@consiliency/agent-board-schema 1.60.0 → 1.63.0

package/migrations/20261011000100_agent_board_session_identities.sql

@@ -0,0 +1,1964 @@
+-- SIDSCHEMA: durable per-session identities.  Transport attestation is deliberately
+-- not established here: SIDSERVER is the only producer allowed to bind harness
+-- evidence to the optional session arguments below.
+
+create table agent_board.session_identities (
+  agent_id uuid primary key references agent_board.agents(id) on delete cascade,
+  parent_agent_id uuid references agent_board.agents(id),
+  root_agent_id uuid not null references agent_board.agents(id),
+  depth smallint not null check (depth between 0 and 2),
+  identity_kind text not null default 'legacy' check (identity_kind in ('legacy', 'session')),
+  harness text check (harness is null or harness in ('agy', 'claude', 'codex', 'grok', 'opencode', 'pi')),
+  forked_from uuid references agent_board.session_identities(agent_id),
+  readmitted_from uuid references agent_board.session_identities(agent_id),
+  tombstoned_at timestamptz,
+  tombstone_reason text check (tombstone_reason is null or tombstone_reason in ('revoked', 'cascade', 'superseded_unclaimed')),
+  credential_epoch bigint not null default 0 check (credential_epoch >= 0),
+  holder_secret_hash bytea,
+  lease_alias_id uuid,
+  last_heartbeat timestamptz,
+  approved_risky_digest text,
+  current_risky_digest text,
+  recorded_fingerprint jsonb not null default '{}'::jsonb check (jsonb_typeof(recorded_fingerprint) = 'object'),
+  resolution_state text not null default 'active' check (resolution_state in ('active', 'frozen')),
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  check ((identity_kind = 'session') = (harness is not null)),
+  check ((tombstoned_at is null) = (tombstone_reason is null)),
+  check (identity_kind <> 'session' or parent_agent_id is not null)
+);
+
+create table agent_board.session_id_aliases (
+  id uuid primary key default gen_random_uuid(),
+  identity_agent_id uuid not null references agent_board.session_identities(agent_id) on delete cascade,
+  root_agent_id uuid not null references agent_board.agents(id),
+  harness text not null check (harness in ('agy', 'claude', 'codex', 'grok', 'opencode', 'pi')),
+  session_id text not null check (length(session_id) > 0),
+  created_at timestamptz not null default now(),
+  unique (root_agent_id, harness, session_id)
+);
+alter table agent_board.session_identities
+  add constraint session_identities_lease_alias_fkey foreign key (lease_alias_id)
+  references agent_board.session_id_aliases(id) deferrable initially deferred;
+
+-- Existing principals retain their historical behavior.  Delegated legacy children
+-- are represented as depth one but never acquire a session lease implicitly.
+do $$
+declare v_count bigint; v_mismatch record;
+begin
+  with recursive lineage(agent_id, parent_agent_id, root_agent_id, depth) as (
+    select id, parent_agent_id, id, 0 from agent_board.agents where parent_agent_id is null
+    union all
+    select a.id, a.parent_agent_id, l.root_agent_id, l.depth + 1
+      from agent_board.agents a join lineage l on a.parent_agent_id = l.agent_id
+     where l.depth < 3
+  )
+  select count(*) into v_count from lineage where depth > 2;
+  if v_count > 0 then raise exception 'identity_depth_exceeded' using errcode = '23514'; end if;
+  with recursive lineage(agent_id, root_agent_id) as (
+    select id, id from agent_board.agents where parent_agent_id is null
+    union all
+    select a.id, l.root_agent_id from agent_board.agents a join lineage l on a.parent_agent_id = l.agent_id
+  )
+  select a.id, a.root_agent_id as stored_root, l.root_agent_id as computed_root into v_mismatch
+    from lineage l join agent_board.agents a on a.id = l.agent_id
+   where coalesce(a.root_agent_id, a.id) is distinct from l.root_agent_id
+   order by a.id limit 1;
+  if found then
+    raise exception 'session identity backfill lineage mismatch: agent %, stored root %, computed root %',
+      v_mismatch.id, v_mismatch.stored_root, v_mismatch.computed_root using errcode = '23514';
+  end if;
+  with recursive lineage(agent_id, parent_agent_id, root_agent_id, depth) as (
+    select id, parent_agent_id, id, 0 from agent_board.agents where parent_agent_id is null
+    union all
+    select a.id, a.parent_agent_id, l.root_agent_id, l.depth + 1
+      from agent_board.agents a join lineage l on a.parent_agent_id = l.agent_id
+  )
+  insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth)
+  select l.agent_id, l.parent_agent_id, l.root_agent_id, l.depth from lineage l;
+  if (select count(*) from agent_board.session_identities) <> (select count(*) from agent_board.agents) then
+    raise exception 'identity lineage is cyclic or incomplete' using errcode = '23514';
+  end if;
+end;
+$$;
+
+-- Flush the backfill's deferred FK events before indexes, triggers and RLS DDL.
+-- It is the only deferred constraint on the backfilled relation at this point.
+-- Leave every unrelated constraint deferred for following statements in this
+-- same migration-application transaction.
+set constraints agent_board.session_identities_lease_alias_fkey immediate;
+
+create index session_identities_root_active_idx
+  on agent_board.session_identities(root_agent_id, identity_kind, tombstoned_at);
+create index session_identities_parent_idx on agent_board.session_identities(parent_agent_id);
+
+create or replace function agent_board._session_identity_kind_immutable()
+returns trigger language plpgsql security definer set search_path = '' as $$
+begin
+  if new.identity_kind is distinct from old.identity_kind then
+    raise exception 'session identity kind is immutable' using errcode = '42501';
+  end if;
+  if old.holder_secret_hash is not null and new.holder_secret_hash is null then
+    raise exception 'a claimed session lease cannot be cleared' using errcode = '42501';
+  end if;
+  return new;
+end;
+$$;
+drop trigger if exists trg_session_identity_kind_immutable on agent_board.session_identities;
+create trigger trg_session_identity_kind_immutable
+  before update of identity_kind, holder_secret_hash on agent_board.session_identities
+  for each row execute function agent_board._session_identity_kind_immutable();
+revoke all on function agent_board._session_identity_kind_immutable() from public, anon, authenticated;
+grant execute on function agent_board._session_identity_kind_immutable() to service_role;
+comment on function agent_board._session_identity_kind_immutable() is 'Keeps session identity kind immutable and prevents clearing a claimed lease to disable epoch fencing.';
+
+create function agent_board._session_identity_lineage()
+returns trigger language plpgsql security definer set search_path = '' as $$
+declare v_target uuid;
+begin
+  if tg_op = 'DELETE' then v_target := old.agent_id; else v_target := new.agent_id; end if;
+  if exists (
+    select 1 from agent_board.session_identities si
+    join agent_board.agents a on a.id = si.agent_id
+    left join agent_board.session_identities parent on parent.agent_id = si.parent_agent_id
+    where (si.agent_id = v_target or si.parent_agent_id = v_target)
+      and (si.parent_agent_id is distinct from a.parent_agent_id
+        or si.root_agent_id is distinct from coalesce(a.root_agent_id, a.id)
+        or si.depth is distinct from case when si.parent_agent_id is null then 0 else parent.depth + 1 end)
+  ) then raise exception 'session identity lineage mismatch' using errcode = '23514'; end if;
+  return new;
+end;
+$$;
+create constraint trigger trg_session_identity_lineage
+  after insert or update or delete on agent_board.session_identities
+  deferrable initially deferred for each row execute function agent_board._session_identity_lineage();
+revoke all on function agent_board._session_identity_lineage() from public, anon, authenticated;
+grant execute on function agent_board._session_identity_lineage() to service_role;
+comment on function agent_board._session_identity_lineage() is 'Pins identity parent, root and depth to the stored agent lineage; checked at transaction end.';
+
+-- Deferred construction lets explicit session mints supply their session row
+-- before commit, while every legacy constructor receives a lease-free identity.
+create function agent_board._session_identity_agent_lineage()
+returns trigger language plpgsql security definer set search_path = '' as $$
+declare v_root uuid; v_depth integer; v_node record;
+begin
+  if not exists (select 1 from agent_board.agents where id = new.id) then return new; end if;
+  with recursive ancestry(agent_id, parent_agent_id, distance, path, cyclic) as (
+    select a.id, a.parent_agent_id, 0, array[a.id], false from agent_board.agents a where a.id = new.id
+    union all
+    select a.id, a.parent_agent_id, c.distance + 1, c.path || a.id, a.id = any(c.path)
+      from ancestry c join agent_board.agents a on a.id = c.parent_agent_id
+     where not c.cyclic and c.distance < 3
+  )
+  select agent_id, distance into v_root, v_depth from ancestry where parent_agent_id is null and not cyclic;
+  if v_root is null then raise exception 'session identity lineage mismatch' using errcode = '23514'; end if;
+  if v_depth > 2 then raise exception 'identity_depth_exceeded' using errcode = '23514'; end if;
+  for v_node in
+    with recursive ancestry(agent_id, distance) as (
+      select new.id, 0
+      union all
+      select a.parent_agent_id, c.distance + 1 from ancestry c join agent_board.agents a on a.id = c.agent_id
+       where a.parent_agent_id is not null and c.distance < 2
+    )
+    select a.*, v_depth - c.distance as identity_depth from ancestry c join agent_board.agents a on a.id = c.agent_id
+     order by c.distance desc
+  loop
+    if coalesce(v_node.root_agent_id, v_node.id) is distinct from v_root then
+      raise exception 'session identity lineage mismatch' using errcode = '23514';
+    end if;
+    if tg_op = 'INSERT' and v_node.id = new.id and not exists (
+      select 1 from agent_board.session_identities where agent_id = new.id
+    ) then
+      insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth)
+      values (new.id, v_node.parent_agent_id, v_root, v_node.identity_depth);
+    end if;
+    if not exists (select 1 from agent_board.session_identities where agent_id = v_node.id) then
+      raise exception 'session identity lineage mismatch' using errcode = '23514';
+    end if;
+    if exists (select 1 from agent_board.session_identities si where si.agent_id = v_node.id
+      and (si.parent_agent_id is distinct from v_node.parent_agent_id
+        or si.root_agent_id is distinct from v_root or si.depth is distinct from v_node.identity_depth)) then
+      raise exception 'session identity lineage mismatch' using errcode = '23514';
+    end if;
+  end loop;
+  return new;
+end;
+$$;
+create constraint trigger trg_session_identity_agent_lineage
+  after insert or update of parent_agent_id, root_agent_id on agent_board.agents
+  deferrable initially deferred for each row execute function agent_board._session_identity_agent_lineage();
+revoke all on function agent_board._session_identity_agent_lineage() from public, anon, authenticated;
+grant execute on function agent_board._session_identity_agent_lineage() to service_role;
+comment on function agent_board._session_identity_agent_lineage() is 'At commit every legacy constructor gets an identity with no implicit lease or fingerprint approval. Existing explicit session rows retain their immutable kind. Derives depth and root from agents, refuses depth three and cycles, and enforces lineage equality on agent inserts and lineage updates.';
+
+alter table agent_board.session_identities enable row level security;
+alter table agent_board.session_id_aliases enable row level security;
+revoke all on table agent_board.session_identities, agent_board.session_id_aliases from public, anon, authenticated;
+grant select on agent_board.session_identities, agent_board.session_id_aliases to service_role;
+
+-- A session credential is usable only when its epoch claim is current.  Compare
+-- text-to-text so malformed JWT input denies rather than raises.
