@consiliency/agent-board-schema 1.59.0 → 1.63.0

package/tests/isolation/specs/grant_target_role_race.spec

@@ -0,0 +1,207 @@
+# #674 (plans/plan-674-grant-target-role.md §5.4): grant_board_role reads the target's
+# CURRENT role in ONE step-6 statement that locks the target's active row
+# FOR NO KEY UPDATE OF t and LEFT JOINs the grantor's active row unlocked. Every session
+# uses explicit BEGIN/COMMIT (or ROLLBACK); claims are transaction-local, so they are set
+# in the begin step. Authenticated grants pass no p_grantor_agent_id (the host shape).
+#
+# Board B (created by O). Roles at setup:
+#   O owner, A1 admin, M member, V observer, G member.
+# One admin-preset invite link on B, minted by O through create_invite_link (max_uses 5).
+#
+#   I-1  M redeems the admin link (rank-max lifts M to admin, row held) while A1 grants
+#        M -> observer. A1 BLOCKS at step 6; after M commits, the locked read sees admin,
+#        and C-B refuses (D6b). M stays admin.                         (pins M7)
+#   I-2  O removes M (update_board_membership, held) while A1 grants M -> observer. A1
+#        blocks; after O commits, A1 gets P0002 (no all-null row).
+#   I-3  O demotes A1 to member (held) while A1 grants M -> observer. A1 blocks on the
+#        board advisory lock; after O commits, step 6 sees A1 as member and C-A refuses
+#        (D6a). Reverse order: both succeed.
+#   I-4  O posts on B (post_board_message fan-out inserts delivery_recipients naming M's
+#        membership: FOR KEY SHARE on M's row, held) while O's second session grants
+#        M -> observer. The grant completes WITHOUT blocking.          (pins M7b)
+#   I-5  G redeems the admin link (G's own row raised to admin, held) while G's second
+#        session grants V -> member. It does NOT block (g is unlocked), reads G's committed
+#        role member, and C-A refuses (D6a). After G commits, a retry succeeds.
+
+setup
+{
+  insert into auth.users(id) values
+    ('67410000-0000-4000-8000-000000000001'),
+    ('67410000-0000-4000-8000-000000000002'),
+    ('67410000-0000-4000-8000-000000000003'),
+    ('67410000-0000-4000-8000-000000000004'),
+    ('67410000-0000-4000-8000-000000000005');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id) values
+    ('67420000-0000-4000-8000-000000000001', 'agent', 'g674-iso-o',  'G674 O',  'active', '67410000-0000-4000-8000-000000000001'),
+    ('67420000-0000-4000-8000-000000000002', 'agent', 'g674-iso-a1', 'G674 A1', 'active', '67410000-0000-4000-8000-000000000002'),
+    ('67420000-0000-4000-8000-000000000003', 'agent', 'g674-iso-m',  'G674 M',  'active', '67410000-0000-4000-8000-000000000003'),
+    ('67420000-0000-4000-8000-000000000004', 'agent', 'g674-iso-v',  'G674 V',  'active', '67410000-0000-4000-8000-000000000004'),
+    ('67420000-0000-4000-8000-000000000005', 'agent', 'g674-iso-g',  'G674 G',  'active', '67410000-0000-4000-8000-000000000005');
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility)
+  values ('67430000-0000-4000-8000-000000000001', 'g674-iso-board', 'G674 isolation board',
+          '67420000-0000-4000-8000-000000000001', 'private');
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role, created_by_agent_id) values
+    ('67430000-0000-4000-8000-000000000001', '67420000-0000-4000-8000-000000000001', 'joined', 'owner',    '67420000-0000-4000-8000-000000000001'),
+    ('67430000-0000-4000-8000-000000000001', '67420000-0000-4000-8000-000000000002', 'joined', 'admin',    '67420000-0000-4000-8000-000000000001'),
+    ('67430000-0000-4000-8000-000000000001', '67420000-0000-4000-8000-000000000003', 'joined', 'member',   '67420000-0000-4000-8000-000000000001'),
+    ('67430000-0000-4000-8000-000000000001', '67420000-0000-4000-8000-000000000004', 'joined', 'observer', '67420000-0000-4000-8000-000000000001'),
+    ('67430000-0000-4000-8000-000000000001', '67420000-0000-4000-8000-000000000005', 'joined', 'member',   '67420000-0000-4000-8000-000000000001');
+  insert into agent_board.threads(id, created_by_agent_id, subject, board_id)
+  values ('67440000-0000-4000-8000-000000000001', '67420000-0000-4000-8000-000000000001', 'g674 iso thread',
+          '67430000-0000-4000-8000-000000000001');
+  -- The admin-preset link, minted by O through the real RPC (service path, O supplied).
