@consiliency/agent-board-schema 1.58.0 → 1.60.0

package/tests/isolation/expected/hosted_delegate_exchange_agent_revoke_race.out

@@ -0,0 +1,66 @@
+Parsed test spec with 4 sessions
+
+starting permutation: h_begin x_begin x_gen2 r_begin r_agent h_commit x_commit r_commit check
+count
+-----
+    1
+(1 row)
+
+step h_begin: 
+  BEGIN;
+  select (ac.id is not null) as held
+    from agent_board.agent_credentials ac
+    join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+   where di.instance_id = 'iso_xa_instance_00001'
+   order by ac.created_at desc, ac.id desc
+   limit 1
+   for update of ac;
+
+held
+----
+t   
+(1 row)
+
+step x_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step x_gen2: 
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-xa.test', 'sub', 'iso-xa-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_xa_instance_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-xa-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+ <waiting ...>
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_agent: 
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_xa_instance_00001'),
+    '16591400-0000-4000-8000-000000000001', 'iso exchange revoke race');
+ <waiting ...>
+step h_commit: COMMIT;
+step x_gen2: <... completed>
+issued
+------
+     1
+(1 row)
+
+step x_commit: COMMIT;
+step r_agent: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select a.status as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id) as credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.generation = 2) as generation_2,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.revoked_at is null) as live
+    from agent_board.agents a
+    join agent_board.delegate_instances di on di.agent_id = a.id
+   where di.instance_id = 'iso_xa_instance_00001';
+
+delegate_status|credentials|generation_2|live
+---------------+-----------+------------+----
+revoked        |          3|           1|   0
+(1 row)
+

package/tests/isolation/expected/hosted_delegate_tombstone_revoke_race.out

@@ -0,0 +1,170 @@
+Parsed test spec with 4 sessions
+
+starting permutation: h_begin t_begin t_tomb r_begin r_human h_commit t_commit r_commit check
+bare_owner
+----------
+t         
+(1 row)
+
+step h_begin: 
+  BEGIN;
+  select (bm.id is not null) as held from agent_board.board_memberships bm
+    join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+   where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state = 'joined'
+   for update of bm;
+
+held
+----
+t   
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_instance_00001', 'https://iso-tr.test', 'iso-tr-owner', 'owner_revoked');
+ <waiting ...>
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_human: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-owner')),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+ <waiting ...>
+step h_commit: COMMIT;
+step t_tomb: <... completed>
+first
+-----
+t    
+(1 row)
+
+step t_commit: COMMIT;
+step r_human: <... completed>
+revoked_agent_count
+-------------------
+                  2
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_tr_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_tr_instance_00001') as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state in ('joined', 'subscribed')) as active_memberships;
+
+tombstoned|delegate_status|live_credentials|active_memberships
+----------+---------------+----------------+------------------
+true      |revoked        |               0|                 0
+(1 row)
+
+
+starting permutation: h_begin t_begin t_tomb r_begin r_agent h_commit t_commit r_commit check
+bare_owner
+----------
+t         
+(1 row)
+
+step h_begin: 
+  BEGIN;
+  select (bm.id is not null) as held from agent_board.board_memberships bm
+    join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+   where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state = 'joined'
+   for update of bm;
+
+held
+----
+t   
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_instance_00001', 'https://iso-tr.test', 'iso-tr-owner', 'owner_revoked');
+ <waiting ...>
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_agent: 
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_tr_instance_00001'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+ <waiting ...>
+step h_commit: COMMIT;
+step t_tomb: <... completed>
+first
+-----
+t    
+(1 row)
+
+step t_commit: COMMIT;
+step r_agent: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step r_commit: COMMIT;
+step check: 
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_tr_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_tr_instance_00001') as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state in ('joined', 'subscribed')) as active_memberships;
+
+tombstoned|delegate_status|live_credentials|active_memberships
+----------+---------------+----------------+------------------
+true      |revoked        |               0|                 0
+(1 row)
+
+
+starting permutation: t_begin t_tomb_bare r_begin r_human_bare t_commit r_commit check_bare
+bare_owner
+----------
+t         
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb_bare: 
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_bare_instance_01', 'https://iso-tr.test', 'iso-tr-bare', 'owner_revoked');
+
+first
+-----
+t    
+(1 row)
+
+step r_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step r_human_bare: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select id from auth.users
+      where email = 'agent+' || agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-bare') || '@agent-board.local'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+
+revoked_agent_count
+-------------------
+                  0
+(1 row)
+
+step t_commit: COMMIT;
+step r_commit: COMMIT;
+step check_bare: 
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_tr_bare_instance_01'
+            and tombstoned_at is not null and owner_subject = 'iso-tr-bare') as tombstoned_recorded,
+         (select count(*) from agent_board.fleet_human_revocations
+           where issuer = 'https://iso-tr.test' and subject = 'iso-tr-bare') as markers;
+
+tombstoned_recorded|markers
+-------------------+-------
+                  1|      0
+(1 row)
+