+create or replace function agent_board.current_agent_id()
+returns uuid language sql stable security definer set search_path = '' as $$
+  with identity_claims as (
+    select coalesce(
+      nullif(current_setting('request.jwt.claim.identity_lease_epoch', true), ''),
+      nullif(nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'identity_lease_epoch', '')
+    ) as lease_epoch,
+    coalesce(
+      nullif(current_setting('request.jwt.claim.agent_credential_id', true), ''),
+      nullif(nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'agent_credential_id', '')
+    ) as credential_id
+  )
+  select a.id
+    from agent_board.agents a cross join identity_claims c
+    left join agent_board.session_identities si on si.agent_id = a.id
+   where a.auth_user_id = auth.uid()
+     and a.status = 'active'
+     and (
+       (c.credential_id is null and not a.is_delegate)
+       or (c.credential_id ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$' and exists (
+         select 1 from agent_board.agent_credentials ac
+          where ac.id::text = lower(c.credential_id) and ac.agent_id = a.id
+            and ac.revoked_at is null and (ac.expires_at is null or ac.expires_at > now())
+       ))
+     )
+     and (si.identity_kind is distinct from 'session' or c.lease_epoch = si.credential_epoch::text)
+   limit 1;
+$$;
+revoke all on function agent_board.current_agent_id() from public;
+grant execute on function agent_board.current_agent_id() to authenticated, service_role;
+comment on function agent_board.current_agent_id() is 'Resolves an active principal, preserves hosted delegates'' mandatory credential claim, and denies a session identity unless identity_lease_epoch from either JWT GUC equals its current stored epoch.';
+
+create or replace function agent_board._session_identity_lease_live(p_identity uuid)
+returns boolean language sql stable security definer set search_path = '' as $$
+  select exists (
+    select 1 from agent_board.session_identities si
+     where si.agent_id = p_identity and si.identity_kind = 'session'
+       and si.tombstoned_at is null and si.holder_secret_hash is not null
+       and si.last_heartbeat > now() - interval '180 seconds'
+  );
+$$;
+revoke all on function agent_board._session_identity_lease_live(uuid) from public, anon, authenticated;
+grant execute on function agent_board._session_identity_lease_live(uuid) to service_role;
+comment on function agent_board._session_identity_lease_live(uuid) is 'A non-tombstoned claimed session lease is live strictly before 180 seconds since its heartbeat.';
+
+create or replace function agent_board.heartbeat_session_identity(p_identity_agent_id uuid)
+returns void language plpgsql security definer set search_path = agent_board, public as $$
+declare v_identity agent_board.session_identities%rowtype;
+begin
+  if agent_board.current_agent_id() is distinct from p_identity_agent_id then
+    raise exception 'identity_lease_not_held' using errcode = '42501';
+  end if;
+  select * into v_identity from agent_board.session_identities where agent_id = p_identity_agent_id for update;
+  if agent_board.current_agent_id() is distinct from p_identity_agent_id then
+    raise exception 'identity_lease_not_held' using errcode = '42501';
+  end if;
+  if v_identity.agent_id is null or not agent_board._session_identity_lease_live(p_identity_agent_id) then
+    raise exception 'identity_lease_lapsed' using errcode = '42501';
+  end if;
+  if v_identity.resolution_state = 'frozen' or v_identity.approved_risky_digest is null
+     or v_identity.current_risky_digest is distinct from v_identity.approved_risky_digest then
+    raise exception 'identity_fingerprint_unapproved' using errcode = '42501';
+  end if;
+  update agent_board.session_identities set last_heartbeat = now(), updated_at = now() where agent_id = p_identity_agent_id;
+end;
+$$;
+revoke all on function agent_board.heartbeat_session_identity(uuid) from public, anon;
+grant execute on function agent_board.heartbeat_session_identity(uuid) to authenticated;
+comment on function agent_board.heartbeat_session_identity(uuid) is 'Current epoch holder refreshes a live session lease only; a lapsed lease must be reclaimed through mint_fleet_agent_session.';
+
+create or replace function agent_board.renew_session_identity(p_identity_agent_id uuid, p_risky_digest text)
+returns void language plpgsql security definer set search_path = agent_board, public as $$
+declare v_identity agent_board.session_identities%rowtype;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'session renewal is service_role-only' using errcode = '42501';
+  end if;
+  perform 1 from agent_board.agents where id = (
+    select root_agent_id from agent_board.session_identities where agent_id = p_identity_agent_id
+  ) for update;
+  select * into v_identity from agent_board.session_identities where agent_id = p_identity_agent_id for update;
+  if v_identity.tombstoned_at is not null then raise exception 'identity_tombstoned' using errcode = '42501'; end if;
+  if agent_board.current_agent_id() is distinct from p_identity_agent_id then raise exception 'identity_lease_not_held' using errcode = '42501'; end if;
+  if v_identity.agent_id is null or not agent_board._session_identity_lease_live(p_identity_agent_id) then raise exception 'identity_lease_lapsed' using errcode = '42501'; end if;
+  if v_identity.resolution_state = 'frozen' or v_identity.approved_risky_digest is null
+     or v_identity.approved_risky_digest is distinct from p_risky_digest
+     or v_identity.current_risky_digest is distinct from v_identity.approved_risky_digest then
+    raise exception 'identity_fingerprint_unapproved' using errcode = '42501';
+  end if;
+  perform * from agent_board.renew_delegated_grant(p_identity_agent_id, interval '7 days');
+  update agent_board.session_identities set current_risky_digest = p_risky_digest, last_heartbeat = now(), updated_at = now() where agent_id = p_identity_agent_id;
+end;
+$$;
+revoke all on function agent_board.renew_session_identity(uuid, text) from public, anon, authenticated;
+grant execute on function agent_board.renew_session_identity(uuid, text) to service_role;
+comment on function agent_board.renew_session_identity(uuid, text) is 'Service-only fresh-fingerprint renewal; SIDSERVER must bind the reading and forward the verified holder subject and epoch. Extends the same live identity grant by at most seven days, current ancestor authority and tighter operator policy; never rotates the holder or revives a tombstone.';
+
+create function agent_board.link_session_alias(
+  p_identity_agent_id uuid,
+  p_identity_lease_epoch text,
+  p_session_id text
+)
+returns void language plpgsql security definer set search_path = agent_board, public as $$
+declare v_identity agent_board.session_identities%rowtype;
+  v_root uuid; v_board uuid; v_locked_boards uuid[] := '{}'; v_subject record;
+  v_membership agent_board.board_memberships%rowtype; v_allowed jsonb;
+  v_parent_role text; v_role text;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'link_session_alias is service_role-only' using errcode = '42501';
+  end if;
+  -- Board mutexes precede the root and deterministic identity/alias row locks.