+  select count(*) from agent_board.create_invite_link('67430000-0000-4000-8000-000000000001', 'admin', 'joined', 5,
+    null, '67420000-0000-4000-8000-000000000001', jsonb_build_object());
+}
+
+teardown
+{
+  delete from agent_board.board_invite_redemptions where invite_id in
+    (select id from agent_board.board_invite_tokens where board_id = '67430000-0000-4000-8000-000000000001');
+  delete from agent_board.board_invite_tokens where board_id = '67430000-0000-4000-8000-000000000001';
+  delete from agent_board.delivery_recipients where board_id = '67430000-0000-4000-8000-000000000001';
+  delete from agent_board.inbox_items where board_id = '67430000-0000-4000-8000-000000000001';
+  delete from agent_board.callback_outbox_events where board_id = '67430000-0000-4000-8000-000000000001';
+  delete from agent_board.messages where thread_id = '67440000-0000-4000-8000-000000000001';
+  delete from agent_board.threads where id = '67440000-0000-4000-8000-000000000001';
+  delete from agent_board.board_membership_events where board_id = '67430000-0000-4000-8000-000000000001';
+  delete from agent_board.board_memberships where board_id = '67430000-0000-4000-8000-000000000001';
+  delete from agent_board.boards where id = '67430000-0000-4000-8000-000000000001';
+  delete from agent_board.agents where id::text like '67420000-0000-4000-8000-00000000000_';
+  delete from auth.users where id::text like '67410000-0000-4000-8000-00000000000_';
+}
+
+# M, redeeming the admin link (I-1).
+session "m"
+step "m_begin" {
+  BEGIN;
+  select set_config('g674.code', (select code from agent_board.board_invite_tokens
+    where board_id = '67430000-0000-4000-8000-000000000001' and preset_role = 'admin'), true) is not null as have_code;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000003';
+}
+step "m_redeem" { select role, membership_state from agent_board.redeem_invite_link(current_setting('g674.code')); }
+step "m_commit" { COMMIT; }
+
+# A1, the admin grantor (I-1, I-2, I-3).
+session "a"
+step "a_begin" {
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000002';
+}
+step "a_grant_m_observer" {
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000003', 'observer');
+}
+step "a_commit" { COMMIT; }
+step "a_rollback" { ROLLBACK; }
+
+# O, the owner (I-2 eviction, I-3 demotion of A1, I-4 grantor).
+session "o"
+step "o_begin" {
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000001';
+}
+step "o_remove_m" {
+  select membership_state from agent_board.update_board_membership('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000003', 'removed');
+}
+step "o_demote_a" {
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000002', 'member');
+}
+step "o_grant_m_observer" {
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000003', 'observer');
+}
+step "o_commit" { COMMIT; }
+
+# O's second session, posting on B (I-4): the fan-out FK-inserts delivery_recipients rows
+# naming each recipient's membership, which takes FOR KEY SHARE on M's row.
+session "p"
+step "p_begin" {
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000001';
+}
+step "p_post" {
+  select count(*) > 0 as posted from agent_board.post_board_message('67440000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000001', '67430000-0000-4000-8000-000000000001', 'g674 iso', 'fan-out to M');
+}
+# RESET ROLE (still inside the open transaction, which keeps every lock it took) so this
+# count reads M's uncommitted delivery row past the recipient-scoped RLS O is under.
