@consiliency/agent-board-schema 1.59.0 → 1.63.0

package/tests/catalog/p_metadata_parameters.json

@@ -249,6 +249,10 @@
       "signature": "_mint_agent_refresh_token()",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_mint_fleet_agent_session_legacy(p_challenge_id uuid, p_nonce text, p_signing_key_id uuid, p_agent_id uuid, p_max_ttl_seconds integer)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_next_callback_attempt_number(p_outbox_event_id uuid)",
       "declares_p_metadata": false
@@ -345,6 +349,10 @@
       "signature": "_revoke_agent_principal(p_agent_id uuid, p_revoked_by_agent_id uuid, p_reason text)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_revoke_session_identity_family(p_agent_id uuid, p_actor uuid, p_reason text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_role_rank(p_role text)",
       "declares_p_metadata": false
@@ -353,6 +361,50 @@
       "signature": "_send_fleet_scope_mode(p_scope_key text)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_session_identity_agent_lineage()",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_ancestor_actor(p_identity_agent_id uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_ancestor_ceiling(p_agent_id uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_check_limits(p_root uuid, p_parent uuid, p_reactivation uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_has_human_owner(p_root_agent_id uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_kind_immutable()",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_lease_live(p_identity uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_lineage()",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_owner(p_identity_agent_id uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_read_allowed(p_identity_agent_id uuid)",
+      "declares_p_metadata": false
+    },
+    {
+      "signature": "_session_identity_revocation_actor(p_identity_agent_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_signed_write_actor_id(p_payload jsonb, p_gateway_decision jsonb, p_actor_field text)",
       "declares_p_metadata": false
@@ -393,6 +445,10 @@
       "signature": "append_task_event(p_task_id uuid, p_actor_agent_id uuid, p_event_type text, p_payload jsonb, p_status text, p_assigned_agent_id uuid, p_completed_at timestamp with time zone)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "approve_identity_state(p_identity_agent_id uuid, p_risky_digest text, p_recorded_fingerprint jsonb)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "block_board_inviter(p_board_id uuid, p_inviter_agent_id uuid, p_target_agent_id uuid, p_metadata jsonb)",
       "declares_p_metadata": true
@@ -493,6 +549,10 @@
       "signature": "get_schema_version()",
       "declares_p_metadata": false
     },
+    {
+      "signature": "get_session_identity_state(p_identity_agent_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "grant_board_role(p_board_id uuid, p_agent_id uuid, p_grantee_role text, p_grantor_agent_id uuid)",
       "declares_p_metadata": false
@@ -501,6 +561,10 @@
       "signature": "heartbeat(p_agent_id uuid, p_thread_id uuid, p_availability text, p_activity_summary text, p_expires_in interval, p_metadata jsonb)",
       "declares_p_metadata": true
     },
+    {
+      "signature": "heartbeat_session_identity(p_identity_agent_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "invite_board_for_display(p_code_sha256 text)",
       "declares_p_metadata": false
@@ -521,6 +585,10 @@
       "signature": "leave_board(p_board_id uuid, p_agent_id uuid, p_metadata jsonb)",
       "declares_p_metadata": true
     },
+    {
+      "signature": "link_session_alias(p_identity_agent_id uuid, p_identity_lease_epoch text, p_session_id text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "list_board_members(p_board_id uuid)",
       "declares_p_metadata": false
@@ -533,6 +601,10 @@
       "signature": "list_my_board_requests()",
       "declares_p_metadata": false
     },
+    {
+      "signature": "list_session_children(p_parent_agent_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "mark_read(p_thread_id uuid, p_agent_id uuid, p_last_read_message_sequence bigint)",