+  select root_agent_id into v_root from agent_board.session_identities where agent_id = p_identity_agent_id;
+  for v_board in
+    with recursive children(agent_id) as (
+      select p_identity_agent_id union all
+      select si.agent_id from agent_board.session_identities si join children c on si.parent_agent_id = c.agent_id
+    )
+    select distinct bm.board_id from agent_board.board_memberships bm join children c on c.agent_id = bm.agent_id order by 1
+  loop
+    perform agent_board._lock_board_authority_ceiling(v_board);
+    v_locked_boards := array_append(v_locked_boards, v_board);
+  end loop;
+  perform 1 from agent_board.agents where id = v_root for update;
+  perform 1 from agent_board.session_identities where agent_id in (
+    with recursive children(agent_id) as (
+      select p_identity_agent_id union all
+      select si.agent_id from agent_board.session_identities si join children c on si.parent_agent_id = c.agent_id
+    ) select agent_id from children
+  ) order by agent_id for update;
+  select * into v_identity from agent_board.session_identities where agent_id = p_identity_agent_id for update;
+  if not found or v_identity.identity_kind <> 'session' then raise exception 'identity_lease_not_held' using errcode = '42501'; end if;
+  if not exists (select 1 from agent_board.agents a where a.id = p_identity_agent_id
+    and a.auth_user_id = auth.uid() and a.status = 'active') then
+    raise exception 'identity_lease_not_held' using errcode = '42501';
+  end if;
+  if p_identity_lease_epoch is distinct from v_identity.credential_epoch::text then raise exception 'identity_lease_not_held' using errcode = '42501'; end if;
+  if not agent_board._session_identity_lease_live(v_identity.agent_id) then raise exception 'identity_lease_lapsed' using errcode = '42501'; end if;
+  if v_identity.resolution_state = 'frozen' or v_identity.approved_risky_digest is null
+     or v_identity.current_risky_digest is distinct from v_identity.approved_risky_digest then
+    raise exception 'identity_fingerprint_unapproved' using errcode = '42501';
+  end if;
+  perform agent_board._session_identity_ancestor_ceiling(v_identity.parent_agent_id);
+  if p_session_id is null or length(p_session_id) = 0 then raise exception 'unattributed_session_refused' using errcode = '22023'; end if;
+  if exists (
+    select 1 from agent_board.session_id_aliases a
+     where a.root_agent_id = v_identity.root_agent_id
+       and a.harness = v_identity.harness
+       and a.session_id = p_session_id
+       and a.identity_agent_id <> v_identity.agent_id
+  ) then raise exception 'identity_continuity_refused' using errcode = '42501'; end if;
+  if not exists (
+    select 1 from agent_board.session_id_aliases a
+     where a.identity_agent_id = v_identity.agent_id and a.session_id = p_session_id
+  ) and v_identity.harness <> 'claude' then
+    raise exception 'identity_continuity_refused' using errcode = '42501';
+  end if;
+  -- Re-read current authority, parent before descendant. No parent authority can
+  -- add to the subject's stored grant, role or currently active room set.
+  for v_subject in
+    with recursive children(agent_id) as (
+      select p_identity_agent_id union all
+      select si.agent_id from agent_board.session_identities si join children c on si.parent_agent_id = c.agent_id
+    ) select si.* from agent_board.session_identities si join children c on c.agent_id = si.agent_id
+      order by si.depth, si.agent_id
+  loop
+    perform agent_board._refuse_delegate_membership_target(v_subject.agent_id, 'link_session_alias');
+    if exists (select 1 from agent_board.board_memberships bm where bm.agent_id = v_subject.agent_id
+      and not (bm.board_id = any(v_locked_boards))) then
+      raise exception 'identity authority changed during link; retry' using errcode = '40001';
+    end if;
+    if exists (select 1 from agent_board.agents a where a.id = v_subject.parent_agent_id and a.parent_agent_id is null) then
+      select dp.allowed_scopes into v_allowed from agent_board.delegation_policies dp
+        where dp.root_agent_id = v_root and dp.revoked_at is null order by dp.created_at desc, dp.id desc limit 1;
+    else
+      select g.granted_scopes into v_allowed from agent_board.delegation_grants g where g.child_agent_id = v_subject.parent_agent_id;
+    end if;
+    update agent_board.delegation_grants g
+       set granted_scopes = (select coalesce(jsonb_agg(s.value), '[]'::jsonb)
+         from jsonb_array_elements(g.granted_scopes) s where coalesce(v_allowed, '[]'::jsonb) @> jsonb_build_array(s.value))
+     where g.child_agent_id = v_subject.agent_id;
+    for v_membership in select bm.* from agent_board.board_memberships bm
+      where bm.agent_id = v_subject.agent_id and bm.membership_state in ('joined', 'subscribed')
+      order by bm.board_id, bm.id for update
+    loop
+      select bm.role into v_parent_role from agent_board.board_memberships bm
+       where bm.agent_id = v_subject.parent_agent_id and bm.board_id = v_membership.board_id
+         and bm.membership_state in ('joined', 'subscribed')
+       order by agent_board._role_rank(bm.role) desc, bm.created_at desc, bm.id desc limit 1;
+      v_role := null;
+      if v_parent_role is not null then
+        select r into v_role from unnest(array['owner', 'admin', 'member', 'observer']) r
+         where agent_board._role_rank(r) <= agent_board._role_rank(v_membership.role)
+           and agent_board._role_rank(r) <= agent_board._role_rank(v_parent_role)
+           and agent_board._grant_within_ceiling(v_subject.parent_agent_id, v_membership.board_id, r)
+         order by agent_board._role_rank(r) desc limit 1;
+      end if;
+      if v_role is null then
+        perform agent_board._upsert_board_membership_state(v_membership.board_id, v_subject.agent_id,
+          'removed', null, '{}'::jsonb, v_membership.id);
+      elsif v_role is distinct from v_membership.role then
+        update agent_board.board_memberships set role = v_role where id = v_membership.id;
+      end if;
+    end loop;
+  end loop;
+  perform 1 from agent_board.session_id_aliases a where a.root_agent_id = v_identity.root_agent_id
+    and a.harness = v_identity.harness and a.session_id = p_session_id for update;
+  insert into agent_board.session_id_aliases(identity_agent_id, root_agent_id, harness, session_id)
+  values (v_identity.agent_id, v_identity.root_agent_id, v_identity.harness, p_session_id)
+  on conflict (root_agent_id, harness, session_id) do nothing;
+  update agent_board.session_identities
+     set lease_alias_id = (select a.id from agent_board.session_id_aliases a
+       where a.identity_agent_id = v_identity.agent_id and a.session_id = p_session_id), updated_at = now()
+   where agent_id = v_identity.agent_id;
+  perform agent_board._assert_actor_not_fleet_revoked(p_identity_agent_id, 'link_session_alias');
+end;
+$$;
+revoke all on function agent_board.link_session_alias(uuid, text, text) from public, anon, authenticated;
+grant execute on function agent_board.link_session_alias(uuid, text, text) to service_role;
+comment on function agent_board.link_session_alias(uuid, text, text) is 'Service-only continuity alias link: SIDSERVER forwards the verified holder subject, identity, epoch and measured id. Board mutexes precede root and deterministic identity/alias locks. Rechecks live lease, approved digest and ancestors; scopes, active rooms and roles only shrink, parent before descendants, through the consent sink for removals. A concurrent newly added room refuses 40001 for a safe retry. The latest binding is recorded even for an existing alias; only Claude may add a new id.';
+
+-- Every session-form issuer walks the stored lineage, not a caller's root or
+-- the child's self-written policy. Legacy API calls retain their original gate.
+create function agent_board._session_identity_ancestor_ceiling(p_agent_id uuid)
+returns timestamptz language plpgsql security definer set search_path = '' as $$
+declare v_ancestor record; v_expires timestamptz := 'infinity';
+begin
+  for v_ancestor in
+    with recursive lineage as (
+      select a.id, a.parent_agent_id from agent_board.agents a where a.id = p_agent_id
+      union all
+      select a.id, a.parent_agent_id from agent_board.agents a join lineage l on a.id = l.parent_agent_id
+    )
+    select a.id, a.status, si.identity_kind, si.tombstoned_at, si.resolution_state,
+           si.current_risky_digest, si.approved_risky_digest,
+           g.id as grant_id, g.revoked_at, g.grant_expires_at, dp.revoked_at as policy_revoked_at
+      from lineage l join agent_board.agents a on a.id = l.id
+      left join agent_board.session_identities si on si.agent_id = a.id
+      left join agent_board.delegation_grants g on g.child_agent_id = a.id
+      left join agent_board.delegation_policies dp on dp.id = g.delegation_policy_id
+  loop
+    if agent_board._actor_fleet_revoked(v_ancestor.id) then
+      raise exception 'identity_parent_inactive' using errcode = '42501';
+    end if;
+    if v_ancestor.status <> 'active' or v_ancestor.tombstoned_at is not null then
+      raise exception 'identity_parent_inactive' using errcode = '42501';
+    end if;
+    if v_ancestor.grant_id is not null and (v_ancestor.revoked_at is not null
+       or v_ancestor.policy_revoked_at is not null or v_ancestor.grant_expires_at <= now()) then
+      raise exception 'identity_parent_inactive' using errcode = '42501';
+    end if;
+    if v_ancestor.resolution_state = 'frozen' or (v_ancestor.identity_kind = 'session'
+       and (v_ancestor.approved_risky_digest is null
+         or v_ancestor.current_risky_digest is distinct from v_ancestor.approved_risky_digest)) then
+      raise exception 'identity_fingerprint_unapproved' using errcode = '42501';
+    end if;
+    v_expires := least(v_expires, v_ancestor.grant_expires_at);
+  end loop;
+  return v_expires;
+end;
+$$;
+revoke all on function agent_board._session_identity_ancestor_ceiling(uuid) from public, anon, authenticated, service_role;
+comment on function agent_board._session_identity_ancestor_ceiling(uuid) is 'Internal session-form ancestor gate: every stored ancestor must be active, unrevoked, unexpired and non-frozen; returns the tightest grant expiry.';
+
+create function agent_board._session_identity_check_limits(p_root uuid, p_parent uuid, p_reactivation uuid default null)
+returns void language plpgsql security definer set search_path = '' as $$
+declare v_active bigint; v_hourly bigint; v_parent_depth smallint; v_policy_limit int;
+begin
+  -- Caller has already locked the true root; count both depths and legacy grants.