+step "p_holds_m_fk" {
+  RESET ROLE;
+  select count(*) as m_delivery_rows from agent_board.delivery_recipients dr
+    join agent_board.board_memberships bm on bm.id = dr.board_membership_id
+   where bm.board_id = '67430000-0000-4000-8000-000000000001' and bm.agent_id = '67420000-0000-4000-8000-000000000003';
+}
+step "p_commit" { COMMIT; }
+
+# G, redeeming the admin link for its OWN row (I-5).
+session "g"
+step "g_begin" {
+  BEGIN;
+  select set_config('g674.code', (select code from agent_board.board_invite_tokens
+    where board_id = '67430000-0000-4000-8000-000000000001' and preset_role = 'admin'), true) is not null as have_code;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000005';
+}
+step "g_redeem" { select role, membership_state from agent_board.redeem_invite_link(current_setting('g674.code')); }
+step "g_commit" { COMMIT; }
+
+# G's second session, the grantor in I-5.
+session "g2"
+step "g2_begin" {
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000005';
+}
+step "g2_grant_v_member" {
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000004', 'member');
+}
+step "g2_rollback" { ROLLBACK; }
+step "g2_retry_begin" {
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '67410000-0000-4000-8000-000000000005';
+}
+step "g2_retry_grant_v_member" {
+  select role from agent_board.grant_board_role('67430000-0000-4000-8000-000000000001',
+    '67420000-0000-4000-8000-000000000004', 'member');
+}
+step "g2_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select a.handle, bm.role, bm.membership_state
+    from agent_board.board_memberships bm join agent_board.agents a on a.id = bm.agent_id
+   where bm.board_id = '67430000-0000-4000-8000-000000000001'
+   order by a.handle, bm.membership_state;
+}
+
+# I-1: the target is promoted through the product while it is being demoted.
+permutation "m_begin" "m_redeem" "a_begin" "a_grant_m_observer" "m_commit" "a_rollback" "check"
+# I-2: eviction during a grant.
+permutation "o_begin" "o_remove_m" "a_begin" "a_grant_m_observer" "o_commit" "a_rollback" "check"
+# I-3: two grants on one board, advisory-serialised. Demotion first: the grantor's role is
+# read AFTER the advisory wait (C-A refuses). Grant first: both succeed.
+permutation "o_begin" "o_demote_a" "a_begin" "a_grant_m_observer" "o_commit" "a_rollback" "check"
+permutation "a_begin" "a_grant_m_observer" "o_begin" "o_demote_a" "a_commit" "o_commit" "check"
+# I-4: FK-share non-interference -- the grant completes without blocking. The poster commits
+# BEFORE the grantor so that a grant which DID block (M7b, FOR UPDATE) is released and the
+# golden diff shows `<waiting ...>`/`<... completed>` instead of a truncated run.
+permutation "p_begin" "p_post" "p_holds_m_fk" "o_begin" "o_grant_m_observer" "p_commit" "o_commit" "check"
+# I-5: a concurrent raise of the grantor is seen as the older, lower rank (refusal), never
+# a wrongful allow; the retry after commit succeeds.
+permutation "g_begin" "g_redeem" "g2_begin" "g2_grant_v_member" "g2_rollback" "g_commit" "g2_retry_begin" "g2_retry_grant_v_member" "g2_commit" "check"

package/tests/isolation/specs/session_identity_limits.spec

@@ -0,0 +1,81 @@
+# Concurrent mints from a 59-row mixed rolling-hour census share the true root
+# lock. Expired legacy grants and revoked session mints still consume the hour.