       "declares_p_metadata": false
@@ -542,11 +614,11 @@
       "declares_p_metadata": false
     },
     {
-      "signature": "mint_delegated_child(p_root_agent_id uuid, p_child_slug text, p_requested_scopes jsonb, p_child_public_key text, p_ttl interval, p_self_service boolean)",
+      "signature": "mint_delegated_child(p_root_agent_id uuid, p_child_slug text, p_requested_scopes jsonb, p_child_public_key text, p_ttl interval, p_self_service boolean, p_session_harness text, p_session_id text, p_minter_lease_epoch text, p_requested_rooms jsonb, p_fingerprint jsonb, p_forked_from uuid)",
       "declares_p_metadata": false
     },
     {
-      "signature": "mint_fleet_agent_session(p_challenge_id uuid, p_nonce text, p_signing_key_id uuid, p_agent_id uuid, p_max_ttl_seconds integer)",
+      "signature": "mint_fleet_agent_session(p_challenge_id uuid, p_nonce text, p_signing_key_id uuid, p_agent_id uuid, p_max_ttl_seconds integer, p_holder_secret text, p_session_id text)",
       "declares_p_metadata": false
     },
     {
@@ -585,6 +657,10 @@
       "signature": "reactivate_fleet_machine(p_machine_id uuid, p_reactivated_by_agent_id uuid, p_reactivation_reason text)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "readmit_session_identity(p_identity_agent_id uuid, p_child_slug text, p_child_public_key text, p_requested_scopes jsonb, p_requested_rooms jsonb, p_ttl interval)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "reap_expired_enroll_rate_events(p_older_than interval)",
       "declares_p_metadata": false
@@ -621,6 +697,10 @@
       "signature": "record_callback_delivery_terminal_failure(p_outbox_event_id uuid, p_endpoint_id uuid, p_http_status integer, p_error_summary text, p_metadata jsonb)",
       "declares_p_metadata": true
     },
+    {
+      "signature": "record_session_identity_state(p_identity_agent_id uuid, p_fingerprint jsonb)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "record_signing_key_proof_result(p_challenge_id uuid, p_agent_id uuid, p_key_id text, p_verified boolean, p_failure_class text, p_metadata jsonb)",
       "declares_p_metadata": true
@@ -645,6 +725,10 @@
       "signature": "release_claim(p_lease_token uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "rename_agent(p_agent_id uuid, p_display_name text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "renew_claim(p_lease_token uuid, p_lease_expires_at timestamp with time zone)",
       "declares_p_metadata": false
@@ -653,6 +737,10 @@
       "signature": "renew_delegated_grant(p_child_agent_id uuid, p_extend interval)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "renew_session_identity(p_identity_agent_id uuid, p_risky_digest text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "request_join_board(p_board_id uuid, p_agent_id uuid, p_metadata jsonb)",
       "declares_p_metadata": true
@@ -705,6 +793,10 @@
       "signature": "revoke_invite_link(p_code text, p_metadata jsonb)",
       "declares_p_metadata": true
     },
+    {
+      "signature": "revoke_session_identity(p_identity_agent_id uuid)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "rotate_agent_token(p_agent_id uuid)",
       "declares_p_metadata": false
@@ -741,6 +833,10 @@
       "signature": "set_board_claim_policy(p_board_id uuid, p_claim_policy text)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "set_board_member_label(p_board_id uuid, p_agent_id uuid, p_label text)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "set_board_role_gate(p_board_id uuid, p_enforced boolean)",
       "declares_p_metadata": false

package/tests/isolation/expected/grant_target_role_race.out

@@ -0,0 +1,348 @@
+Parsed test spec with 7 sessions
+
+starting permutation: m_begin m_redeem a_begin a_grant_m_observer m_commit a_rollback check
+count
+-----
+    1
+(1 row)
+
+step m_begin: 
+  BEGIN;
+  select set_config('g674.code', (select code from agent_board.board_invite_tokens
+    where board_id = '67430000-0000-4000-8000-000000000001' and preset_role = 'admin'), true) is not null as have_code;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000003';
+
