
+Parsed test spec with 4 sessions
+
+starting permutation: a_begin a_exchange b_begin b_exchange a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step a_commit: COMMIT;
+step b_exchange: <... completed>
+issued
+------
+     1
+(1 row)
+
+step b_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_first_exchange_01') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%') as delegate_agents,
+         (select count(*) from auth.users where email like 'agent+delegate-%') as delegate_auth_users,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_first_exchange_01' and ac.revoked_at is null) as live_credentials;
+
+instances|delegate_agents|delegate_auth_users|live_credentials
+---------+---------------+-------------------+----------------
+        1|              1|                  1|               2
+(1 row)
+
+
+starting permutation: b_begin b_exchange a_begin a_exchange b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step b_commit: COMMIT;
+step a_exchange: <... completed>
+issued
+------
+     1
+(1 row)
+
+step a_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_first_exchange_01') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%') as delegate_agents,
+         (select count(*) from auth.users where email like 'agent+delegate-%') as delegate_auth_users,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_first_exchange_01' and ac.revoked_at is null) as live_credentials;
+
+instances|delegate_agents|delegate_auth_users|live_credentials
+---------+---------------+-------------------+----------------
+        1|              1|                  1|               2
+(1 row)
+
+
+starting permutation: a_begin a_exchange i_begin i_exchange a_commit i_commit check
+step a_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step i_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step i_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-other-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_first_exchange_01', 'grant_id', 'iso_grant_0000000009', 'generation', 1,
+      'owner_sub', 'iso-other-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step a_commit: COMMIT;
+step i_exchange: <... completed>
+ERROR:  owner_mismatch
+step i_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_first_exchange_01') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%') as delegate_agents,
+         (select count(*) from auth.users where email like 'agent+delegate-%') as delegate_auth_users,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_first_exchange_01' and ac.revoked_at is null) as live_credentials;
+
+instances|delegate_agents|delegate_auth_users|live_credentials
+---------+---------------+-------------------+----------------
+        1|              1|                  1|               1
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_owner_provisioning_race.out

@@ -0,0 +1,91 @@
+Parsed test spec with 3 sessions
+
+starting permutation: h_begin h_enroll x_begin x_exchange h_commit x_commit check
+step h_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step h_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://iso-prov.test', 'message-board', 'iso-prov-owner',
+    jsonb_build_object('sub', 'iso-prov-owner'), 'Iso Prov Owner');
+
+status
+------
+active
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-prov.test', 'sub', 'iso-prov-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_prov_instance_0001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-prov-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step h_commit: COMMIT;
+step x_exchange: <... completed>
+issued
+------
+     1
+(1 row)
+
+step x_commit: COMMIT;
+step check: 
+  select (select count(*) from auth.users
+           where email = 'agent+' || agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+                         || '@agent-board.local') as owner_auth_users,
+         (select count(*) from agent_board.agents
+           where handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')) as human_rows,
+         (select h.auth_user_id = di.owner_user_id
+            from agent_board.agents h, agent_board.delegate_instances di
+           where h.handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+             and di.instance_id = 'iso_prov_instance_0001') as delegate_owned_by_human;
+
+owner_auth_users|human_rows|delegate_owned_by_human
+----------------+----------+-----------------------
+               1|         1|t                      
+(1 row)
+
+
+starting permutation: x_begin x_exchange h_begin h_enroll x_commit h_commit check
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-prov.test', 'sub', 'iso-prov-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_prov_instance_0001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-prov-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step h_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step h_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://iso-prov.test', 'message-board', 'iso-prov-owner',
+    jsonb_build_object('sub', 'iso-prov-owner'), 'Iso Prov Owner');
+ <waiting ...>
+step x_commit: COMMIT;
+step h_enroll: <... completed>
+status
+------
+active
+(1 row)
+
+step h_commit: COMMIT;
+step check: 
+  select (select count(*) from auth.users
+           where email = 'agent+' || agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+                         || '@agent-board.local') as owner_auth_users,
+         (select count(*) from agent_board.agents
+           where handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')) as human_rows,
+         (select h.auth_user_id = di.owner_user_id
+            from agent_board.agents h, agent_board.delegate_instances di
+           where h.handle = agent_board._federated_identity_slug('https://iso-prov.test', 'iso-prov-owner')
+             and di.instance_id = 'iso_prov_instance_0001') as delegate_owned_by_human;
+
+owner_auth_users|human_rows|delegate_owned_by_human
+----------------+----------+-----------------------
+               1|         1|t                      
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_owner_revoke_race.out