package/tests/isolation/specs/hosted_delegate_add_tombstone_race.spec

@@ -0,0 +1,102 @@
+# HOSTED follow-ups (Consiliency/message-board#591, item 3b): add_delegate_to_board racing
+# tombstone_delegate_instance of the same instance.
+#
+# add_delegate_to_board reads the instance row FOR SHARE (after the board advisory lock and the
+# owner's agents row) and refuses a tombstoned one; the tombstone holds that row FOR UPDATE while
+# it tombstones the instance and ends every active membership it then lists. The instance row is
+# the one lock the two contend on, so they serialise, and a tombstoned instance is never left with
+# an active membership:
+#
+#   P1 the owner's add first: the tombstone waits on the instance row, then lists the new
+#      membership and ends it (`left`). Tombstoned, revoked, no active membership.
+#   P2 the tombstone first: the add waits on the instance row, then reads the tombstone and is
+#      refused. Tombstoned, revoked, no membership at all.
+#
+# Without the FOR SHARE (measured, mutation T4 in plans/evidence/hosted/mutation-receipts.md) both
+# orders leave a tombstoned instance joined to the board: in P1 the tombstone no longer waits and
+# lists no membership to end; in P2 the add reads the instance before the tombstone commits and
+# writes its membership without waiting (the sink's foreign-key FOR KEY SHARE on the delegate's
+# agents row does not conflict with the tombstone's FOR NO KEY UPDATE). Removing the tombstone's
+# own FOR UPDATE alone is NOT caught (T5): its UPDATE of the instance row takes the same lock
+# before it lists memberships.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16591100-0000-4000-8000-000000000001', 'agent', 'agent', 'iso-at-admin', 'Iso At Admin', 'active');
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://iso-at.test', 'message-board', true, true, ARRAY[]::text[], ARRAY[]::text[], ARRAY['human']
+  );
+  select count(*) from agent_board.enroll_federated_human(
+    'https://iso-at.test', 'message-board', 'iso-at-owner',
+    jsonb_build_object('sub', 'iso-at-owner'), 'Iso At Owner');
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-at.test', 'sub', 'iso-at-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_at_instance_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-at-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+  values ('16591300-0000-4000-8000-000000000001', 'iso-at-board', 'Iso At Board',
+          '16591100-0000-4000-8000-000000000001', 'private', 'active');
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  select '16591300-0000-4000-8000-000000000001'::uuid, a.id, 'member', 'joined', '16591100-0000-4000-8000-000000000001'::uuid
+    from agent_board.agents a where a.handle = agent_board._federated_identity_slug('https://iso-at.test', 'iso-at-owner');
+}
+
+teardown
+{
+  delete from agent_board.board_membership_events where board_id = '16591300-0000-4000-8000-000000000001';
+  delete from agent_board.board_memberships where board_id = '16591300-0000-4000-8000-000000000001';
+  delete from agent_board.boards where id = '16591300-0000-4000-8000-000000000001';
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_at\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_at\_%';
+  delete from agent_board.enrollment_federation_audit where issuer = 'https://iso-at.test';
+  delete from agent_board.agents
+   where handle like 'delegate-%' or handle like 'fed-human-%' or id = '16591100-0000-4000-8000-000000000001';
+  delete from agent_board.identity_providers where issuer = 'https://iso-at.test';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "owner"
+step "o_begin" {
+  BEGIN;
+  select set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-at.test', 'iso-at-owner')))::text, true) is not null as owner_session;
+}
+step "o_add" {
+  select membership_state from agent_board.add_delegate_to_board(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_at_instance_00001'),
+    '16591300-0000-4000-8000-000000000001');
+}
+step "o_commit" { COMMIT; }
+
+session "tomb"
+step "t_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "t_tomb" {
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_at_instance_00001', 'https://iso-at.test', 'iso-at-owner', 'owner_revoked');
+}
+step "t_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_at_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_at_instance_00001') as delegate_status,
+         (select string_agg(bm.membership_state, ',' order by bm.created_at, bm.id) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_at_instance_00001') as delegate_memberships,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.tombstoned_at is not null and bm.membership_state in ('joined', 'subscribed')) as tombstoned_and_active;
+}
+
+permutation "o_begin" "o_add" "t_begin" "t_tomb" "o_commit" "t_commit" "check"
+permutation "t_begin" "t_tomb" "o_begin" "o_add" "t_commit" "o_commit" "check"