+  select count(*) into v_active
+    from agent_board.delegation_grants g
+    join agent_board.agents a on a.id = g.child_agent_id
+    left join agent_board.session_identities si on si.agent_id = a.id
+   where g.root_agent_id = p_root and a.status = 'active' and g.revoked_at is null
+     and g.grant_expires_at > now() and a.id is distinct from p_reactivation
+     and (si.identity_kind is distinct from 'session' or agent_board._session_identity_lease_live(a.id));
+  select count(*) into v_hourly from agent_board.delegation_grants g
+   where g.root_agent_id = p_root and g.created_at > now() - interval '3600 seconds';
+  if v_active >= 200 then raise exception 'identity_limit_active_exceeded' using errcode = '42501'; end if;
+  select least(coalesce(dp.max_active_children, 200), coalesce(dp.operator_max_active_children, 200), 200)
+    into v_policy_limit from agent_board.delegation_policies dp
+   where dp.root_agent_id = p_root and dp.revoked_at is null
+   order by dp.created_at desc, dp.id desc limit 1;
+  if v_active >= v_policy_limit then
+    raise exception 'max_active_children: root has reached its active delegated-child ceiling' using errcode = '42501';
+  end if;
+  if p_reactivation is null and v_hourly >= 60 then raise exception 'identity_limit_hourly_exceeded' using errcode = '42501'; end if;
+  select depth into v_parent_depth from agent_board.session_identities where agent_id = p_parent;
+  if v_parent_depth = 1 then
+    select count(*) into v_active
+      from agent_board.delegation_grants g join agent_board.agents a on a.id = g.child_agent_id
+      left join agent_board.session_identities si on si.agent_id = a.id
+     where g.parent_agent_id = p_parent and a.status = 'active' and g.revoked_at is null
+       and g.grant_expires_at > now() and a.id is distinct from p_reactivation
+       and (si.identity_kind is distinct from 'session' or agent_board._session_identity_lease_live(a.id));
+    select count(*) into v_hourly from agent_board.delegation_grants
+     where parent_agent_id = p_parent and created_at > now() - interval '3600 seconds';
+    if v_active >= 20 then raise exception 'identity_limit_active_exceeded' using errcode = '42501'; end if;
+    if p_reactivation is null and v_hourly >= 10 then raise exception 'identity_limit_hourly_exceeded' using errcode = '42501'; end if;
+  end if;
+end;
+$$;
+revoke all on function agent_board._session_identity_check_limits(uuid, uuid, uuid) from public, anon, authenticated, service_role;
+comment on function agent_board._session_identity_check_limits(uuid, uuid, uuid) is 'Internal root-locked descendant-wide mixed legacy/session census: 200/60 per root and 20/10 per depth-one parent; unclaimed sessions are hourly-only and tombstoned mints remain in the rolling hour.';
+
+create or replace function agent_board.upsert_delegation_policy(
+  p_root_agent_id uuid, p_mode text default 'root_minted', p_allowed_scopes jsonb default null,
+  p_max_active_children int default null, p_child_ttl_ceiling interval default null,
+  p_require_child_signing_key boolean default null
+)
+returns agent_board.delegation_policies language plpgsql security definer set search_path = agent_board, public as $$
+declare
+  v_actor uuid := agent_board._resolved_actor_agent_id(p_root_agent_id, 'p_root_agent_id');
+  v_is_service boolean := agent_board._is_service_role();
+  v_max int; v_ttl interval := coalesce(p_child_ttl_ceiling, interval '8 hours');
+  v_operator_max int; v_operator_ttl interval;
+  v_existing agent_board.delegation_policies%rowtype;
+  v_policy agent_board.delegation_policies%rowtype;
+begin
+  perform 1 from agent_board.agents where id = v_actor for update;
+  if not found then raise exception 'root agent not found' using errcode = 'P0002'; end if;
+  perform pg_advisory_xact_lock(hashtext('agent_board.delegation_policy:' || v_actor::text));
+  if p_mode is not null and p_mode not in ('independent_auth', 'root_minted') then
+    raise exception 'invalid delegation policy mode' using errcode = '22023';
+  end if;
+  if v_ttl <= interval '0' then raise exception 'child_ttl_ceiling must be positive' using errcode = '22023'; end if;
+  v_max := case when v_is_service then p_max_active_children else coalesce(p_max_active_children, 5) end;
+  if not v_is_service then
+    if v_max < 1 or v_max > 200 then
+      raise exception 'max_active_children must be between 1 and 200 for self-service delegation policies' using errcode = '22023';
+    end if;
+    if v_ttl > interval '24 hours' then
+      raise exception 'child_ttl_ceiling may not exceed 24 hours for self-service delegation policies' using errcode = '22023';
+    end if;
+  end if;
+  select * into v_existing from agent_board.delegation_policies dp
+   where dp.root_agent_id = v_actor and dp.revoked_at is null
+   order by dp.created_at desc, dp.id desc limit 1 for update;
+  v_operator_max := case when v_is_service then v_max else v_existing.operator_max_active_children end;
+  v_operator_ttl := case when v_is_service then v_ttl else v_existing.operator_child_ttl_ceiling end;
+  if v_existing.id is not null then
+    update agent_board.delegation_policies dp
+       set mode = coalesce(p_mode, 'root_minted'), max_depth = 2, max_active_children = v_max,
+           allowed_scopes = coalesce(p_allowed_scopes, '[]'::jsonb), child_ttl_ceiling = v_ttl,
+           require_child_signing_key = case when v_is_service then coalesce(p_require_child_signing_key, true) else true end,
+           scope_attestation = case when v_is_service then 'operator_vetted' else 'self_declared' end,
+           operator_max_active_children = v_operator_max, operator_child_ttl_ceiling = v_operator_ttl
+     where dp.id = v_existing.id returning * into v_policy;
+  else
+    insert into agent_board.delegation_policies(root_agent_id, mode, max_depth, max_active_children, allowed_scopes,
+      child_ttl_ceiling, require_child_signing_key, scope_attestation, operator_max_active_children, operator_child_ttl_ceiling)
+    values (v_actor, coalesce(p_mode, 'root_minted'), 2, v_max, coalesce(p_allowed_scopes, '[]'::jsonb), v_ttl,
+      case when v_is_service then coalesce(p_require_child_signing_key, true) else true end,
+      case when v_is_service then 'operator_vetted' else 'self_declared' end, v_operator_max, v_operator_ttl)
+    returning * into v_policy;
+  end if;
+  return v_policy;
+end;
+$$;
+revoke all on function agent_board.upsert_delegation_policy(uuid, text, jsonb, int, interval, boolean) from public, anon;
+grant execute on function agent_board.upsert_delegation_policy(uuid, text, jsonb, int, interval, boolean) to authenticated, service_role;
+comment on function agent_board.upsert_delegation_policy(uuid, text, jsonb, int, interval, boolean) is 'Sole delegation-policy writer, serialized with mint and reactivation on the root. Self-service actor is session-derived, max children is 1..200, depth is two, keys are required and unattributed TTL stays <=24h. Operator writes establish durable ceilings; self-service preserves them.';
+
+create or replace function agent_board.renew_delegated_grant(p_child_agent_id uuid, p_extend interval default null)
+returns table(grant_expires_at timestamptz) language plpgsql security definer set search_path = agent_board, public as $$
+declare
+  v_grant agent_board.delegation_grants%rowtype;
+  v_policy agent_board.delegation_policies%rowtype;
+  v_identity agent_board.session_identities%rowtype;
+  v_root uuid; v_ceiling interval; v_ancestor_expires timestamptz; v_new_expires_at timestamptz;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'renew_delegated_grant is service_role-only' using errcode = '42501';
+  end if;
+  if p_extend <= interval '0' then raise exception 'non_positive_ttl: requested grant TTL must be positive' using errcode = '22023'; end if;
+  select g.root_agent_id into v_root from agent_board.delegation_grants g where g.child_agent_id = p_child_agent_id;
+  perform 1 from agent_board.agents where id = v_root for update;
+  select * into v_identity from agent_board.session_identities where agent_id = p_child_agent_id for update;
+  if v_identity.identity_kind = 'session' then
+    if v_identity.tombstoned_at is not null then raise exception 'identity_tombstoned' using errcode = '42501'; end if;
+    if v_identity.resolution_state = 'frozen' or v_identity.approved_risky_digest is null
+       or v_identity.current_risky_digest is distinct from v_identity.approved_risky_digest then
+      raise exception 'identity_fingerprint_unapproved' using errcode = '42501';
+    end if;
+    if agent_board.current_agent_id() is distinct from p_child_agent_id then raise exception 'identity_lease_not_held' using errcode = '42501'; end if;
+    if not agent_board._session_identity_lease_live(p_child_agent_id) then raise exception 'identity_lease_lapsed' using errcode = '42501'; end if;
+  end if;
+  select * into v_grant from agent_board.delegation_grants g where g.child_agent_id = p_child_agent_id for update;
+  if not found then raise exception 'delegation grant not found for child' using errcode = 'P0002'; end if;
+  if v_grant.revoked_at is not null then raise exception 'grant_revoked: cannot renew a revoked delegation grant' using errcode = '42501'; end if;
+  select * into v_policy from agent_board.delegation_policies dp where dp.id = v_grant.delegation_policy_id;
+  if not found or v_policy.revoked_at is not null then
+    raise exception 'policy_revoked: the root delegation policy is revoked' using errcode = '42501';
+  end if;
+  if not agent_board._agent_principal_active(v_grant.root_agent_id) then
+    raise exception 'principal_inactive: root agent principal is not active; grant cannot outlive its root' using errcode = '42501';
+  end if;
+  v_ancestor_expires := agent_board._session_identity_ancestor_ceiling(v_grant.parent_agent_id);
+  if v_grant.grant_expires_at <= now() or v_identity.identity_kind = 'session' then
+    perform agent_board._session_identity_check_limits(v_grant.root_agent_id, v_grant.parent_agent_id, p_child_agent_id);
+  end if;
+  v_ceiling := least(v_policy.child_ttl_ceiling, v_policy.operator_child_ttl_ceiling);
+  if v_identity.identity_kind = 'session' then v_ceiling := least(v_ceiling, interval '7 days');
+  elsif v_policy.scope_attestation = 'self_declared' then v_ceiling := least(v_ceiling, interval '24 hours'); end if;
+  v_new_expires_at := least(now() + least(coalesce(p_extend, v_ceiling), v_ceiling), v_ancestor_expires);
+  update agent_board.delegation_grants set grant_expires_at = v_new_expires_at, last_renewed_at = now()
+   where child_agent_id = p_child_agent_id;
+  return query select v_new_expires_at;
+end;
+$$;
+revoke all on function agent_board.renew_delegated_grant(uuid, interval) from public, anon, authenticated;
+grant execute on function agent_board.renew_delegated_grant(uuid, interval) to service_role;
+comment on function agent_board.renew_delegated_grant(uuid, interval) is 'Service-role renewal under root then identity and grant locks. Every path honors durable operator TTL, all ancestor authority and expired-renew active recount. Session identities additionally require the verified current-epoch live holder and approved unchanged fingerprint, with a seven-day bound; legacy self-declared grants retain 24h and operator legacy grants retain their bounded latitude.';
+
+drop function agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean);
+
+create function agent_board.mint_delegated_child(
+  p_root_agent_id uuid, p_child_slug text, p_requested_scopes jsonb,
+  p_child_public_key text default null, p_ttl interval default null, p_self_service boolean default false,
+  p_session_harness text default null, p_session_id text default null, p_minter_lease_epoch text default null,
+  p_requested_rooms jsonb default '[]'::jsonb, p_fingerprint jsonb default null, p_forked_from uuid default null
+) returns table(child_agent_id uuid, grant_expires_at timestamptz, signing_key_id uuid)
+language plpgsql security definer set search_path = agent_board, public as $$
+declare
+  v_minter agent_board.session_identities%rowtype;
+  v_root agent_board.agents%rowtype;
+  v_policy agent_board.delegation_policies%rowtype;
+  v_true_root uuid;
+  v_depth smallint;
+  v_allowed jsonb;
+  v_requested jsonb := coalesce(p_requested_scopes, '[]'::jsonb);
+  v_child_id uuid;
+  v_key_id uuid;
+  v_child_auth uuid;
+  v_slug text;
+  v_ceiling interval;
+  v_ancestor_expires timestamptz := 'infinity';
+  v_expires timestamptz;
+  v_room jsonb;
+  v_board uuid;
+  v_role text;
+  v_parent_role text;
+  v_membership agent_board.board_memberships%rowtype;
+  v_approved text;
+  v_reserved agent_board.session_identities%rowtype;
+  v_reserved_id uuid;
+  v_reserved_alias uuid;
+  v_owner uuid;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'mint_delegated_child is service_role-only' using errcode = '42501';
+  end if;
+  if p_ttl is not null and p_ttl <= interval '0' then
+    raise exception 'non_positive_ttl: requested grant TTL must be positive' using errcode = '22023';
+  end if;
+  v_slug := agent_board._normalize_provision_slug(p_child_slug);
+  select coalesce(a.root_agent_id, a.id) into v_true_root from agent_board.agents a where a.id = p_root_agent_id;
+  if not found then raise exception 'root agent not found' using errcode = 'P0002'; end if;
+  -- Board mutexes precede agent and membership row locks, as in grant_board_role.
