@consiliency/agent-board-schema 1.58.0 → 1.59.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.58.0",
+  "version": "1.59.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.58.0",
+  "packageVersion": "1.59.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 156,
-  "aggregateSha256": "2ad57215f17554d6ceb6ec1b7987f0e705cbc1c24e0411214be93dc2a2018315",
+  "migrationCount": 157,
+  "aggregateSha256": "481b368359a456111c6a2f901ceba486f32085ee8d48c36aefcfb592c0f1070f",
   "migrations": [
     {
       "order": 0,
@@ -1452,6 +1452,15 @@
       "sourceRef": "message-board",
       "bytes": 166072,
       "sha256": "ef57647e29b8afc788dc8c481a0165b10a3c448aae12b8901901b653216bc3a8"
+    },
+    {
+      "order": 156,
+      "id": "20261009000100_agent_board_hosted_followups",
+      "filename": "20261009000100_agent_board_hosted_followups.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 37430,
+      "sha256": "4c2c4041bb41126b3e1bce940bc8a52ac78b69389a0c866556ba0c0e4adc3564"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST + one ONBOARD + one HOSTED forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 156)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY + one HEARTBEATPRESERVE + one LIVENESSDENOM + one OWNERLESSRENEWTTL + one OWNERLESSQUOTACENSUS + one FLEETDOMAINNODOWNGRADE + one OWNERLESSQUOTACONVERGE + one ADVISORYREVERTRESET + one CLAIMPOLICYRACE + one CLAIMPOLICYLOCKGRANT + one SESSIONCHALLENGESUPERSEDE + one ROOMCONTRACT + one CALLBACKCONSUMER + one ENROLLTOKENSINGLEUSE + one ROOMCONTRACT-ACTIVEFIRST + one ONBOARD + one HOSTED + one HOSTED-FOLLOWUPS forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 157)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(156);
+    expect(manifest.migrationCount).toBe(157);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -349,6 +349,10 @@ describe('manifest integrity', () => {
       // HOSTED (v11): the agent_board_delegate role, delegate instances, the exchange and
       // tombstone RPCs, add_delegate_to_board, the D14 read predicates and the D16 refusals.
       '20261008000100_agent_board_hosted_delegates.sql',
+      // HOSTED follow-ups (#591): the owner's verified (iss, sub) on each delegate instance and the
+      // revocation marker revoke_human_subtree derives from it; the tombstone's and the exchange's
+      // lock order against the subtree revokers (AB15).
+      '20261009000100_agent_board_hosted_followups.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_hosted_delegates.test.sql

@@ -21,7 +21,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(129);
+select plan(143);
 
 -- The test role switches to agent_board_delegate. On PostgreSQL 16+ the role's creator holds
 -- ADMIN OPTION but not SET, so grant SET to the current role for this transaction only (rolled
@@ -1105,9 +1105,11 @@ select is(
   'N2: a suspended owner cannot bring up a new delegate instance, and nothing is written');
 
 -- Owner E: never enrolled as a human on this board (no human row), then durably revoked. The
--- marker is SEEDED: revoke_human_subtree writes it only from a federated enrollment's audit row
--- of an agent the human owns (a keyed agent via enroll_federated_identity), which this file does
--- not build. The row is the shape revoke_human_subtree writes, keyed by the verified (iss, sub).
+-- marker is SEEDED here, by hand, so that E's delegate row stays active and 128 isolates the
+-- marker arm alone (revoke_human_subtree would also revoke the delegate). The row is the shape
+-- revoke_human_subtree writes, keyed by the verified (iss, sub). The real revocation of a
+-- delegate-only owner, which now writes the marker from the instance's recorded (iss, sub)
+-- (#591 item 4, AB15), is section 24.
 -- 127 -- control: an owner with no human row is allowed, as before
 select is(
   pg_temp.exch(pg_temp.claim('inst_eeeeeeeeeeeeeeee_01', 'grant_eeeeeeeeeeeeee_01_1', 1, 'hosted-owner-e', 'client-e'), 'E1'),
@@ -1130,5 +1132,147 @@ select is(
   '42501:owner_inactive 0 0 0',
   'N2: the revocation marker alone refuses a new instance, and nothing is written');
 
