@consiliency/agent-board-schema 1.60.0 → 1.63.0

package/tests/isolation/expected/session_identity_links.out

@@ -0,0 +1,235 @@
+Parsed test spec with 3 sessions
+
+starting permutation: a_begin a_link b_begin b_same a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_same: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a'); <waiting ...>
+step a_commit: COMMIT;
+step b_same: <... completed>
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_commit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      2|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes   |role 
+-----------------+-----
+["read", "write"]|admin
+(1 row)
+
+
+starting permutation: b_begin b_same a_begin a_link b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_same: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a'); <waiting ...>
+step b_commit: COMMIT;
+step a_link: <... completed>
+link_session_alias
+------------------
+                  
+(1 row)
+
+step a_commit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      2|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes   |role 
+-----------------+-----
+["read", "write"]|admin
+(1 row)
+
+
+starting permutation: a_begin a_link b_begin b_other a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_other: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-b'); <waiting ...>
+step a_commit: COMMIT;
+step b_other: <... completed>
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_commit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      3|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes   |role 
+-----------------+-----
+["read", "write"]|admin
+(1 row)
+
+
+starting permutation: a_begin a_link b_begin b_narrow a_commit b_commit a_rebegin a_relink a_recommit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_narrow: 
+  select role from agent_board.grant_board_role('74000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000001', 'observer', '72000000-0000-4000-8000-000000000001');
+  select allowed_scopes from agent_board.upsert_delegation_policy('72000000-0000-4000-8000-000000000001', 'root_minted', '["read"]', 200, interval '8 hours', true);
+ <waiting ...>
+step a_commit: COMMIT;
+step b_narrow: <... completed>
+role    
+--------
+observer
+(1 row)
+
+allowed_scopes
+--------------
+["read"]      
+(1 row)
+
+step b_commit: COMMIT;
+step a_rebegin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_relink: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step a_recommit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      2|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes|role    
+--------------+--------
+["read"]      |observer
+(1 row)
+
+
+starting permutation: b_begin b_narrow a_begin a_link b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_narrow: 
+  select role from agent_board.grant_board_role('74000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000001', 'observer', '72000000-0000-4000-8000-000000000001');
+  select allowed_scopes from agent_board.upsert_delegation_policy('72000000-0000-4000-8000-000000000001', 'root_minted', '["read"]', 200, interval '8 hours', true);
+
+role    
+--------
+observer
+(1 row)
+
+allowed_scopes
+--------------
+["read"]      
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a'); <waiting ...>
+step b_commit: COMMIT;
+step a_link: <... completed>
+link_session_alias
+------------------
+                  
+(1 row)
+
+step a_commit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      2|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes|role    
+--------------+--------
+["read"]      |observer
+(1 row)
+