+setup
+{
+  grant usage on schema extensions to service_role;
+  insert into auth.users(id) values ('77000000-0000-4000-8000-000000000001');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id)
+  values ('78000000-0000-4000-8000-000000000001', 'agent', 'sid-limits-root', 'SID limits root', 'active',
+    '77000000-0000-4000-8000-000000000001');
+  insert into agent_board.session_identities(agent_id, root_agent_id, depth)
+  values ('78000000-0000-4000-8000-000000000001', '78000000-0000-4000-8000-000000000001', 0);
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, max_active_children, allowed_scopes, child_ttl_ceiling)
+  values ('79000000-0000-4000-8000-000000000001', '78000000-0000-4000-8000-000000000001', 'root_minted', 200, '[]', interval '8 hours');
+  do $$ declare n integer; child uuid; begin
+    for n in 1..59 loop
+      child := gen_random_uuid();
+      insert into agent_board.agents(id, agent_type, handle, display_name, status, owner_user_id, parent_agent_id, root_agent_id)
+      values (child, 'agent', 'sid-limits-history-' || n, 'SID limits history', case when n <= 30 then 'active' else 'revoked' end,
+        '77000000-0000-4000-8000-000000000001', '78000000-0000-4000-8000-000000000001', '78000000-0000-4000-8000-000000000001');
+      insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth, identity_kind, harness, tombstoned_at, tombstone_reason)
+      values (child, '78000000-0000-4000-8000-000000000001', '78000000-0000-4000-8000-000000000001', 1,
+        case when n <= 30 then 'legacy' else 'session' end, case when n <= 30 then null else 'codex' end,
+        case when n <= 30 then null else now() end, case when n <= 30 then null else 'revoked' end);
+      insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id, granted_scopes, grant_expires_at, revoked_at)
+      values (child, '78000000-0000-4000-8000-000000000001', '78000000-0000-4000-8000-000000000001',
+        '79000000-0000-4000-8000-000000000001', '[]', now() - interval '1 hour', case when n <= 30 then null else now() end);
+    end loop;
+  end $$;
+}
+
+teardown
+{
+  do $$ declare v_auth_ids uuid[]; begin
+    select array_agg(auth_user_id) into v_auth_ids from agent_board.agents
+      where root_agent_id = '78000000-0000-4000-8000-000000000001' and auth_user_id is not null;
+    delete from agent_board.session_id_aliases where root_agent_id = '78000000-0000-4000-8000-000000000001';
+    delete from agent_board.session_identities where root_agent_id = '78000000-0000-4000-8000-000000000001';
+    delete from agent_board.agents where root_agent_id = '78000000-0000-4000-8000-000000000001';
+    delete from agent_board.agents where id = '78000000-0000-4000-8000-000000000001';
+    delete from auth.users where id = any(v_auth_ids) or id = '77000000-0000-4000-8000-000000000001';
+  end $$;
+}
+
+session "a"
+step "a_begin" { BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "a_mint" {
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-a', '[]',
+      public.test_pubkey('sid-limit-a'), interval '1 hour', false, 'codex', 'limit-a');
+  end $$;
+}
+step "a_commit" { COMMIT; }
+
+session "b"
+step "b_begin" { BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "b_mint" {
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-b', '[]',
+      public.test_pubkey('sid-limit-b'), interval '1 hour', false, 'codex', 'limit-b');
+  end $$;
+}
+step "b_duplicate" {
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-b', '[]',
+      public.test_pubkey('sid-limit-b'), interval '1 hour', false, 'codex', 'limit-a');
+  end $$;
+}
+step "b_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select count(*) as mixed_hourly, count(*) filter (where revoked_at is not null) as tombstoned_hourly
+  from agent_board.delegation_grants where root_agent_id = '78000000-0000-4000-8000-000000000001';
+  select count(*) as new_principals from agent_board.agents where handle in ('sid-limit-a', 'sid-limit-b');
+  select count(*) as aliases from agent_board.session_id_aliases where root_agent_id = '78000000-0000-4000-8000-000000000001';
+}
+
+permutation "a_begin" "a_mint" "b_begin" "b_mint" "a_commit" "b_commit" "check"
+permutation "b_begin" "b_mint" "a_begin" "a_mint" "b_commit" "a_commit" "check"
+permutation "a_begin" "a_mint" "b_begin" "b_duplicate" "a_commit" "b_commit" "check"
+permutation "b_begin" "b_duplicate" "a_begin" "a_mint" "b_commit" "a_commit" "check"

package/tests/isolation/specs/session_identity_links.spec

@@ -0,0 +1,80 @@
+# Two verified service-role links serialize on one live Claude identity. Both
+# commit orders and idempotent/different aliases are observable without sleeps.