+-- ===========================================================================
+-- 24. #591 item 4 -- the owner's (iss, sub) on each instance, and the marker it gives
+--     revoke_human_subtree (AB15); #591 item 9 -- owner_inactive before instance_revoked
+-- ===========================================================================
+-- An owner whose only principals are hosted delegates has no enrollment audit row, so before
+-- 1.59.0 revoke_human_subtree wrote it no marker, and a fresh first exchange passed. Both RPCs now
+-- record the verified pair, and the revocation derives a marker from it.
+-- plpgsql, not sql: each read runs as its own query, so it sees what an action earlier in the
+-- same statement wrote (the reason pg_temp.q exists).
+create function pg_temp.pair(p_iid text) returns text language plpgsql as $$
+begin
+  return coalesce((select coalesce(owner_issuer, '(null)') || ' ' || coalesce(owner_subject, '(null)')
+                     from agent_board.delegate_instances where instance_id = p_iid), '(no row)');
+end $$;
+create function pg_temp.owner_of(p_iid text) returns uuid language plpgsql as $$
+begin
+  return (select owner_user_id from agent_board.delegate_instances where instance_id = p_iid);
+end $$;
+create function pg_temp.markers(p_sub text) returns text language plpgsql as $$
+begin
+  return (select count(*)::text || coalesce(' ' || string_agg(r.owner_user_id::text, ','), '')
+            from agent_board.fleet_human_revocations r
+           where r.issuer = 'https://portal.hosted.test' and r.subject = p_sub);
+end $$;
+-- 130 -- the exchange records the pair (D1 was exchanged in 123)
+select is(pg_temp.pair('inst_dddddddddddddddd_01'), 'https://portal.hosted.test hosted-owner-d',
+  'AB15: the exchange records the owner''s verified (iss, sub) on the instance');
+-- 131 -- a revocation before the first exchange records it too (owner H has nothing else)
+select is(
+  pg_temp.tomb('inst_hhhhhhhhhhhhhhhh_01', 'hosted-owner-h') || ' ' || pg_temp.pair('inst_hhhhhhhhhhhhhhhh_01'),
+  'first=true https://portal.hosted.test hosted-owner-h',
+  'AB15: a pre-exchange tombstone records the owner''s verified (iss, sub) on the row it creates');
+-- 132 -- once recorded, the pair never changes
+select is(
+  pg_temp.try($q$update agent_board.delegate_instances set owner_subject = 'someone-else' where instance_id = 'inst_dddddddddddddddd_01'$q$)
+  || ' ' || pg_temp.pair('inst_dddddddddddddddd_01'),
+  '23514:delegate_instances owner identity never changes once recorded https://portal.hosted.test hosted-owner-d',
+  'AB15: the recorded owner pair is immutable');
+
+-- Owner G: never enrolled, live; the control owner, and the legacy-row fills.
+select pg_temp.svc();
+-- 133 -- a LEGACY row (pre-1.59.0 shape: no pair) is filled by its first exchange
+select is(
+  pg_temp.exch(pg_temp.claim('inst_gggggggggggggggg_01', 'grant_gggggggggggggg_01_1', 1, 'hosted-owner-g', 'client-g'), 'G1')
+  || ' ' || pg_temp.try(format($q$insert into agent_board.delegate_instances(instance_id, owner_user_id) values ('inst_gggggggggggggggg_l1', %L), ('inst_gggggggggggggggg_l2', %L)$q$,
+                              pg_temp.owner_of('inst_gggggggggggggggg_01'), pg_temp.owner_of('inst_gggggggggggggggg_01')))
+  || ' ' || pg_temp.pair('inst_gggggggggggggggg_l1')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_gggggggggggggggg_l1', 'grant_gggggggggggggg_l1_1', 1, 'hosted-owner-g', 'client-g'), 'GL1')
+  || ' ' || pg_temp.pair('inst_gggggggggggggggg_l1'),
+  'ok ok (null) (null) ok https://portal.hosted.test hosted-owner-g',
+  'AB15: a legacy instance with no recorded pair is filled by its next exchange');
+-- 134 -- ...and by a tombstone
+select is(