+  if jsonb_typeof(coalesce(p_requested_rooms, '[]'::jsonb)) <> 'array'
+     or jsonb_typeof(v_requested) <> 'array' then
+    raise exception 'rooms and scopes must be arrays' using errcode = '22023';
+  end if;
+  for v_board in select distinct (r ->> 'board_id')::uuid
+      from jsonb_array_elements(coalesce(p_requested_rooms, '[]'::jsonb)) r order by 1 loop
+    perform agent_board._lock_board_authority_ceiling(v_board);
+    perform 1 from agent_board.boards where id = v_board for key share;
+  end loop;
+  select owner_user_id into v_owner from agent_board.agents where id = p_root_agent_id;
+  perform 1 from auth.users where id = v_owner for key share;
+  perform 1 from agent_board.agents where id = v_true_root for update;
+  select * into v_root from agent_board.agents where id = p_root_agent_id;
+  if v_root.owner_user_id is distinct from v_owner then
+    raise exception 'identity owner changed during mint; retry' using errcode = '40001';
+  end if;
+  select * into v_minter from agent_board.session_identities where agent_id = p_root_agent_id for update;
+  v_depth := coalesce(v_minter.depth, case when v_root.parent_agent_id is null then 0 else 1 end);
+  if v_minter.tombstoned_at is not null then raise exception 'identity_tombstoned' using errcode = '42501'; end if;
+  if exists (
+    with recursive ancestry(id, parent_agent_id) as (
+      select id, parent_agent_id from agent_board.agents where id = p_root_agent_id
+      union all
+      select a.id, a.parent_agent_id from agent_board.agents a join ancestry c on a.id = c.parent_agent_id
+    )
+    select 1 from ancestry a join agent_board.session_identities si on si.agent_id = a.id
+     where si.resolution_state = 'frozen'
+  ) then raise exception 'identity_fingerprint_unapproved' using errcode = '42501'; end if;
+  if v_minter.identity_kind = 'session' and p_minter_lease_epoch is distinct from v_minter.credential_epoch::text then
+    raise exception 'identity_lease_not_held' using errcode = '42501';
+  end if;
+  if (p_session_harness is null) <> (p_session_id is null) then
+    raise exception 'unattributed_session_refused' using errcode = '22023';
+  end if;
+  if p_session_harness is null then
+    if v_root.parent_agent_id is not null or exists (select 1 from agent_board.delegation_grants g where g.child_agent_id = p_root_agent_id) then
+      raise exception 'max_depth: only a true lineage root may mint (no transitive delegation)' using errcode = '42501';
+    end if;
+    if jsonb_array_length(coalesce(p_requested_rooms, '[]'::jsonb)) <> 0
+       or p_fingerprint is not null or p_forked_from is not null then
+      raise exception 'unattributed_session_refused' using errcode = '22023';
+    end if;
+  else
+    if p_session_harness not in ('agy', 'claude', 'codex', 'grok', 'opencode', 'pi') or length(p_session_id) = 0 then
+      raise exception 'unattributed_session_refused' using errcode = '22023';
+    end if;
+    if v_depth >= 2 then raise exception 'identity_depth_exceeded' using errcode = '42501'; end if;
+    if v_depth = 1 and v_minter.identity_kind <> 'session' then
+      raise exception 'unattributed_session_refused' using errcode = '42501';
+    end if;
+    v_ancestor_expires := agent_board._session_identity_ancestor_ceiling(p_root_agent_id);
+    if p_forked_from is not null and not exists (
+      select 1 from agent_board.session_identities si
+       where si.agent_id = p_forked_from and si.identity_kind = 'session'
+         and si.root_agent_id = v_true_root and si.parent_agent_id = p_root_agent_id and si.tombstoned_at is null
+    ) then raise exception 'identity_tombstoned' using errcode = '42501'; end if;
+  end if;
+  select * into v_policy from agent_board.delegation_policies dp
+   where dp.root_agent_id = v_true_root and dp.revoked_at is null
+   order by dp.created_at desc, dp.id desc limit 1 for update;
+  if not found then raise exception 'no active delegation policy for root agent' using errcode = '42501'; end if;
+  if v_policy.mode <> 'root_minted' then
+    raise exception 'delegation policy mode is not root_minted (independent_auth children self-provision)' using errcode = '42501';
+  end if;
+  if not agent_board._agent_principal_active(p_root_agent_id) then
+    raise exception 'principal_inactive: root agent principal is not fully active' using errcode = '42501';
+  end if;
+  v_allowed := coalesce(v_policy.allowed_scopes, '[]'::jsonb);
+  if v_depth > 0 then
+    select g.granted_scopes into v_allowed from agent_board.delegation_grants g where g.child_agent_id = p_root_agent_id;
+  end if;
+  if not (coalesce(v_allowed, '[]'::jsonb) @> v_requested) then
+    raise exception 'scope_exceeded: requested scopes are not a subset of the root allowed_scopes' using errcode = '42501';
+  end if;
+  if p_session_harness is not null then
+    -- Match issuance/readmission: lock an existing alias before any supersede
+    -- revocation can acquire its old principal's keys or credentials.