package/tests/isolation/expected/session_identity_reclaim.out

@@ -0,0 +1,253 @@
+Parsed test spec with 3 sessions
+
+starting permutation: a_begin a_reclaim b_begin b_reclaim a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_reclaim: 
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-a');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000001', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_reclaim: 
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-b');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000002', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+ <waiting ...>
+step a_commit: COMMIT;
+step b_reclaim: <... completed>
+ERROR:  duplicate_live_session
+step b_commit: COMMIT;
+step check: 
+  select credential_epoch, holder_secret_hash <> extensions.digest('old-holder', 'sha256') as rotated_holder,
+    a.session_id as bound_alias
+  from agent_board.session_identities si join agent_board.session_id_aliases a on a.id = si.lease_alias_id
+  where si.agent_id = '75000000-0000-4000-8000-000000000002';
+  select count(*) as tokens from agent_board.nonfleet_sessions where agent_id = '75000000-0000-4000-8000-000000000002';
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '74000000-0000-4000-8000-000000000001';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+  select agent_board.current_agent_id() is null as old_epoch_fenced;
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '1';
+  select agent_board.current_agent_id() = '75000000-0000-4000-8000-000000000002'::uuid as new_epoch_resolves;
+  COMMIT;
+
+credential_epoch|rotated_holder|bound_alias
+----------------+--------------+-----------
+               1|t             |resumed    
+(1 row)
+
+tokens
+------
+     1
+(1 row)
+
+old_epoch_fenced
+----------------
+t               
+(1 row)
+
+new_epoch_resolves
+------------------
+t                 
+(1 row)
+
+
+starting permutation: b_begin b_reclaim a_begin a_reclaim b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_reclaim: 
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-b');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000002', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_reclaim: 
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-a');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000001', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+ <waiting ...>
+step b_commit: COMMIT;
+step a_reclaim: <... completed>
+ERROR:  duplicate_live_session
+step a_commit: COMMIT;
+step check: 
+  select credential_epoch, holder_secret_hash <> extensions.digest('old-holder', 'sha256') as rotated_holder,
+    a.session_id as bound_alias
+  from agent_board.session_identities si join agent_board.session_id_aliases a on a.id = si.lease_alias_id
+  where si.agent_id = '75000000-0000-4000-8000-000000000002';
+  select count(*) as tokens from agent_board.nonfleet_sessions where agent_id = '75000000-0000-4000-8000-000000000002';
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '74000000-0000-4000-8000-000000000001';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+  select agent_board.current_agent_id() is null as old_epoch_fenced;
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '1';
+  select agent_board.current_agent_id() = '75000000-0000-4000-8000-000000000002'::uuid as new_epoch_resolves;
+  COMMIT;
+
+credential_epoch|rotated_holder|bound_alias
+----------------+--------------+-----------
+               1|t             |resumed    
+(1 row)
+
+tokens
+------
+     1
+(1 row)
+
+old_epoch_fenced
+----------------
+t               
+(1 row)
+
+new_epoch_resolves
+------------------
+t                 
+(1 row)
+
+
+starting permutation: prepare_stale a_begin a_first_claim b_begin b_supersede a_commit b_commit check_stale
+step prepare_stale: 
+  update agent_board.agents set owner_user_id = '74000000-0000-4000-8000-000000000001'
+  where id = '75000000-0000-4000-8000-000000000001';
+  BEGIN;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  select count(*) from agent_board.upsert_delegation_policy('75000000-0000-4000-8000-000000000001', 'root_minted', '[]', 200, interval '8 hours', true);
+  do $$ declare m record; begin
+    select * into m from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-old', '[]',
+      public.test_pubkey('sid-stale-old'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+    perform * from agent_board.issue_signing_key_challenge(m.child_agent_id, 'delegated-ephemeral');
+  end $$;
+  COMMIT;
+  update agent_board.session_identities set created_at = now() - interval '181 seconds'
+  where agent_id = (select id from agent_board.agents where handle = 'sid-stale-old');
+
+count
+-----
+    1
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_first_claim: 
+  do $$ declare a uuid; k uuid; c record; begin
+    select id into a from agent_board.agents where handle = 'sid-stale-old';
+    select id into k from agent_board.agent_signing_keys where agent_id = a;
+    select id, challenge_nonce into c from agent_board.agent_signing_key_challenges where agent_id = a order by created_at desc limit 1;
+    perform * from agent_board.mint_fleet_agent_session(c.id, c.challenge_nonce, k, a, 900, null, 'stale-reservation');
+  end $$;
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_supersede: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-new', '[]',
+      public.test_pubkey('sid-stale-new'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+  end $$;
+ <waiting ...>
+step a_commit: COMMIT;
+step b_supersede: <... completed>
+ERROR:  duplicate_live_session
+step b_commit: COMMIT;
+step check_stale: 
+  select a.status, si.tombstone_reason, si.credential_epoch, si.holder_secret_hash is not null as claimed,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id where a.handle = 'sid-stale-old';
+  select a.handle as bound_principal from agent_board.session_id_aliases al join agent_board.agents a on a.id = al.identity_agent_id
+  where al.root_agent_id = '75000000-0000-4000-8000-000000000001' and al.session_id = 'stale-reservation';
+  select count(*) as successor_principals from agent_board.agents where handle = 'sid-stale-new';
+
+status|tombstone_reason|credential_epoch|claimed|permanent_revocations
+------+----------------+----------------+-------+---------------------
+active|                |               0|t      |                    0
+(1 row)
+
+bound_principal
+---------------
+sid-stale-old  
+(1 row)
+
+successor_principals
+--------------------
+                   0
+(1 row)
+
+
+starting permutation: prepare_stale b_begin b_supersede a_begin a_first_claim b_commit a_commit check_stale
+step prepare_stale: 
+  update agent_board.agents set owner_user_id = '74000000-0000-4000-8000-000000000001'
+  where id = '75000000-0000-4000-8000-000000000001';
+  BEGIN;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  select count(*) from agent_board.upsert_delegation_policy('75000000-0000-4000-8000-000000000001', 'root_minted', '[]', 200, interval '8 hours', true);
+  do $$ declare m record; begin
+    select * into m from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-old', '[]',
+      public.test_pubkey('sid-stale-old'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+    perform * from agent_board.issue_signing_key_challenge(m.child_agent_id, 'delegated-ephemeral');
+  end $$;
+  COMMIT;
+  update agent_board.session_identities set created_at = now() - interval '181 seconds'
+  where agent_id = (select id from agent_board.agents where handle = 'sid-stale-old');
+
+count
+-----
+    1
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_supersede: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-new', '[]',
+      public.test_pubkey('sid-stale-new'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+  end $$;
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_first_claim: 
+  do $$ declare a uuid; k uuid; c record; begin
+    select id into a from agent_board.agents where handle = 'sid-stale-old';
+    select id into k from agent_board.agent_signing_keys where agent_id = a;
+    select id, challenge_nonce into c from agent_board.agent_signing_key_challenges where agent_id = a order by created_at desc limit 1;
+    perform * from agent_board.mint_fleet_agent_session(c.id, c.challenge_nonce, k, a, 900, null, 'stale-reservation');
+  end $$;
+ <waiting ...>
+step b_commit: COMMIT;
+step a_first_claim: <... completed>
+ERROR:  identity_tombstoned
+step a_commit: COMMIT;
+step check_stale: 
+  select a.status, si.tombstone_reason, si.credential_epoch, si.holder_secret_hash is not null as claimed,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id where a.handle = 'sid-stale-old';
+  select a.handle as bound_principal from agent_board.session_id_aliases al join agent_board.agents a on a.id = al.identity_agent_id
+  where al.root_agent_id = '75000000-0000-4000-8000-000000000001' and al.session_id = 'stale-reservation';
+  select count(*) as successor_principals from agent_board.agents where handle = 'sid-stale-new';
+
+status |tombstone_reason    |credential_epoch|claimed|permanent_revocations
+-------+--------------------+----------------+-------+---------------------
+revoked|superseded_unclaimed|               1|f      |                    1
+(1 row)
+
+bound_principal
+---------------
+sid-stale-new  
+(1 row)
+
+successor_principals
+--------------------
+                   1
+(1 row)
+