+  pg_temp.tomb('inst_gggggggggggggggg_l2', 'hosted-owner-g') || ' ' || pg_temp.pair('inst_gggggggggggggggg_l2'),
+  'first=true https://portal.hosted.test hosted-owner-g',
+  'AB15: a legacy instance with no recorded pair is filled by its tombstone');
+
+-- Owner F: never enrolled as a human; its ONLY principal is a hosted delegate.
+-- 135 -- revoke_human_subtree for real, as service_role
+select is(
+  pg_temp.exch(pg_temp.claim('inst_ffffffffffffffff_01', 'grant_ffffffffffffff_01_1', 1, 'hosted-owner-f', 'client-f'), 'F1')
+  || ' ' || pg_temp.try(format($q$select agent_board.revoke_human_subtree(%L, %L, 'hosted 591 test')$q$,
+                               pg_temp.owner_of('inst_ffffffffffffffff_01'), pg_temp.v('K')))
+  || ' ' || pg_temp.q(format($q$select status from agent_board.agents where id = %L$q$, pg_temp.v('F1.agent'))),
+  'ok ok revoked',
+  '#591 item 4: an owner with only a hosted delegate is revoked, and its delegate with it');
+-- 136 -- the marker exists, keyed by the verified pair, naming the owner
+select is(pg_temp.markers('hosted-owner-f'), '1 ' || pg_temp.owner_of('inst_ffffffffffffffff_01')::text,
+  '#591 item 4: revoking a delegate-only owner writes the durable (iss, sub) marker from the instance''s recorded pair');
+-- 137 -- so a fresh first exchange is refused, and writes nothing
+select is(
+  pg_temp.exch(pg_temp.claim('inst_ffffffffffffffff_02', 'grant_ffffffffffffff_02_1', 1, 'hosted-owner-f', 'client-f'), 'x')
+  || ' ' || pg_temp.n2_rows('inst_ffffffffffffffff_02'),
+  '42501:owner_inactive 0 0 0',
+  '#591 item 4: after the revocation a new first exchange for that owner is refused owner_inactive, and nothing is written');
+-- 138 -- control: another live owner, never enrolled, still brings up a new instance
+select is(
+  pg_temp.exch(pg_temp.claim('inst_gggggggggggggggg_02', 'grant_gggggggggggggg_02_1', 1, 'hosted-owner-g', 'client-g'), 'G2')
+  || ' ' || pg_temp.markers('hosted-owner-g'),
+  'ok 0',
+  '#591 item 4 control: a different, unrevoked owner''s first exchange succeeds and has no marker');
+-- 139 -- #591 item 9: a revoked owner AND a tombstoned instance -> owner_inactive, not instance_revoked
+select is(
+  pg_temp.tomb('inst_ffffffffffffffff_01', 'hosted-owner-f')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_ffffffffffffffff_01', 'grant_ffffffffffffff_01_2', 2, 'hosted-owner-f', 'client-f'), 'x'),
+  'first=true 42501:owner_inactive',
+  'AB14 precedence: the owner check runs before the instance''s own refusals -- a tombstoned instance of a revoked owner is refused owner_inactive, not instance_revoked');
+-- 140 -- owner H, whose only row is a pre-exchange tombstone (131): its revocation marks it too
+select is(
+  pg_temp.try(format($q$select agent_board.revoke_human_subtree(%L, %L, 'hosted 591 test')$q$,
+                     pg_temp.owner_of('inst_hhhhhhhhhhhhhhhh_01'), pg_temp.v('K')))
+  || ' ' || pg_temp.markers('hosted-owner-h')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_hhhhhhhhhhhhhhhh_02', 'grant_hhhhhhhhhhhhhh_02_1', 1, 'hosted-owner-h', 'client-h'), 'x')
+  || ' ' || pg_temp.n2_rows('inst_hhhhhhhhhhhhhhhh_02'),
+  'ok 1 ' || pg_temp.owner_of('inst_hhhhhhhhhhhhhhhh_01')::text || ' 42501:owner_inactive 0 0 0',
+  '#591 item 4: an owner whose only row is a pre-exchange tombstone is marked by its revocation, and a new instance is refused');
+-- 141 -- the class: every function that WRITES delegate_instances (any INSERT, UPDATE, MERGE or
+-- DELETE, from the catalog, through the shared matcher family) is one of the two RPCs that record
+-- the pair, and every row this file created carries one except the two hand-inserted legacy rows,