+setup
+{
+  insert into auth.users(id) values ('71000000-0000-4000-8000-000000000001');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, parent_agent_id, root_agent_id)
+  values
+    ('72000000-0000-4000-8000-000000000001', 'agent', 'sid-links-root', 'SID links root', 'active', null, null, null),
+    ('72000000-0000-4000-8000-000000000002', 'agent', 'sid-links-child', 'SID links child', 'active', '71000000-0000-4000-8000-000000000001',
+      '72000000-0000-4000-8000-000000000001', '72000000-0000-4000-8000-000000000001');
+  insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth, identity_kind, harness,
+    approved_risky_digest, current_risky_digest, holder_secret_hash, last_heartbeat)
+  values
+    ('72000000-0000-4000-8000-000000000001', null, '72000000-0000-4000-8000-000000000001', 0, 'legacy', null, 'approved', 'approved', null, null),
+    ('72000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000001', '72000000-0000-4000-8000-000000000001', 1, 'session', 'claude',
+      'approved', 'approved', extensions.digest('isolation-holder', 'sha256'), now());
+  insert into agent_board.session_id_aliases(id, identity_agent_id, root_agent_id, harness, session_id)
+  values ('73000000-0000-4000-8000-000000000001', '72000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000001', 'claude', 'original');
+  update agent_board.session_identities set lease_alias_id = '73000000-0000-4000-8000-000000000001'
+  where agent_id = '72000000-0000-4000-8000-000000000002';
+  insert into agent_board.delegation_policies(id, root_agent_id, mode, allowed_scopes)
+  values ('74000000-0000-4000-8000-000000000001', '72000000-0000-4000-8000-000000000001', 'root_minted', '["read","write"]');
+  insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id, granted_scopes, grant_expires_at)
+  values ('72000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000001',
+    '72000000-0000-4000-8000-000000000001', '74000000-0000-4000-8000-000000000001', '["read","write"]', now() + interval '8 hours');
+  insert into agent_board.boards(id, slug, name, created_by_agent_id)
+  values ('74000000-0000-4000-8000-000000000002', 'sid-links-room', 'SID links room', '72000000-0000-4000-8000-000000000001');
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role) values
+    ('74000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000001', 'joined', 'owner'),
+    ('74000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000002', 'joined', 'admin');
+}
+
+teardown
+{
+  delete from agent_board.board_membership_events where board_id = '74000000-0000-4000-8000-000000000002';
+  delete from agent_board.board_memberships where board_id = '74000000-0000-4000-8000-000000000002';
+  delete from agent_board.boards where id = '74000000-0000-4000-8000-000000000002';
+  delete from agent_board.delegation_grants where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  delete from agent_board.delegation_policies where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  update agent_board.session_identities set lease_alias_id = null where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  delete from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  delete from agent_board.session_identities where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  delete from agent_board.agents where id = '72000000-0000-4000-8000-000000000002';
+  delete from agent_board.agents where id = '72000000-0000-4000-8000-000000000001';
+  delete from auth.users where id = '71000000-0000-4000-8000-000000000001';
+}
+
+session "a"
+step "a_begin" { BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001'; }
+step "a_link" { select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a'); }
+step "a_commit" { COMMIT; }
+step "a_rebegin" { BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001'; }
+step "a_relink" { select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a'); }
+step "a_recommit" { COMMIT; }
+
+session "b"
+step "b_begin" { BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001'; }
+step "b_same" { select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a'); }
+step "b_other" { select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-b'); }
+step "b_narrow" {
+  select role from agent_board.grant_board_role('74000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000001', 'observer', '72000000-0000-4000-8000-000000000001');
+  select allowed_scopes from agent_board.upsert_delegation_policy('72000000-0000-4000-8000-000000000001', 'root_minted', '["read"]', 200, interval '8 hours', true);
+}
+step "b_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+}
+
+permutation "a_begin" "a_link" "b_begin" "b_same" "a_commit" "b_commit" "check"
+permutation "b_begin" "b_same" "a_begin" "a_link" "b_commit" "a_commit" "check"
+permutation "a_begin" "a_link" "b_begin" "b_other" "a_commit" "b_commit" "check"
+permutation "a_begin" "a_link" "b_begin" "b_narrow" "a_commit" "b_commit" "a_rebegin" "a_relink" "a_recommit" "check"
+permutation "b_begin" "b_narrow" "a_begin" "a_link" "b_commit" "a_commit" "check"

package/tests/isolation/specs/session_identity_reclaim.spec

@@ -0,0 +1,125 @@
+# Two verified key holders reclaim one lapsed Claude identity. Distinct keys
+# avoid challenge/key serialization masking the identity-row race. Both commit
+# orders must produce one epoch bump, one token, one rotated holder and the named
+# duplicate_live_session refusal; the old epoch cannot resolve afterward.