@@ -0,0 +1,137 @@
+Parsed test spec with 3 sessions
+
+starting permutation: x_begin x_new r_begin r_revoke x_commit r_commit check
+count
+-----
+    1
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_new: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-rev.test', 'sub', 'iso-rev-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_rev_new_000000001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-rev-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_revoke: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-rev.test', 'iso-rev-owner')),
+    '16310000-0000-0000-0000-000000000001', 'iso owner revoke race');
+ <waiting ...>
+step x_commit: COMMIT;
+step r_revoke: <... completed>
+revoked_agent_count
+-------------------
+                  3
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.fleet_human_revocations where issuer = 'https://iso-rev.test') as markers,
+         (select count(*) from agent_board.delegate_instances where instance_id like 'iso\_rev\_%') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%' and status = 'active') as active_delegates,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id like 'iso\_rev\_%' and ac.revoked_at is null) as live_delegate_credentials;
+
+markers|instances|active_delegates|live_delegate_credentials
+-------+---------+----------------+-------------------------
+      1|        2|               0|                        0
+(1 row)
+
+
+starting permutation: r_begin r_revoke x_begin x_new r_commit x_commit check
+count
+-----
+    1
+(1 row)
+
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_revoke: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-rev.test', 'iso-rev-owner')),
+    '16310000-0000-0000-0000-000000000001', 'iso owner revoke race');
+
+revoked_agent_count
+-------------------
+                  2
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_new: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-rev.test', 'sub', 'iso-rev-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_rev_new_000000001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-rev-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step r_commit: COMMIT;
+step x_new: <... completed>
+ERROR:  owner_inactive
+step x_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.fleet_human_revocations where issuer = 'https://iso-rev.test') as markers,
+         (select count(*) from agent_board.delegate_instances where instance_id like 'iso\_rev\_%') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%' and status = 'active') as active_delegates,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id like 'iso\_rev\_%' and ac.revoked_at is null) as live_delegate_credentials;
+
+markers|instances|active_delegates|live_delegate_credentials
+-------+---------+----------------+-------------------------
+      1|        1|               0|                        0
+(1 row)
+
+
+starting permutation: r_begin r_revoke x_begin x_existing r_commit x_commit check
+count
+-----
+    1
+(1 row)
+
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_revoke: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-rev.test', 'iso-rev-owner')),
+    '16310000-0000-0000-0000-000000000001', 'iso owner revoke race');
+
+revoked_agent_count
+-------------------
+                  2
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_existing: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-rev.test', 'sub', 'iso-rev-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_rev_existing_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-rev-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step r_commit: COMMIT;
+step x_existing: <... completed>
+ERROR:  owner_inactive
+step x_commit: COMMIT;
+step check: 
+  select (select count(*) from agent_board.fleet_human_revocations where issuer = 'https://iso-rev.test') as markers,
+         (select count(*) from agent_board.delegate_instances where instance_id like 'iso\_rev\_%') as instances,
+         (select count(*) from agent_board.agents where handle like 'delegate-%' and status = 'active') as active_delegates,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id like 'iso\_rev\_%' and ac.revoked_at is null) as live_delegate_credentials;
+
+markers|instances|active_delegates|live_delegate_credentials
+-------+---------+----------------+-------------------------
+      1|        1|               0|                        0
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_revoke_race.out

@@ -0,0 +1,87 @@
+Parsed test spec with 3 sessions
+
+starting permutation: ex_begin ex_exchange rv_begin rv_tombstone ex_commit rv_commit check
+count
+-----
+    1
+(1 row)
+
+step ex_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ex_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_revoke_race_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+
+issued
+------
+     1
+(1 row)
+
+step rv_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rv_tombstone: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_revoke_race_00001', 'https://iso-portal.test', 'iso-owner', 'owner_revoked');
+ <waiting ...>
+step ex_commit: COMMIT;
+step rv_tombstone: <... completed>
+first
+-----
+t    
+(1 row)
+
+step rv_commit: COMMIT;
+step check: 
+  select (di.tombstoned_at is not null) as tombstoned,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id) as all_credentials,
+         (select a.status from agent_board.agents a where a.id = di.agent_id) as agent_status
+    from agent_board.delegate_instances di where di.instance_id = 'iso_revoke_race_00001';
+
+tombstoned|live_credentials|all_credentials|agent_status
+----------+----------------+---------------+------------
+t         |               0|              2|revoked     
+(1 row)
+
+
+starting permutation: rv_begin rv_tombstone ex_begin ex_exchange rv_commit ex_commit check
+count
+-----
+    1
+(1 row)
+
+step rv_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step rv_tombstone: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_revoke_race_00001', 'https://iso-portal.test', 'iso-owner', 'owner_revoked');
+
+first
+-----
+t    
+(1 row)
+
+step ex_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step ex_exchange: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-portal.test', 'sub', 'iso-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_revoke_race_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step rv_commit: COMMIT;
+step ex_exchange: <... completed>
+ERROR:  instance_revoked
+step ex_commit: COMMIT;
+step check: 
+  select (di.tombstoned_at is not null) as tombstoned,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = di.agent_id) as all_credentials,
+         (select a.status from agent_board.agents a where a.id = di.agent_id) as agent_status
+    from agent_board.delegate_instances di where di.instance_id = 'iso_revoke_race_00001';
+
+tombstoned|live_credentials|all_credentials|agent_status
+----------+----------------+---------------+------------
+t         |               0|              1|revoked     
+(1 row)
+