+-- which their exchange and tombstone filled (133, 134). A new writer fails this and names itself.
+-- Every non-system schema, not only agent_board: a writer in public or extensions bypasses the pair
+-- just as well (mutation-checked with one in public). agent_board_test is excluded because it holds
+-- this suite's matcher functions, which carry relation names as data and write nothing.
+select is(
+  (select string_agg(p.proname, ',' order by p.proname)
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname not in ('pg_catalog', 'information_schema', 'agent_board_test')
+      and n.nspname !~ '^pg_'
+      and p.prokind in ('f', 'p')
+      and agent_board_test.stripped_body(p.oid) ~ agent_board_test.write_re('delegate_instances'))
+  || ' ' || (select count(*) from agent_board.delegate_instances where owner_issuer is null)::text,
+  'exchange_delegate_credential,tombstone_delegate_instance 0',
+  'AB15: exactly the exchange and the tombstone write delegate_instances (catalog-derived), and no row is left without the owner pair');
+
+-- 142 -- the pair is both-or-neither and never empty (delegate_instances_owner_identity_shape)
+select is(
+  pg_temp.try(format($q$insert into agent_board.delegate_instances(instance_id, owner_user_id, owner_issuer) values ('inst_gggggggggggggggg_s1', %L, 'https://portal.hosted.test')$q$, pg_temp.owner_of('inst_gggggggggggggggg_01')))
+  || ' ' || pg_temp.try(format($q$insert into agent_board.delegate_instances(instance_id, owner_user_id, owner_issuer, owner_subject) values ('inst_gggggggggggggggg_s2', %L, 'https://portal.hosted.test', '')$q$, pg_temp.owner_of('inst_gggggggggggggggg_01'))),
+  '23514:new row for relation "delegate_instances" violates check constraint "delegate_instances_owner_identity_shape" 23514:new row for relation "delegate_instances" violates check constraint "delegate_instances_owner_identity_shape"',
+  'AB15: an owner pair is recorded whole or not at all, and never empty');
+
+-- 143 -- a LEGACY TOMBSTONED row (pre-1.59.0: tombstoned, no pair) is filled by a repeated
+-- revocation. Nothing else ever writes such a row again: the exchange refuses it
+-- (instance_revoked) before its UPDATE, and a tombstone used to return early. Owner J has only this
+-- row (never enrolled, never exchanged), so the pair is the only evidence revoke_human_subtree can
+-- mark it from. Then a new first exchange of J is refused owner_inactive and writes nothing.
+select pg_temp.put('J.owner', agent_board._ensure_agent_auth_user(
+  agent_board._federated_identity_slug('https://portal.hosted.test', 'hosted-owner-j'))::text);
+select is(
+  pg_temp.try(format($q$insert into agent_board.delegate_instances(instance_id, owner_user_id, tombstoned_at, tombstone_reason) values ('inst_jjjjjjjjjjjjjjjj_l1', %L, now(), 'owner_revoked')$q$, pg_temp.v('J.owner')))
+  || ' ' || pg_temp.pair('inst_jjjjjjjjjjjjjjjj_l1')
+  || ' ' || pg_temp.tomb('inst_jjjjjjjjjjjjjjjj_l1', 'hosted-owner-j')
+  || ' ' || pg_temp.pair('inst_jjjjjjjjjjjjjjjj_l1')
+  || ' ' || pg_temp.try(format($q$select agent_board.revoke_human_subtree(%L, %L, 'hosted 591 test')$q$,
+                               pg_temp.v('J.owner'), pg_temp.v('K')))
+  || ' ' || pg_temp.markers('hosted-owner-j')
+  || ' ' || pg_temp.exch(pg_temp.claim('inst_jjjjjjjjjjjjjjjj_02', 'grant_jjjjjjjjjjjjjj_02_1', 1, 'hosted-owner-j', 'client-j'), 'x')
+  || ' ' || pg_temp.n2_rows('inst_jjjjjjjjjjjjjjjj_02'),
+  'ok (null) (null) first=false https://portal.hosted.test hosted-owner-j ok 1 ' || pg_temp.v('J.owner')
+  || ' 42501:owner_inactive 0 0 0',
+  'AB15: a legacy tombstoned row is filled by a repeated revocation, so revoking its delegate-only owner marks it and a new instance is refused');
+
 select * from finish();
 rollback;