+have_code
+---------
+t        
+(1 row)
+
+step m_redeem: select role, membership_state from agent_board.redeem_invite_link(current_setting('g674.code'));
+role |membership_state
+-----+----------------
+admin|joined          
+(1 row)
+
+step a_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000002';
+
+step a_grant_m_observer: 
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000003', 'observer');
+ <waiting ...>
+step m_commit: COMMIT;
+step a_grant_m_observer: <... completed>
+ERROR:  grant requires a higher board role than the target
+step a_rollback: ROLLBACK;
+step check: 
+  select a.handle, bm.role, bm.membership_state
+    from agent_board.board_memberships bm join agent_board.agents a on a.id = bm.agent_id
+   where bm.board_id = '67430000-0000-4000-8000-000000000001'
+   order by a.handle, bm.membership_state;
+
+handle     |role    |membership_state
+-----------+--------+----------------
+g674-iso-a1|admin   |joined          
+g674-iso-g |member  |joined          
+g674-iso-m |admin   |joined          
+g674-iso-o |owner   |joined          
+g674-iso-v |observer|joined          
+(5 rows)
+
+
+starting permutation: o_begin o_remove_m a_begin a_grant_m_observer o_commit a_rollback check
+count
+-----
+    1
+(1 row)
+
+step o_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000001';
+
+step o_remove_m: 
+  select membership_state from agent_board.update_board_membership('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000003', 'removed');
+
+membership_state
+----------------
+removed         
+(1 row)
+
+step a_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000002';
+
+step a_grant_m_observer: 
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000003', 'observer');
+ <waiting ...>
+step o_commit: COMMIT;
+step a_grant_m_observer: <... completed>
+ERROR:  grantee has no membership on this board
+step a_rollback: ROLLBACK;
+step check: 
+  select a.handle, bm.role, bm.membership_state
+    from agent_board.board_memberships bm join agent_board.agents a on a.id = bm.agent_id
+   where bm.board_id = '67430000-0000-4000-8000-000000000001'
+   order by a.handle, bm.membership_state;
+
+handle     |role    |membership_state
+-----------+--------+----------------
+g674-iso-a1|admin   |joined          
+g674-iso-g |member  |joined          
+g674-iso-m |member  |removed         
+g674-iso-o |owner   |joined          
+g674-iso-v |observer|joined          
+(5 rows)
+
+
+starting permutation: o_begin o_demote_a a_begin a_grant_m_observer o_commit a_rollback check
+count
+-----
+    1
+(1 row)
+
+step o_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000001';
+
+step o_demote_a: 
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000002', 'member');
+
+role  
+------
+member
+(1 row)
+
+step a_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000002';
+
+step a_grant_m_observer: 
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000003', 'observer');
+ <waiting ...>
+step o_commit: COMMIT;
+step a_grant_m_observer: <... completed>
+ERROR:  grant on another member requires owner or admin role
+step a_rollback: ROLLBACK;
+step check: 
+  select a.handle, bm.role, bm.membership_state
+    from agent_board.board_memberships bm join agent_board.agents a on a.id = bm.agent_id
+   where bm.board_id = '67430000-0000-4000-8000-000000000001'
+   order by a.handle, bm.membership_state;
+
+handle     |role    |membership_state
+-----------+--------+----------------
+g674-iso-a1|member  |joined          
+g674-iso-g |member  |joined          
+g674-iso-m |member  |joined          
+g674-iso-o |owner   |joined          
+g674-iso-v |observer|joined          
+(5 rows)
+
+
+starting permutation: a_begin a_grant_m_observer o_begin o_demote_a a_commit o_commit check
+count
+-----
+    1
+(1 row)
+
+step a_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000002';
+
+step a_grant_m_observer: 
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000003', 'observer');
+
+role    
+--------
+observer
+(1 row)
+
+step o_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000001';
+
+step o_demote_a: 
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000002', 'member');