package/tests/isolation/specs/hosted_delegate_exchange_agent_revoke_race.spec

@@ -0,0 +1,92 @@
+# HOSTED follow-ups (Consiliency/message-board#591, the class of item 8): an exchange that
+# supersedes a generation racing revoke_agent_subtree of the same delegate.
+#
+# The exchange revokes every lower-generation credential (an UPDATE that locks those rows) and
+# then inserts the new credential, whose foreign key takes FOR KEY SHARE on the delegate's agents
+# row. _revoke_agent_principal takes that agents row FOR UPDATE and then the credentials: ABBA,
+# the same shape as the tombstone's (hosted_delegate_tombstone_revoke_race P2). The exchange now
+# takes the FOR KEY SHARE when it reads the agent's status, before any credential.
+#
+# The "hold" session parks the exchange mid-UPDATE deterministically: it holds the delegate's
+# newest credential FOR UPDATE, so the exchange's superseding UPDATE locks the older one and waits.
+#
+#   P1 Unfixed: the revocation takes the agents row, revokes the agent, and waits on the
+#      credential the exchange holds; released, the exchange's insert waits on the agents row:
+#      deadlock, the exchange is the victim (its deadlock_timeout is the shorter). Fixed: the
+#      revocation waits on the agents row; the exchange commits its generation-2 credential, and
+#      the revocation then revokes the agent and every credential, that one included.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16591400-0000-4000-8000-000000000001', 'agent', 'agent', 'iso-xa-revoker', 'Iso Xa Revoker', 'active');
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-xa.test', 'sub', 'iso-xa-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_xa_instance_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-xa-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-xa.test', 'sub', 'iso-xa-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_xa_instance_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-xa-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+
+teardown
+{
+  delete from agent_board.fleet_revocation_events where revoked_by_agent_id = '16591400-0000-4000-8000-000000000001';
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_xa\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_xa\_%';
+  delete from agent_board.agents where handle like 'delegate-%' or id = '16591400-0000-4000-8000-000000000001';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "hold"
+step "h_begin" {
+  BEGIN;
+  select (ac.id is not null) as held
+    from agent_board.agent_credentials ac
+    join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+   where di.instance_id = 'iso_xa_instance_00001'
+   order by ac.created_at desc, ac.id desc
+   limit 1
+   for update of ac;
+}
+step "h_commit" { COMMIT; }
+
+session "exch"
+setup { SET deadlock_timeout = '100ms'; }
+step "x_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "x_gen2" {
+  select count(*) as issued from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-xa.test', 'sub', 'iso-xa-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_xa_instance_00001', 'grant_id', 'iso_grant_0000000002', 'generation', 2,
+      'owner_sub', 'iso-xa-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+}
+step "x_commit" { COMMIT; }
+
+session "revoke"
+setup { SET deadlock_timeout = '60s'; }
+step "r_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "r_agent" {
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_xa_instance_00001'),
+    '16591400-0000-4000-8000-000000000001', 'iso exchange revoke race');
+}
+step "r_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select a.status as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id) as credentials,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.generation = 2) as generation_2,
+         (select count(*) from agent_board.agent_credentials ac where ac.agent_id = a.id and ac.revoked_at is null) as live
+    from agent_board.agents a
+    join agent_board.delegate_instances di on di.agent_id = a.id
+   where di.instance_id = 'iso_xa_instance_00001';
+}
+
+permutation "h_begin" "x_begin" "x_gen2" "r_begin" "r_agent" "h_commit" "x_commit" "r_commit" "check"