package/tests/catalog/function_execute_privileges.json

@@ -343,6 +343,15 @@
         "authenticated": false
       }
     },
+    {
+      "name": "_delegate_instances_owner_identity_immutable",
+      "signature": "_delegate_instances_owner_identity_immutable()",
+      "executable_by": {
+        "anon": false,
+        "service_role": false,
+        "authenticated": false
+      }
+    },
     {
       "name": "_delegate_principal_agent_id",
       "signature": "_delegate_principal_agent_id(p_agent_id uuid)",

package/tests/catalog/p_metadata_parameters.json

@@ -153,6 +153,10 @@
       "signature": "_delegate_instance_slug(p_issuer text, p_instance_id text)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_delegate_instances_owner_identity_immutable()",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_delegate_principal_agent_id(p_agent_id uuid)",
       "declares_p_metadata": false

package/tests/isolation/expected/hosted_delegate_add_tombstone_race.out

@@ -0,0 +1,105 @@
+Parsed test spec with 3 sessions
+
+starting permutation: o_begin o_add t_begin t_tomb o_commit t_commit check
+step o_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-at.test', 'iso-at-owner')))::text, true) is not null as owner_session;
+
+owner_session
+-------------
+t            
+(1 row)
+
+step o_add: 
+  select membership_state from agent_board.add_delegate_to_board(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_at_instance_00001'),
+    '16591300-0000-4000-8000-000000000001');
+
+membership_state
+----------------
+joined          
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_at_instance_00001', 'https://iso-at.test', 'iso-at-owner', 'owner_revoked');
+ <waiting ...>
+step o_commit: COMMIT;
+step t_tomb: <... completed>
+first
+-----
+t    
+(1 row)
+
+step t_commit: COMMIT;
+step check: 
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_at_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_at_instance_00001') as delegate_status,
+         (select string_agg(bm.membership_state, ',' order by bm.created_at, bm.id) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_at_instance_00001') as delegate_memberships,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.tombstoned_at is not null and bm.membership_state in ('joined', 'subscribed')) as tombstoned_and_active;
+
+tombstoned|delegate_status|delegate_memberships|tombstoned_and_active
+----------+---------------+--------------------+---------------------
+true      |revoked        |left                |                    0
+(1 row)
+
+
+starting permutation: t_begin t_tomb o_begin o_add t_commit o_commit check
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_at_instance_00001', 'https://iso-at.test', 'iso-at-owner', 'owner_revoked');
+
+first
+-----
+t    
+(1 row)
+
+step o_begin: 
+  BEGIN;
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-at.test', 'iso-at-owner')))::text, true) is not null as owner_session;
+
+owner_session
+-------------
+t            
+(1 row)
+
+step o_add: 
+  select membership_state from agent_board.add_delegate_to_board(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_at_instance_00001'),
+    '16591300-0000-4000-8000-000000000001');
+ <waiting ...>
+step t_commit: COMMIT;
+step o_add: <... completed>
+ERROR:  the hosted delegate instance is not live
+step o_commit: COMMIT;
+step check: 
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_at_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_at_instance_00001') as delegate_status,
+         (select string_agg(bm.membership_state, ',' order by bm.created_at, bm.id) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_at_instance_00001') as delegate_memberships,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.tombstoned_at is not null and bm.membership_state in ('joined', 'subscribed')) as tombstoned_and_active;
+
+tombstoned|delegate_status|delegate_memberships|tombstoned_and_active
+----------+---------------+--------------------+---------------------
+true      |revoked        |                    |                    0
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_exchange_agent_revoke_race.out