+    perform 1 from agent_board.session_id_aliases
+     where root_agent_id = v_true_root and harness = p_session_harness and session_id = p_session_id
+     order by id for update;
+    select a.identity_agent_id, a.id into v_reserved_id, v_reserved_alias
+      from agent_board.session_id_aliases a
+      join agent_board.session_identities si on si.agent_id = a.identity_agent_id
+     where a.root_agent_id = coalesce(v_minter.root_agent_id, p_root_agent_id)
+       and a.harness = p_session_harness and a.session_id = p_session_id
+     for update of si;
+    if found then
+      select * into v_reserved from agent_board.session_identities
+       where agent_id = v_reserved_id;
+      if v_reserved.tombstoned_at is not null then
+        raise exception 'identity_tombstoned' using errcode = '42501';
+      elsif v_reserved.holder_secret_hash is not null and v_reserved.last_heartbeat > now() - interval '180 seconds' then
+        raise exception 'duplicate_live_session' using errcode = '42501';
+      elsif v_reserved.holder_secret_hash is null and v_reserved.created_at > now() - interval '180 seconds' then
+        raise exception 'identity_lease_live' using errcode = '42501';
+      elsif v_reserved.holder_secret_hash is not null then
+        raise exception 'identity_lease_lapsed' using errcode = '42501';
+      end if;
+      perform agent_board._revoke_agent_principal(v_reserved.agent_id, p_root_agent_id, 'superseded_unclaimed');
+      update agent_board.session_identities
+         set tombstoned_at = now(), tombstone_reason = 'superseded_unclaimed', updated_at = now()
+       where agent_id = v_reserved.agent_id;
+    end if;
+  end if;
+  perform agent_board._session_identity_check_limits(v_true_root, p_root_agent_id);
+  if p_fingerprint is not null then
+    if jsonb_typeof(p_fingerprint) <> 'object' or p_fingerprint ->> 'resolution' is distinct from 'resolved'
+       or nullif(p_fingerprint ->> 'risky_digest', '') is null then
+      raise exception 'identity_fingerprint_unapproved' using errcode = '42501';
+    end if;
+    if v_minter.resolution_state = 'active' and v_minter.approved_risky_digest = p_fingerprint ->> 'risky_digest'
+       and v_minter.approved_risky_digest = v_minter.current_risky_digest then
+      v_approved := v_minter.approved_risky_digest;
+    end if;
+  end if;
+  v_ceiling := least(v_policy.child_ttl_ceiling,
+    v_policy.operator_child_ttl_ceiling,
+    case when p_session_harness is null and not p_self_service then null
+         when p_session_harness is null or v_approved is null then interval '24 hours' else interval '7 days' end);
+  v_expires := least(now() + least(coalesce(p_ttl, v_ceiling), v_ceiling), v_ancestor_expires);
+  v_child_auth := agent_board._ensure_agent_auth_user(v_slug);
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status,
+    auth_user_id, owner_user_id, parent_agent_id, root_agent_id, metadata)
+  values ('agent', 'agent'::agent_board.agent_kind, v_slug, agent_board._default_provision_display_name(v_slug), 'active',
+    v_child_auth, v_root.owner_user_id, p_root_agent_id, v_true_root,
+    jsonb_build_object('delegatedByRootAgentId', v_true_root, 'grantedScopes', v_requested)) returning id into v_child_id;
+  if v_policy.require_child_signing_key or p_session_harness is not null then
+    if p_child_public_key is null then
+      raise exception 'a child public key is required when the delegation policy requires a signing key' using errcode = '22023';
+    end if;
+    if p_child_public_key !~ '^[A-Za-z0-9_-]{43}$' then
+      raise exception 'malformed child public key: expected a 43-char base64url raw Ed25519 key' using errcode = '22023';
+    end if;
+    if p_child_public_key = repeat('A', 43) then
+      raise exception 'child public key is the all-zero small-order placeholder and is rejected' using errcode = '22023';
+    end if;
+    insert into agent_board.agent_signing_keys(id, agent_id, key_id, key_version, public_key, public_key_format,
+      fingerprint, status, proof_state, metadata)
+    values (gen_random_uuid(), v_child_id, 'delegated-ephemeral', 1, p_child_public_key, 'raw_ed25519_base64url',
+      agent_board._raw_key_fingerprint(p_child_public_key), 'active', 'proven',
+      jsonb_build_object('ephemeral', true, 'scopes', v_requested)) returning id into v_key_id;
+  end if;
+  insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id,
+    granted_scopes, grant_expires_at)
+  values (v_child_id, v_true_root, p_root_agent_id, v_policy.id, v_requested, v_expires);
+  insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth, identity_kind, harness,
+    forked_from, approved_risky_digest, current_risky_digest, recorded_fingerprint, resolution_state)
+  values (v_child_id, p_root_agent_id, v_true_root, v_depth + 1,
+    case when p_session_harness is null then 'legacy' else 'session' end, p_session_harness, p_forked_from,
+    v_approved, p_fingerprint ->> 'risky_digest',
+    case when p_fingerprint is null then '{}'::jsonb else
+      coalesce(p_fingerprint -> 'recorded', '{}'::jsonb) || jsonb_build_object('resolution', p_fingerprint ->> 'resolution') end,
+    case when p_session_harness is null or v_approved is not null then 'active' else 'frozen' end);
+  perform agent_board._refuse_delegate_membership_target(v_child_id, 'mint_delegated_child');
+  if p_session_harness is not null then
+    if v_reserved_alias is null then
+      insert into agent_board.session_id_aliases(identity_agent_id, root_agent_id, harness, session_id)
+      values (v_child_id, v_true_root, p_session_harness, p_session_id) returning id into v_reserved_alias;
+    else
+      update agent_board.session_id_aliases set identity_agent_id = v_child_id
+       where id = v_reserved_alias;
+    end if;
+    update agent_board.session_identities set lease_alias_id = v_reserved_alias where agent_id = v_child_id;
+    for v_room in select value from jsonb_array_elements(coalesce(p_requested_rooms, '[]'::jsonb)) order by value ->> 'board_id' loop
+      v_board := (v_room ->> 'board_id')::uuid;
+      v_role := v_room ->> 'role';
+      select bm.role into v_parent_role from agent_board.board_memberships bm
+       where bm.board_id = v_board and bm.agent_id = p_root_agent_id and bm.membership_state in ('joined', 'subscribed')
+       order by agent_board._role_rank(bm.role) desc limit 1;
+      if v_role not in ('owner', 'admin', 'member', 'observer') or v_role is null or v_parent_role is null
+         or agent_board._role_rank(v_role) > agent_board._role_rank(v_parent_role)
+         or not agent_board._grant_within_ceiling(p_root_agent_id, v_board, v_role) then
+        raise exception 'room_authority_exceeded' using errcode = '42501';
+      end if;
+      select * into v_membership from agent_board._upsert_board_membership_state(v_board, v_child_id, 'joined');
+      update agent_board.board_memberships set role = v_role where id = v_membership.id;
+    end loop;
+  end if;
+  perform agent_board._assert_actor_not_fleet_revoked(p_root_agent_id, 'mint_delegated_child');
+  return query select v_child_id, v_expires, v_key_id;
+end;
+$$;
+revoke all on function agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean, text, text, text, jsonb, jsonb, uuid) from public, anon, authenticated;
+grant execute on function agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean, text, text, text, jsonb, jsonb, uuid) to service_role;
+comment on function agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean, text, text, text, jsonb, jsonb, uuid) is 'Single service-role child mint. The six legacy inputs/results remain compatible. Trusted session context adds measured harness/id, verified minter epoch, explicit [{board_id,role}] rooms, {resolution,risky_digest,recorded} fingerprint and optional same-parent fork. SIDSERVER must bind every new field in child-key PoP before forwarding; public Edge shapes do not supply them. Enforces true root, depth two, granted scopes, ancestor validity, root-locked mixed census and effective lifetime; only matching approved fingerprints get seven days. Membership provenance is derived by the consent sink, never supplied by the caller.';
+
+-- The server-facing mint keeps all historical challenge/key gates in the renamed
+-- implementation and adds session lease claim/reclaim semantics around its result.
+alter function agent_board.mint_fleet_agent_session(uuid, text, uuid, uuid, integer)
+  rename to _mint_fleet_agent_session_legacy;
+revoke all on function agent_board._mint_fleet_agent_session_legacy(uuid, text, uuid, uuid, integer) from public, anon, authenticated, service_role;
+comment on function agent_board._mint_fleet_agent_session_legacy(uuid,text,uuid,uuid,integer) is 'Private whole-principal PoP issuer, retaining the legacy challenge/key/lineage validation and 900-second credential ceiling. No PostgREST role, including service_role, can execute it directly; the service-only mint_fleet_agent_session wrapper is its sole session-token caller and applies identity lease, fingerprint and epoch gates.';
+create function agent_board.mint_fleet_agent_session(
+  p_challenge_id uuid, p_nonce text, p_signing_key_id uuid, p_agent_id uuid,
+  p_max_ttl_seconds integer default 900, p_holder_secret text default null, p_session_id text default null
+) returns table(session_id text, expires_at timestamptz, identity_lease_epoch bigint, holder_secret text)
+language plpgsql security definer set search_path = agent_board, public as $$
+declare v_identity agent_board.session_identities%rowtype; v_session record; v_new_secret text; v_alias uuid;
+  v_ancestor_expires timestamptz; v_grant_expires timestamptz;
+begin
+  if not agent_board._is_service_role() then raise exception 'session mint is service_role-only' using errcode = '42501'; end if;
+  -- Match the existing PoP issuer's challenge-before-principal order.
+  perform 1 from agent_board.agent_signing_key_challenges where id = p_challenge_id for update;
+  -- Serialize the census without conflicting with key-issuer FK KEY SHARE locks.
+  perform 1 from agent_board.agents where id = (
+    select root_agent_id from agent_board.session_identities where agent_id = p_agent_id
+  ) for no key update;
+  select * into v_identity from agent_board.session_identities where agent_id = p_agent_id for update;
+  -- Readmission repoints aliases before inserting its new key. Both legacy and
+  -- session issuances use the same identity/alias-before-key acquisition order.