package/tests/isolation/specs/hosted_delegate_tombstone_revoke_race.spec

@@ -0,0 +1,158 @@
+# HOSTED follow-ups (Consiliency/message-board#591, items 8 and 4): tombstone_delegate_instance
+# racing the revokers of the same delegate.
+#
+# The tombstone used to take the delegate's credentials first (its revoke UPDATE) and the
+# delegate's agents row last (the membership event's foreign key, then its status UPDATE).
+# _revoke_agent_principal -- the per-agent step of revoke_human_subtree and revoke_agent_subtree --
+# takes the agents row FOR UPDATE first and the credentials after: ABBA. The tombstone now does its
+# status UPDATE of the agents row (FOR NO KEY UPDATE) right after the instance row, before any
+# credential. It takes NO lock on the owner's auth.users row: it reaches boards, and a board+owner
+# route must take the board first (agent_board_federated_lock_order_class EC-3).
+#
+# P1 and P2 park the tombstone mid-function deterministically: the "hold" session holds the
+# delegate's board_memberships row FOR UPDATE, which update_board_membership (called by the
+# tombstone after it has revoked the credentials) waits for. The revoker is started while the
+# tombstone is parked, then the hold is released.
+#
+#   P1 revoke_human_subtree of the owner. Unfixed: the revocation takes the delegate's agents row
+#      and waits on the credentials the tombstone holds; released, the tombstone waits on that
+#      agents row: deadlock, the tombstone is the victim (its deadlock_timeout is the shorter) and
+#      rolls back. Fixed: the revocation waits on the agents row, and both commit: the instance
+#      is tombstoned AND the delegate revoked.
+#   P2 revoke_agent_subtree of the delegate itself. The same deadlock unfixed; the same wait fixed.
+#   P3 RECORDS A STATED RESIDUAL (AB15), it does not pin a fix: a pre-exchange tombstone (a NEW
+#      instance) racing revoke_human_subtree of an owner with no other evidence. The revocation
+#      does not wait for the tombstone, reads delegate_instances before the insert commits, and
+#      writes no marker (markers = 0). Reachable only for an owner whose auth user exists with no
+#      audit row, no human agents row and no recorded pair -- i.e. pre-1.59.0 evidence only -- so
+#      setup provisions the auth user directly. Closing it needs an owner-row lock in the
+#      tombstone, which EC-3 forbids (it would deadlock against enroll_federated_human). If a
+#      change makes this read 1, the residual closed: update AB15 and this golden together.
+#
+# What each permutation discriminates (measured, plans/evidence/hosted/mutation-receipts.md,
+# section "#591 follow-ups"): P1 and P2 deadlock with the status UPDATE moved back after the
+# memberships.
+
+setup
+{
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16591000-0000-4000-8000-000000000001', 'agent', 'agent', 'iso-tr-revoker', 'Iso Tr Revoker', 'active');
+  insert into agent_board.identity_providers(
+    issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds
+  ) values (
+    'https://iso-tr.test', 'message-board', true, true, ARRAY[]::text[], ARRAY[]::text[], ARRAY['human']
+  );
+  select count(*) from agent_board.enroll_federated_human(
+    'https://iso-tr.test', 'message-board', 'iso-tr-owner',
+    jsonb_build_object('sub', 'iso-tr-owner'), 'Iso Tr Owner');
+  select count(*) from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://iso-tr.test', 'sub', 'iso-tr-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', 'iso_tr_instance_00001', 'grant_id', 'iso_grant_0000000001', 'generation', 1,
+      'owner_sub', 'iso-tr-owner', 'client_id', 'iso-client', 'status', 'active', 'client_change', null)));
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+  values ('16591200-0000-4000-8000-000000000001', 'iso-tr-board', 'Iso Tr Board',
+          '16591000-0000-4000-8000-000000000001', 'private', 'active');
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  select '16591200-0000-4000-8000-000000000001'::uuid, a.id, 'member', 'joined', '16591000-0000-4000-8000-000000000001'::uuid
+    from agent_board.agents a where a.handle = agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-owner');
+  do $$
+  begin
+    perform set_config('request.jwt.claims', json_build_object('role', 'authenticated', 'sub',
+      (select auth_user_id from agent_board.agents
+        where handle = agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-owner')))::text, true);
+    perform agent_board.add_delegate_to_board(
+      (select agent_id from agent_board.delegate_instances where instance_id = 'iso_tr_instance_00001'),
+      '16591200-0000-4000-8000-000000000001');
+  end $$;
+  -- P3's owner: an auth user and nothing else (see the header).