@@ -0,0 +1,66 @@
+Parsed test spec with 4 sessions
+
+starting permutation: h_begin x_begin x_gen2 r_begin r_agent h_commit x_commit r_commit check
+count
+-----
+    1
+(1 row)
+
+step h_begin: 
+  BEGIN;
+  select (ac.id is not null) as held
+    from agent_board.agent_credentials ac
+    join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+   where di.instance_id = 'iso_xa_instance_00001'
+   order by ac.created_at desc, ac.id desc
+   limit 1
+   for update of ac;
+
+held
+----
+t   
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_gen2: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-xa.test', 'sub', 'iso-xa-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_xa_instance_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-xa-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_agent: 
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_xa_instance_00001'),
+    '16591400-0000-4000-8000-000000000001', 'iso exchange revoke race');
+ <waiting ...>
+step h_commit: COMMIT;
+step x_gen2: <... completed>
+issued
+------
+     1
+(1 row)
+
+step x_commit: COMMIT;
+step r_agent: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select a.status as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id) as credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.generation = 2) as generation_2,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.revoked_at is null) as live
+    from agent_board.agents a
+    join agent_board.delegate_instances di on di.agent_id = a.id
+   where di.instance_id = 'iso_xa_instance_00001';
+
+delegate_status|credentials|generation_2|live
+---------------+-----------+------------+----
+revoked        |          3|           1|   0
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_tombstone_revoke_race.out

@@ -0,0 +1,170 @@
+Parsed test spec with 4 sessions
+
+starting permutation: h_begin t_begin t_tomb r_begin r_human h_commit t_commit r_commit check
+bare_owner
+----------
+t         
+(1 row)
+
+step h_begin: 
+  BEGIN;
+  select (bm.id is not null) as held from agent_board.board_memberships bm
+    join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+   where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state = 'joined'
+   for update of bm;
+
+held
+----
+t   
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_instance_00001', 'https://iso-tr.test', 'iso-tr-owner', 'owner_revoked');
+ <waiting ...>
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_human: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-owner')),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+ <waiting ...>
+step h_commit: COMMIT;
+step t_tomb: <... completed>
+first
+-----
+t    
+(1 row)
+
+step t_commit: COMMIT;
+step r_human: <... completed>
+revoked_agent_count
+-------------------
+                  2
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_tr_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_tr_instance_00001') as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state in ('joined', 'subscribed')) as active_memberships;
+
+tombstoned|delegate_status|live_credentials|active_memberships
+----------+---------------+----------------+------------------
+true      |revoked        |               0|                 0
+(1 row)
+
+
+starting permutation: h_begin t_begin t_tomb r_begin r_agent h_commit t_commit r_commit check
+bare_owner
+----------
+t         
+(1 row)
+
+step h_begin: 
+  BEGIN;
+  select (bm.id is not null) as held from agent_board.board_memberships bm
+    join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+   where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state = 'joined'
+   for update of bm;
+
+held
+----
+t   
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_instance_00001', 'https://iso-tr.test', 'iso-tr-owner', 'owner_revoked');
+ <waiting ...>
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_agent: 
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_tr_instance_00001'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+ <waiting ...>
+step h_commit: COMMIT;
+step t_tomb: <... completed>
+first
+-----
+t    
+(1 row)
+
+step t_commit: COMMIT;
+step r_agent: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_tr_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_tr_instance_00001') as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state in ('joined', 'subscribed')) as active_memberships;
+
+tombstoned|delegate_status|live_credentials|active_memberships
+----------+---------------+----------------+------------------
+true      |revoked        |               0|                 0
+(1 row)
+
+
+starting permutation: t_begin t_tomb_bare r_begin r_human_bare t_commit r_commit check_bare
+bare_owner
+----------
+t         
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb_bare: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_bare_instance_01', 'https://iso-tr.test', 'iso-tr-bare', 'owner_revoked');
+
+first
+-----
+t    
+(1 row)
+
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_human_bare: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select id from auth.users
+      where email = 'agent+' || agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-bare') || '@agent-board.local'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+
+revoked_agent_count
+-------------------
+                  0
+(1 row)
+
+step t_commit: COMMIT;
+step r_commit: COMMIT;
+step check_bare: 
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_tr_bare_instance_01'
+            and tombstoned_at is not null and owner_subject = 'iso-tr-bare') as tombstoned_recorded,
+         (select count(*) from agent_board.fleet_human_revocations
+           where issuer = 'https://iso-tr.test' and subject = 'iso-tr-bare') as markers;
+
+tombstoned_recorded|markers
+-------------------+-------
+                  1|      0
+(1 row)
+