+  perform 1 from agent_board.session_id_aliases where identity_agent_id = p_agent_id order by id for update;
+  if v_identity.tombstoned_at is not null then raise exception 'identity_tombstoned' using errcode = '42501'; end if;
+  if exists (
+    with recursive ancestry(id, parent_agent_id) as (
+      select id, parent_agent_id from agent_board.agents where id = p_agent_id
+      union all
+      select a.id, a.parent_agent_id from agent_board.agents a join ancestry c on a.id = c.parent_agent_id
+    )
+    select 1 from ancestry a join agent_board.session_identities si on si.agent_id = a.id
+     where si.resolution_state = 'frozen'
+  ) then raise exception 'identity_fingerprint_unapproved' using errcode = '42501'; end if;
+  if v_identity.agent_id is null or v_identity.identity_kind <> 'session' then
+    select * into v_session from agent_board._mint_fleet_agent_session_legacy(p_challenge_id, p_nonce, p_signing_key_id, p_agent_id, p_max_ttl_seconds);
+    return query select v_session.session_id, v_session.expires_at, null::bigint, null::text; return;
+  end if;
+  if v_identity.resolution_state = 'frozen' or v_identity.approved_risky_digest is null
+     or v_identity.current_risky_digest is distinct from v_identity.approved_risky_digest then
+    raise exception 'identity_fingerprint_unapproved' using errcode = '42501';
+  end if;
+  v_ancestor_expires := agent_board._session_identity_ancestor_ceiling(v_identity.parent_agent_id);
+  if not agent_board._session_identity_lease_live(p_agent_id) then
+    perform agent_board._session_identity_check_limits(v_identity.root_agent_id, v_identity.parent_agent_id, p_agent_id);
+  end if;
+  if not exists (select 1 from agent_board.agent_signing_keys k where k.id = p_signing_key_id
+    and k.agent_id = p_agent_id and k.proof_state = 'proven') then
+    raise exception 'key_unproven: session key requires proof' using errcode = '42501';
+  end if;
+  select * into v_session from agent_board._mint_fleet_agent_session_legacy(p_challenge_id, p_nonce, p_signing_key_id, p_agent_id, p_max_ttl_seconds);
+  select g.grant_expires_at into v_grant_expires from agent_board.delegation_grants g where g.child_agent_id = p_agent_id;
+  v_session.expires_at := least(v_session.expires_at, v_ancestor_expires, v_grant_expires);
+  update agent_board.nonfleet_sessions s set expires_at = v_session.expires_at where s.session_id = v_session.session_id;
+  if v_identity.holder_secret_hash is not null and v_identity.last_heartbeat > now() - interval '180 seconds' then
+    if p_holder_secret is not null and extensions.digest(p_holder_secret, 'sha256') = v_identity.holder_secret_hash then
+      return query select v_session.session_id, v_session.expires_at, v_identity.credential_epoch, null::text; return;
+    end if;
+    if p_holder_secret is not null then raise exception 'identity_lease_not_held' using errcode = '42501'; end if;
+    if p_session_id is not null and exists (select 1 from agent_board.session_id_aliases a where a.id = v_identity.lease_alias_id and a.session_id = p_session_id) then
+      raise exception 'duplicate_live_session' using errcode = '42501';
+    end if;
+    raise exception 'identity_lease_live' using errcode = '42501';
+  end if;
+  select a.id into v_alias from agent_board.session_id_aliases a
+   where a.identity_agent_id = p_agent_id and a.session_id = p_session_id;
+  if v_identity.holder_secret_hash is null then
+    if v_alias is null or v_alias is distinct from v_identity.lease_alias_id then raise exception 'identity_continuity_refused' using errcode = '42501'; end if;
+  elsif v_alias is null then
+    if p_session_id is null or length(p_session_id) = 0 or v_identity.harness <> 'claude' then
+      raise exception 'identity_continuity_refused' using errcode = '42501';
+    end if;
+    if exists (select 1 from agent_board.session_id_aliases a where a.root_agent_id = v_identity.root_agent_id
+      and a.harness = v_identity.harness and a.session_id = p_session_id) then
+      raise exception 'identity_continuity_refused' using errcode = '42501';
+    end if;
+    insert into agent_board.session_id_aliases(identity_agent_id, root_agent_id, harness, session_id)
+    values (p_agent_id, v_identity.root_agent_id, v_identity.harness, p_session_id) returning id into v_alias;
+  end if;
+  v_new_secret := encode(extensions.gen_random_bytes(32), 'hex');
+  update agent_board.session_identities
+     set holder_secret_hash = extensions.digest(v_new_secret, 'sha256'), lease_alias_id = v_alias,
+         credential_epoch = case when holder_secret_hash is null then credential_epoch else credential_epoch + 1 end,
+         last_heartbeat = now(), updated_at = now()
+   where agent_id = p_agent_id
+  returning credential_epoch into identity_lease_epoch;
+  return query select v_session.session_id, v_session.expires_at, identity_lease_epoch, v_new_secret;
+end;
+$$;
+revoke all on function agent_board.mint_fleet_agent_session(uuid, text, uuid, uuid, integer, text, text) from public, anon, authenticated;
+grant execute on function agent_board.mint_fleet_agent_session(uuid, text, uuid, uuid, integer, text, text) to service_role;
+comment on function agent_board.mint_fleet_agent_session(uuid, text, uuid, uuid, integer, text, text) is 'Service-role PoP mint with one-live-holder session lease fencing; a newly generated holder secret is returned only on claim or reclaim.';
+
+create or replace function agent_board._session_identity_owner(p_identity_agent_id uuid)
+returns boolean language sql stable security definer set search_path = '' as $$
+  select exists (
+    select 1
+      from agent_board.session_identities si
+      join agent_board.agents root on root.id = si.root_agent_id
+      join agent_board.agents human on human.auth_user_id = auth.uid()
+     where si.agent_id = p_identity_agent_id
+       and root.owner_user_id = auth.uid()
+       and human.agent_type = 'human' and human.status = 'active'
+  );
+$$;
+revoke all on function agent_board._session_identity_owner(uuid) from public, anon, authenticated;
+grant execute on function agent_board._session_identity_owner(uuid) to service_role;
+comment on function agent_board._session_identity_owner(uuid) is 'Checks the authenticated active human against the identity root owner. No caller-supplied actor is accepted.';
+
+create or replace function agent_board._session_identity_ancestor_actor(p_identity_agent_id uuid)
+returns boolean language sql stable security definer set search_path = '' as $$
+  with recursive lineage(agent_id, parent_agent_id) as (
+    select parent.agent_id, parent.parent_agent_id
+      from agent_board.session_identities target
+      join agent_board.session_identities parent on parent.agent_id = target.parent_agent_id
+     where target.agent_id = p_identity_agent_id
+    union all
+    select parent.agent_id, parent.parent_agent_id
+      from agent_board.session_identities parent
+      join lineage child on child.parent_agent_id = parent.agent_id
+  )
+  select exists (
+    select 1 from lineage l
+      join agent_board.session_identities si on si.agent_id = l.agent_id
+      join agent_board.session_identities target on target.agent_id = p_identity_agent_id
+     where l.agent_id = agent_board.current_agent_id()
+       and si.tombstoned_at is null
+       and si.resolution_state = 'active'
+       and si.approved_risky_digest is not null
+       and si.approved_risky_digest = si.current_risky_digest
+       and si.approved_risky_digest = target.current_risky_digest
+  );
+$$;
+revoke all on function agent_board._session_identity_ancestor_actor(uuid) from public, anon, authenticated;
+grant execute on function agent_board._session_identity_ancestor_actor(uuid) to service_role;
+comment on function agent_board._session_identity_ancestor_actor(uuid) is 'Strict ancestor approval predicate: resolver-derived actor, never the target itself, must be active, non-tombstoned and non-frozen with its own approved current digest matching the target reading. Applies to legacy roots too.';
+
+create function agent_board._session_identity_revocation_actor(p_identity_agent_id uuid)
+returns boolean language sql stable security definer set search_path = '' as $$
+  with recursive lineage(agent_id, parent_agent_id) as (
+    select parent.agent_id, parent.parent_agent_id
+      from agent_board.session_identities target
+      join agent_board.session_identities parent on parent.agent_id = target.parent_agent_id
+     where target.agent_id = p_identity_agent_id
+    union all
+    select parent.agent_id, parent.parent_agent_id
+      from agent_board.session_identities parent join lineage child on child.parent_agent_id = parent.agent_id
+  )
+  select exists (select 1 from lineage where agent_id = agent_board.current_agent_id());
+$$;
+revoke all on function agent_board._session_identity_revocation_actor(uuid) from public, anon, authenticated, service_role;
+comment on function agent_board._session_identity_revocation_actor(uuid) is 'Resolver-derived strict ancestor revocation actor. Unlike approval, any active ancestor may revoke, including a frozen one; target self and siblings are not ancestors.';
+
+create function agent_board.record_session_identity_state(p_identity_agent_id uuid, p_fingerprint jsonb)
+returns void language plpgsql security definer set search_path = '' as $$
+declare v_identity agent_board.session_identities%rowtype;
+  v_risky text := nullif(p_fingerprint ->> 'risky_digest', '');
+  v_recorded jsonb := coalesce(p_fingerprint -> 'recorded', '{}'::jsonb)
+    || jsonb_build_object('resolution', coalesce(p_fingerprint ->> 'resolution', 'unresolved'));
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'identity reading is service_role-only' using errcode = '42501';
+  end if;
+  if coalesce(p_fingerprint ->> 'resolution', 'unresolved') not in ('resolved', 'unresolved') then
+    raise exception 'invalid identity fingerprint resolution' using errcode = '22023';
+  end if;
+  perform 1 from agent_board.agents where id = (
+    select root_agent_id from agent_board.session_identities where agent_id = p_identity_agent_id
+  ) for update;
+  select * into v_identity from agent_board.session_identities where agent_id = p_identity_agent_id for update;
+  if not found then raise exception 'identity not found' using errcode = 'P0002'; end if;
+  if v_identity.tombstoned_at is not null then raise exception 'identity_tombstoned' using errcode = '42501'; end if;
+  if not exists (select 1 from agent_board.agents a where a.id = p_identity_agent_id and a.auth_user_id = auth.uid() and a.status = 'active')
+     or (v_identity.identity_kind = 'session' and agent_board.current_agent_id() is distinct from p_identity_agent_id) then
+    raise exception 'identity_lease_not_held' using errcode = '42501';
+  end if;
+  if jsonb_typeof(coalesce(p_fingerprint, '{}'::jsonb)) <> 'object' or jsonb_typeof(v_recorded) <> 'object' then
+    raise exception 'invalid identity fingerprint reading' using errcode = '22023';
+  end if;
+  -- Return normally: throwing here would roll back the freeze. SIDSERVER must
+  -- commit this measured reading before invoking a protected action separately.