+setup
+{
+  grant usage on schema extensions to service_role;
+  insert into auth.users(id, instance_id, aud, role, email)
+  values ('74000000-0000-4000-8000-000000000001', '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'sid-reclaim@test.invalid');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, parent_agent_id, root_agent_id)
+  values ('75000000-0000-4000-8000-000000000001', 'agent', 'sid-reclaim-root', 'Reclaim root', 'active', null, null, null),
+    ('75000000-0000-4000-8000-000000000002', 'agent', 'sid-reclaim-child', 'Reclaim child', 'active', '74000000-0000-4000-8000-000000000001',
+      '75000000-0000-4000-8000-000000000001', '75000000-0000-4000-8000-000000000001');
+  insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
+  values ('76000000-0000-4000-8000-000000000001', '75000000-0000-4000-8000-000000000002', 'holder-a', 1,
+    public.test_pubkey('sid-reclaim-a'), 'raw_ed25519_base64url', public.test_key_fingerprint('sid-reclaim-a'), 'active', 'proven'),
+    ('76000000-0000-4000-8000-000000000002', '75000000-0000-4000-8000-000000000002', 'holder-b', 2,
+    public.test_pubkey('sid-reclaim-b'), 'raw_ed25519_base64url', public.test_key_fingerprint('sid-reclaim-b'), 'active', 'proven');
+  insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth, identity_kind, harness,
+    approved_risky_digest, current_risky_digest, holder_secret_hash, last_heartbeat)
+  values ('75000000-0000-4000-8000-000000000001', null, '75000000-0000-4000-8000-000000000001', 0, 'legacy', null, 'approved', 'approved', null, null),
+    ('75000000-0000-4000-8000-000000000002', '75000000-0000-4000-8000-000000000001', '75000000-0000-4000-8000-000000000001', 1, 'session', 'claude',
+      'approved', 'approved', extensions.digest('old-holder', 'sha256'), now() - interval '181 seconds');
+  insert into agent_board.session_id_aliases(id, identity_agent_id, root_agent_id, harness, session_id)
+  values ('77000000-0000-4000-8000-000000000001', '75000000-0000-4000-8000-000000000002', '75000000-0000-4000-8000-000000000001', 'claude', 'original');
+  update agent_board.session_identities set lease_alias_id = '77000000-0000-4000-8000-000000000001'
+  where agent_id = '75000000-0000-4000-8000-000000000002';
+}
+
+teardown
+{
+  update agent_board.session_identities set lease_alias_id = null where root_agent_id = '75000000-0000-4000-8000-000000000001';
+  delete from agent_board.session_id_aliases where root_agent_id = '75000000-0000-4000-8000-000000000001';
+  delete from agent_board.session_identities where root_agent_id = '75000000-0000-4000-8000-000000000001';
+  delete from agent_board.nonfleet_sessions where agent_id in
+    (select id from agent_board.agents where root_agent_id = '75000000-0000-4000-8000-000000000001');
+  delete from agent_board.agents where root_agent_id = '75000000-0000-4000-8000-000000000001';
+  delete from agent_board.agents where id = '75000000-0000-4000-8000-000000000001';
+  delete from auth.users where id = '74000000-0000-4000-8000-000000000001';
+}
+
+session "a"
+step "a_begin" { BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "a_reclaim" {
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-a');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000001', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+}
+step "a_first_claim" {
+  do $$ declare a uuid; k uuid; c record; begin
+    select id into a from agent_board.agents where handle = 'sid-stale-old';
+    select id into k from agent_board.agent_signing_keys where agent_id = a;
+    select id, challenge_nonce into c from agent_board.agent_signing_key_challenges where agent_id = a order by created_at desc limit 1;