package/tests/isolation/expected/session_identity_renew_revoke.out

@@ -0,0 +1,115 @@
+Parsed test spec with 3 sessions
+
+starting permutation: renew_begin renew revoke_begin revoke renew_commit revoke_commit check
+step renew_begin: 
+  BEGIN;
+  select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where handle = 'sid-renew-child'), true) is not null as holder_forwarded;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+
+holder_forwarded
+----------------
+t               
+(1 row)
+
+step renew: 
+  select agent_board.renew_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'), 'approved');
+
+renew_session_identity
+----------------------
+                      
+(1 row)
+
+step revoke_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '81000000-0000-4000-8000-000000000001';
+
+step revoke: 
+  select agent_board.revoke_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'));
+ <waiting ...>
+step renew_commit: COMMIT;
+step revoke: <... completed>
+revoke_session_identity
+-----------------------
+                       
+(1 row)
+
+step revoke_commit: COMMIT;
+step check: 
+  select si.tombstone_reason, si.credential_epoch, a.status, g.revoked_at is not null as grant_revoked,
+    g.last_renewed_at is not null as renewal_preceded_revoke,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations,
+    (select count(*) from agent_board.agent_signing_keys k where k.agent_id = a.id and k.status <> 'revoked') as active_keys
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id
+    join agent_board.delegation_grants g on g.child_agent_id = a.id where a.handle = 'sid-renew-child';
+  select bool_and(expires_at <= issued_at + interval '900 seconds') as bounded_pre_revoke_tokens
+  from agent_board.nonfleet_sessions where agent_id = (select id from agent_board.agents where handle = 'sid-renew-child');
+
+tombstone_reason|credential_epoch|status |grant_revoked|renewal_preceded_revoke|permanent_revocations|active_keys
+----------------+----------------+-------+-------------+-----------------------+---------------------+-----------
+revoked         |               1|revoked|t            |t                      |                    1|          0
+(1 row)
+
+bounded_pre_revoke_tokens
+-------------------------
+t                        
+(1 row)
+
+
+starting permutation: revoke_begin revoke renew_begin renew revoke_commit renew_commit check
+step revoke_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '81000000-0000-4000-8000-000000000001';
+
+step revoke: 
+  select agent_board.revoke_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'));
+
+revoke_session_identity
+-----------------------
+                       
+(1 row)
+
+step renew_begin: 
+  BEGIN;
+  select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where handle = 'sid-renew-child'), true) is not null as holder_forwarded;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+
+holder_forwarded
+----------------
+t               
+(1 row)
+
+step renew: 
+  select agent_board.renew_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'), 'approved');
+ <waiting ...>
+step revoke_commit: COMMIT;
+step renew: <... completed>
+ERROR:  identity_tombstoned
+step renew_commit: COMMIT;
+step check: 
+  select si.tombstone_reason, si.credential_epoch, a.status, g.revoked_at is not null as grant_revoked,
+    g.last_renewed_at is not null as renewal_preceded_revoke,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations,
+    (select count(*) from agent_board.agent_signing_keys k where k.agent_id = a.id and k.status <> 'revoked') as active_keys
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id
+    join agent_board.delegation_grants g on g.child_agent_id = a.id where a.handle = 'sid-renew-child';
+  select bool_and(expires_at <= issued_at + interval '900 seconds') as bounded_pre_revoke_tokens
+  from agent_board.nonfleet_sessions where agent_id = (select id from agent_board.agents where handle = 'sid-renew-child');
+
+tombstone_reason|credential_epoch|status |grant_revoked|renewal_preceded_revoke|permanent_revocations|active_keys
+----------------+----------------+-------+-------------+-----------------------+---------------------+-----------
+revoked         |               1|revoked|t            |f                      |                    1|          0
+(1 row)
+
+bounded_pre_revoke_tokens
+-------------------------
+t                        
+(1 row)
+