+  select agent_board._ensure_agent_auth_user(agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-bare')) is not null as bare_owner;
+}
+
+teardown
+{
+  delete from agent_board.fleet_revocation_events where revoked_by_agent_id = '16591000-0000-4000-8000-000000000001';
+  delete from agent_board.fleet_human_revocations where issuer = 'https://iso-tr.test';
+  delete from agent_board.board_membership_events where board_id = '16591200-0000-4000-8000-000000000001';
+  delete from agent_board.board_memberships where board_id = '16591200-0000-4000-8000-000000000001';
+  delete from agent_board.boards where id = '16591200-0000-4000-8000-000000000001';
+  delete from agent_board.agent_credentials
+   where agent_id in (select agent_id from agent_board.delegate_instances where instance_id like 'iso\_tr\_%');
+  delete from agent_board.delegate_instances where instance_id like 'iso\_tr\_%';
+  delete from agent_board.enrollment_federation_audit where issuer = 'https://iso-tr.test';
+  delete from agent_board.agents
+   where handle like 'delegate-%' or handle like 'fed-human-%' or id = '16591000-0000-4000-8000-000000000001';
+  delete from agent_board.identity_providers where issuer = 'https://iso-tr.test';
+  delete from auth.identities where provider_id like 'delegate-%' or provider_id like 'fed-human-%';
+  delete from auth.users where email like 'agent+delegate-%' or email like 'agent+fed-human-%';
+}
+
+session "hold"
+step "h_begin" {
+  BEGIN;
+  select (bm.id is not null) as held from agent_board.board_memberships bm
+    join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+   where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state = 'joined'
+   for update of bm;
+}
+step "h_commit" { COMMIT; }
+
+session "tomb"
+setup { SET deadlock_timeout = '100ms'; }
+step "t_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "t_tomb" {
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_instance_00001', 'https://iso-tr.test', 'iso-tr-owner', 'owner_revoked');
+}
+step "t_tomb_bare" {
+  select first from agent_board.tombstone_delegate_instance(
+    'iso_tr_bare_instance_01', 'https://iso-tr.test', 'iso-tr-bare', 'owner_revoked');
+}
+step "t_commit" { COMMIT; }
+
+session "revoke"
+setup { SET deadlock_timeout = '60s'; }
+step "r_begin" { BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "r_human" {
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents
+      where handle = agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-owner')),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+}
+step "r_agent" {
+  select revoked_agent_count from agent_board.revoke_agent_subtree(
+    (select agent_id from agent_board.delegate_instances where instance_id = 'iso_tr_instance_00001'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+}
+step "r_human_bare" {
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select id from auth.users
+      where email = 'agent+' || agent_board._federated_identity_slug('https://iso-tr.test', 'iso-tr-bare') || '@agent-board.local'),
+    '16591000-0000-4000-8000-000000000001', 'iso tombstone revoke race');
+}
+step "r_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select (select (di.tombstoned_at is not null)::text from agent_board.delegate_instances di
+           where di.instance_id = 'iso_tr_instance_00001') as tombstoned,
+         (select a.status from agent_board.agents a
+            join agent_board.delegate_instances di on di.agent_id = a.id
+           where di.instance_id = 'iso_tr_instance_00001') as delegate_status,
+         (select count(*) from agent_board.agent_credentials ac
+            join agent_board.delegate_instances di on di.agent_id = ac.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and ac.revoked_at is null) as live_credentials,
+         (select count(*) from agent_board.board_memberships bm
+            join agent_board.delegate_instances di on di.agent_id = bm.agent_id
+           where di.instance_id = 'iso_tr_instance_00001' and bm.membership_state in ('joined', 'subscribed')) as active_memberships;
+}
+step "check_bare" {
+  select (select count(*) from agent_board.delegate_instances where instance_id = 'iso_tr_bare_instance_01'
+            and tombstoned_at is not null and owner_subject = 'iso-tr-bare') as tombstoned_recorded,
+         (select count(*) from agent_board.fleet_human_revocations
+           where issuer = 'https://iso-tr.test' and subject = 'iso-tr-bare') as markers;
+}
+
+permutation "h_begin" "t_begin" "t_tomb" "r_begin" "r_human" "h_commit" "t_commit" "r_commit" "check"
+permutation "h_begin" "t_begin" "t_tomb" "r_begin" "r_agent" "h_commit" "t_commit" "r_commit" "check"
+permutation "t_begin" "t_tomb_bare" "r_begin" "r_human_bare" "t_commit" "r_commit" "check_bare"