+    perform * from agent_board.mint_fleet_agent_session(c.id, c.challenge_nonce, k, a, 900, null, 'stale-reservation');
+  end $$;
+}
+step "a_commit" { COMMIT; }
+
+session "b"
+step "b_begin" { BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; }
+step "b_reclaim" {
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-b');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000002', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+}
+step "b_supersede" {
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-new', '[]',
+      public.test_pubkey('sid-stale-new'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+  end $$;
+}
+step "b_commit" { COMMIT; }
+
+session "check"
+step "prepare_stale" {
+  update agent_board.agents set owner_user_id = '74000000-0000-4000-8000-000000000001'
+  where id = '75000000-0000-4000-8000-000000000001';
+  BEGIN;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  select count(*) from agent_board.upsert_delegation_policy('75000000-0000-4000-8000-000000000001', 'root_minted', '[]', 200, interval '8 hours', true);
+  do $$ declare m record; begin
+    select * into m from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-old', '[]',
+      public.test_pubkey('sid-stale-old'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+    perform * from agent_board.issue_signing_key_challenge(m.child_agent_id, 'delegated-ephemeral');
+  end $$;
+  COMMIT;
+  update agent_board.session_identities set created_at = now() - interval '181 seconds'
+  where agent_id = (select id from agent_board.agents where handle = 'sid-stale-old');
+}
+step "check_stale" {
+  select a.status, si.tombstone_reason, si.credential_epoch, si.holder_secret_hash is not null as claimed,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id where a.handle = 'sid-stale-old';
+  select a.handle as bound_principal from agent_board.session_id_aliases al join agent_board.agents a on a.id = al.identity_agent_id
+  where al.root_agent_id = '75000000-0000-4000-8000-000000000001' and al.session_id = 'stale-reservation';
+  select count(*) as successor_principals from agent_board.agents where handle = 'sid-stale-new';
+}
+step "check" {
+  select credential_epoch, holder_secret_hash <> extensions.digest('old-holder', 'sha256') as rotated_holder,
+    a.session_id as bound_alias
+  from agent_board.session_identities si join agent_board.session_id_aliases a on a.id = si.lease_alias_id
+  where si.agent_id = '75000000-0000-4000-8000-000000000002';
+  select count(*) as tokens from agent_board.nonfleet_sessions where agent_id = '75000000-0000-4000-8000-000000000002';
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '74000000-0000-4000-8000-000000000001';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+  select agent_board.current_agent_id() is null as old_epoch_fenced;
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '1';
+  select agent_board.current_agent_id() = '75000000-0000-4000-8000-000000000002'::uuid as new_epoch_resolves;
+  COMMIT;
+}
+
+permutation "a_begin" "a_reclaim" "b_begin" "b_reclaim" "a_commit" "b_commit" "check"
+permutation "b_begin" "b_reclaim" "a_begin" "a_reclaim" "b_commit" "a_commit" "check"
+permutation "prepare_stale" "a_begin" "a_first_claim" "b_begin" "b_supersede" "a_commit" "b_commit" "check_stale"
+permutation "prepare_stale" "b_begin" "b_supersede" "a_begin" "a_first_claim" "b_commit" "a_commit" "check_stale"

package/tests/isolation/specs/session_identity_renew_revoke.spec

@@ -0,0 +1,84 @@
+# Renewal and owner revocation of a real minted/claimed identity, both commit
+# orders. The loser waits on the identity row; revoke-after-renew fences its
+# result, and renew-after-revoke must re-read the tombstone rather than revive it.