+ <waiting ...>
+step a_commit: COMMIT;
+step o_demote_a: <... completed>
+role  
+------
+member
+(1 row)
+
+step o_commit: COMMIT;
+step check: 
+  select a.handle, bm.role, bm.membership_state
+    from agent_board.board_memberships bm join agent_board.agents a on a.id = bm.agent_id
+   where bm.board_id = '67430000-0000-4000-8000-000000000001'
+   order by a.handle, bm.membership_state;
+
+handle     |role    |membership_state
+-----------+--------+----------------
+g674-iso-a1|member  |joined          
+g674-iso-g |member  |joined          
+g674-iso-m |observer|joined          
+g674-iso-o |owner   |joined          
+g674-iso-v |observer|joined          
+(5 rows)
+
+
+starting permutation: p_begin p_post p_holds_m_fk o_begin o_grant_m_observer p_commit o_commit check
+count
+-----
+    1
+(1 row)
+
+step p_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000001';
+
+step p_post: 
+  select count(*) > 0 as posted from agent_board.post_board_message('67440000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000001', '67430000-0000-4000-8000-000000000001', 'g674 iso', 'fan-out to M');
+
+posted
+------
+t     
+(1 row)
+
+step p_holds_m_fk: 
+  RESET ROLE;
+  select count(*) as m_delivery_rows from agent_board.delivery_recipients dr
+    join agent_board.board_memberships bm on bm.id = dr.board_membership_id
+   where bm.board_id = '67430000-0000-4000-8000-000000000001' and bm.agent_id = '67420000-0000-4000-8000-000000000003';
+
+m_delivery_rows
+---------------
+              1
+(1 row)
+
+step o_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000001';
+
+step o_grant_m_observer: 
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000003', 'observer');
+
+role    
+--------
+observer
+(1 row)
+
+step p_commit: COMMIT;
+step o_commit: COMMIT;
+step check: 
+  select a.handle, bm.role, bm.membership_state
+    from agent_board.board_memberships bm join agent_board.agents a on a.id = bm.agent_id
+   where bm.board_id = '67430000-0000-4000-8000-000000000001'
+   order by a.handle, bm.membership_state;
+
+handle     |role    |membership_state
+-----------+--------+----------------
+g674-iso-a1|admin   |joined          
+g674-iso-g |member  |joined          
+g674-iso-m |observer|joined          
+g674-iso-o |owner   |joined          
+g674-iso-v |observer|joined          
+(5 rows)
+
+
+starting permutation: g_begin g_redeem g2_begin g2_grant_v_member g2_rollback g_commit g2_retry_begin g2_retry_grant_v_member g2_commit check
+count
+-----
+    1
+(1 row)
+
+step g_begin: 
+  BEGIN;
+  select set_config('g674.code', (select code from agent_board.board_invite_tokens
+    where board_id = '67430000-0000-4000-8000-000000000001' and preset_role = 'admin'), true) is not null as have_code;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000005';
+
+have_code
+---------
+t        
+(1 row)
+
+step g_redeem: select role, membership_state from agent_board.redeem_invite_link(current_setting('g674.code'));
+role |membership_state
+-----+----------------
+admin|joined          
+(1 row)
+
+step g2_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000005';
+
+step g2_grant_v_member: 
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000004', 'member');
+
+ERROR:  grant on another member requires owner or admin role
+step g2_rollback: ROLLBACK;
+step g_commit: COMMIT;
+step g2_retry_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000005';
+
+step g2_retry_grant_v_member: 
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000004', 'member');
+
+role  
+------
+member
+(1 row)
+
+step g2_commit: COMMIT;
+step check: 
+  select a.handle, bm.role, bm.membership_state
+    from agent_board.board_memberships bm join agent_board.agents a on a.id = bm.agent_id
+   where bm.board_id = '67430000-0000-4000-8000-000000000001'
+   order by a.handle, bm.membership_state;
+
+handle     |role  |membership_state
+-----------+------+----------------
+g674-iso-a1|admin |joined          
+g674-iso-g |admin |joined          
+g674-iso-m |member|joined          
+g674-iso-o |owner |joined          
+g674-iso-v |member|joined          
+(5 rows)
+