+setup
+{
+  grant usage on schema extensions to service_role, authenticated;
+  insert into auth.users(id) values ('81000000-0000-4000-8000-000000000001');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('82000000-0000-4000-8000-000000000001', 'human', 'sid-renew-owner', 'Renew owner', 'active',
+    '81000000-0000-4000-8000-000000000001', null),
+    ('82000000-0000-4000-8000-000000000002', 'agent', 'sid-renew-root', 'Renew root', 'active', null,
+    '81000000-0000-4000-8000-000000000001');
+  insert into agent_board.session_identities(agent_id, root_agent_id, depth, current_risky_digest, approved_risky_digest)
+  values ('82000000-0000-4000-8000-000000000002', '82000000-0000-4000-8000-000000000002', 0, 'approved', 'approved');
+  BEGIN;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  select count(*) from agent_board.upsert_delegation_policy('82000000-0000-4000-8000-000000000002', 'root_minted', '[]', 200, interval '7 days', true);
+  do $$ declare m record; c record; begin
+    select * into m from agent_board.mint_delegated_child('82000000-0000-4000-8000-000000000002', 'sid-renew-child', '[]',
+      public.test_pubkey('sid-renew-child'), interval '1 hour', false, 'claude', 'renew-original', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+    select * into c from agent_board.issue_signing_key_challenge(m.child_agent_id, 'delegated-ephemeral');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      m.signing_key_id, m.child_agent_id, 900, null, 'renew-original');
+  end $$;
+  COMMIT;
+}
+
+teardown
+{
+  do $$ declare v_child uuid; v_auth uuid; begin
+    select id, auth_user_id into v_child, v_auth from agent_board.agents where handle = 'sid-renew-child';
+    update agent_board.session_identities set lease_alias_id = null where agent_id = v_child;
+    delete from agent_board.session_id_aliases where identity_agent_id = v_child;
+    delete from agent_board.session_identities where agent_id = v_child;
+    delete from agent_board.nonfleet_sessions where agent_id = v_child;
+    delete from agent_board.agents where id = v_child;
+    delete from auth.users where id = v_auth;
+    delete from agent_board.session_identities where agent_id = '82000000-0000-4000-8000-000000000002';
+    delete from agent_board.agents where id in ('82000000-0000-4000-8000-000000000001', '82000000-0000-4000-8000-000000000002');
+    delete from auth.users where id = '81000000-0000-4000-8000-000000000001';
+  end $$;
+}
+
+session "renew"
+step "renew_begin" {
+  BEGIN;
+  select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where handle = 'sid-renew-child'), true) is not null as holder_forwarded;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+}
+step "renew" {
+  select agent_board.renew_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'), 'approved');
+}
+step "renew_commit" { COMMIT; }
+
+session "revoke"
+step "revoke_begin" {
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '81000000-0000-4000-8000-000000000001';
+}
+step "revoke" {
+  select agent_board.revoke_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'));
+}
+step "revoke_commit" { COMMIT; }
+
+session "check"
+step "check" {
+  select si.tombstone_reason, si.credential_epoch, a.status, g.revoked_at is not null as grant_revoked,
+    g.last_renewed_at is not null as renewal_preceded_revoke,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations,
+    (select count(*) from agent_board.agent_signing_keys k where k.agent_id = a.id and k.status <> 'revoked') as active_keys
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id
+    join agent_board.delegation_grants g on g.child_agent_id = a.id where a.handle = 'sid-renew-child';
+  select bool_and(expires_at <= issued_at + interval '900 seconds') as bounded_pre_revoke_tokens
+  from agent_board.nonfleet_sessions where agent_id = (select id from agent_board.agents where handle = 'sid-renew-child');
+}
+
+permutation "renew_begin" "renew" "revoke_begin" "revoke" "renew_commit" "revoke_commit" "check"
+permutation "revoke_begin" "revoke" "renew_begin" "renew" "revoke_commit" "renew_commit" "check"