+  update agent_board.session_identities
+     set current_risky_digest = v_risky, recorded_fingerprint = v_recorded,
+         resolution_state = case
+           when p_fingerprint ->> 'resolution' is distinct from 'resolved' or v_risky is null
+             or v_identity.approved_risky_digest is null then 'frozen'
+           when v_risky is distinct from v_identity.approved_risky_digest or v_identity.resolution_state = 'frozen' then 'frozen'
+           else 'active' end,
+         updated_at = now()
+   where agent_id = p_identity_agent_id;
+end;
+$$;
+revoke all on function agent_board.record_session_identity_state(uuid,jsonb) from public, anon, authenticated;
+grant execute on function agent_board.record_session_identity_state(uuid,jsonb) to service_role;
+comment on function agent_board.record_session_identity_state(uuid,jsonb) is 'Service-only fresh measured fingerprint recording, bound to the verified subject and epoch. Normal return durably records risky/unresolved freeze without replacing approval or refreshing a lease. Recorded-only changes remain active; existing freeze needs explicit approval. SIDSERVER commits this reading before a separate protected action; no public body attestation is accepted.';
+
+create function agent_board.approve_identity_state(
+  p_identity_agent_id uuid,
+  p_risky_digest text,
+  p_recorded_fingerprint jsonb default '{}'::jsonb
+)
+returns void language plpgsql security definer set search_path = agent_board, public as $$
+declare v_identity agent_board.session_identities%rowtype;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'identity approval is service_role-only' using errcode = '42501';
+  end if;
+  perform 1 from agent_board.agents where id = (
+    select root_agent_id from agent_board.session_identities where agent_id = p_identity_agent_id
+  ) for update;
+  select * into v_identity from agent_board.session_identities where agent_id = p_identity_agent_id for update;
+  if not found then raise exception 'identity not found' using errcode = 'P0002'; end if;
+  if v_identity.tombstoned_at is not null then raise exception 'identity_tombstoned' using errcode = '42501'; end if;
+  if p_risky_digest is null or jsonb_typeof(coalesce(p_recorded_fingerprint, '{}'::jsonb)) <> 'object'
+     or p_recorded_fingerprint ->> 'resolution' is distinct from 'resolved'
+     or v_identity.recorded_fingerprint ->> 'resolution' is distinct from 'resolved'
+     or p_risky_digest is distinct from v_identity.current_risky_digest then
+    raise exception 'identity_fingerprint_unapproved' using errcode = '42501';
+  end if;
+  if v_identity.depth = 0 then
+    if not agent_board._session_identity_owner(p_identity_agent_id) then
+      raise exception 'identity approval requires the human owner' using errcode = '42501';
+    end if;
+  elsif not agent_board._session_identity_owner(p_identity_agent_id)
+        and not agent_board._session_identity_ancestor_actor(p_identity_agent_id) then
+    raise exception 'identity approval requires the owner or an approved ancestor' using errcode = '42501';
+  end if;
+  if agent_board._session_identity_owner(p_identity_agent_id) then
+    perform agent_board._assert_actor_not_fleet_revoked(agent_board.current_agent_id(), 'approve_identity_state');
+  else
+    perform agent_board._assert_actor_not_fleet_revoked(agent_board.current_agent_id(), 'approve_identity_state');
+  end if;
+  update agent_board.session_identities
+     set approved_risky_digest = p_risky_digest,
+         current_risky_digest = p_risky_digest,
+         recorded_fingerprint = v_identity.recorded_fingerprint || p_recorded_fingerprint,
+         resolution_state = 'active', updated_at = now()
+   where agent_id = p_identity_agent_id;
+end;
+$$;
+revoke all on function agent_board.approve_identity_state(uuid, text, jsonb) from public, anon, authenticated;
+grant execute on function agent_board.approve_identity_state(uuid, text, jsonb) to service_role;
+comment on function agent_board.approve_identity_state(uuid, text, jsonb) is 'Service-only measured-fingerprint approval preserving the resolver/auth.uid human or ancestor actor. Depth zero is human-owner-only. Strict ancestors must have their own matching approved current digest and cannot be frozen. Fresh resolution must be explicit and resolved, stored unresolved inputs and unrecorded digests refuse, and tombstones never revive. Uses root-before-identity locking.';
+
+-- The shared primitive closes forks as well as lineage descendants. Legacy
+-- human, subtree, platform-admin and fleet-agent revocations use the same path.
+create or replace function agent_board._revoke_agent_principal(
+  p_agent_id uuid,
+  p_revoked_by_agent_id uuid,
+  p_reason text
+)
+returns integer
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_key record;
+  v_key_count integer := 0;
+  v_agent_flipped boolean := false;
+  v_ids uuid[];
+  v_id uuid;
+begin
+  perform 1 from agent_board.agents a where a.id = (
+    select si.root_agent_id from agent_board.session_identities si where si.agent_id = p_agent_id
+  ) for no key update;
+  with recursive closure(agent_id) as (
+    select p_agent_id
+    union
+    select a.id from agent_board.agents a
+      left join agent_board.session_identities si on si.agent_id = a.id
+      join closure c on a.parent_agent_id = c.agent_id or si.forked_from = c.agent_id
+     where p_reason is distinct from 'superseded_unclaimed'
+  )
+  select array_agg(agent_id order by agent_id) into v_ids from closure;
+  perform 1 from agent_board.session_identities si
+    where si.agent_id = any(v_ids) order by si.agent_id for update;
+  for v_id in select unnest(v_ids)
+  loop
+    v_agent_flipped := false;
+    update agent_board.session_identities
+       set tombstoned_at = now(),
+           tombstone_reason = case when v_id <> p_agent_id then 'cascade'
+             when p_reason = 'superseded_unclaimed' then 'superseded_unclaimed' else 'revoked' end,
+           credential_epoch = credential_epoch + 1, updated_at = now()
+     where agent_id = v_id and tombstoned_at is null;
+  perform 1 from agent_board.agents a where a.id = v_id for update;
+
+  for v_key in
+    select id
+      from agent_board.agent_signing_keys
+     where agent_id = v_id
+       and status not in ('revoked', 'compromised')
+     order by id
+     for update
+  loop
+    update agent_board.agent_signing_keys
+       set status = 'revoked',
+           proof_state = 'revoked',
+           revoked_at = now(),
+           revoked_by_agent_id = p_revoked_by_agent_id,
+           revocation_reason = p_reason,
+           updated_at = now()
+     where id = v_key.id;
+
+    insert into agent_board.fleet_revocation_events(
+      subject_kind, subject_id, signing_key_id, agent_id,
+      revoked_by_agent_id, revocation_reason, metadata
+    )
+    values (
+      'signing_key', v_key.id, v_key.id, v_id,
+      p_revoked_by_agent_id, p_reason,
+      jsonb_build_object('source', 'revoke_agent_subtree')
+    )
+    on conflict (subject_kind, subject_id) do update
+      set revoked_by_agent_id = excluded.revoked_by_agent_id,
+          revocation_reason = excluded.revocation_reason,
+          signing_key_id = excluded.signing_key_id,
+          agent_id = excluded.agent_id,
+          effective_at = now(),
+          metadata = excluded.metadata;
+
+    v_key_count := v_key_count + 1;
+  end loop;
+
+  update agent_board.agents
+     set status = 'revoked', updated_at = now()
+   where id = v_id and status <> 'revoked';
+  if found then
+    v_agent_flipped := true;
+  end if;
+
+  update agent_board.delegation_grants
+     set revoked_at = now()
+   where child_agent_id = v_id and revoked_at is null;
+
+  update agent_board.agent_credentials ac
+     set revoked_at = coalesce(ac.revoked_at, now()),
+         updated_at = now(),
+         metadata = coalesce(ac.metadata, '{}'::jsonb)
+           || jsonb_build_object(
+             'revokedByAgentId', p_revoked_by_agent_id,
+             'revocationReason', p_reason,
+             'source', 'revoke_agent_subtree'
+           )
+   where ac.agent_id = v_id and ac.revoked_at is null;
+
+  insert into agent_board.fleet_revocation_events(
+    subject_kind, subject_id, agent_id,
+    revoked_by_agent_id, revocation_reason, metadata
+  )
+  values (
+    'agent', v_id, v_id,
+    p_revoked_by_agent_id, p_reason,
+    jsonb_build_object('source', 'revoke_agent_subtree', 'statusFlipped', v_agent_flipped)
+  )
+  on conflict (subject_kind, subject_id) do update
+    set revoked_by_agent_id = excluded.revoked_by_agent_id,
+        revocation_reason = excluded.revocation_reason,
+        agent_id = excluded.agent_id,
+        effective_at = now(),
+        metadata = excluded.metadata;
+
+  end loop;
+  return v_key_count;
+end;
+$$;
+revoke all on function agent_board._revoke_agent_principal(uuid, uuid, text) from public, anon, authenticated, service_role;
+grant execute on function agent_board._revoke_agent_principal(uuid, uuid, text) to service_role;
+comment on function agent_board._revoke_agent_principal(uuid, uuid, text) is 'Revokes a principal and transitive identity forks and lineage descendants, except superseded_unclaimed revokes only its never-claimed target. Takes root then identity locks before principal and keys. Tombstones retained alias targets, fences each epoch once, preserves permanent ledger and writes status, keys, grants and legacy credentials. Returns the number of newly revoked signing keys.';
+
+create or replace function agent_board.revoke_agent_subtree(
+  p_root_agent_id uuid,
+  p_revoked_by_agent_id uuid,
+  p_reason text default 'root revocation'
+)
+returns table(revoked_agent_count integer, revoked_key_count integer)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_agent uuid;
+  v_agent_count integer := 0;
+  v_key_count integer := 0;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'revoke_agent_subtree is service_role-only' using errcode = '42501';
+  end if;
+  if trim(p_reason) = 'superseded_unclaimed' then
+    raise exception 'superseded_unclaimed is reserved for the supersede path' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.agents where id = p_root_agent_id) then
+    raise exception 'root agent not found' using errcode = 'P0002';
+  end if;
+
+  perform 1 from agent_board.agents a where a.id = (
+    select si.root_agent_id from agent_board.session_identities si where si.agent_id = p_root_agent_id
+  ) for no key update;
+
+  for v_agent in
+    with recursive subtree(agent_id) as (
+      select p_root_agent_id
+      union
+      select a.id from agent_board.agents a
+        left join agent_board.session_identities si on si.agent_id = a.id
+        join subtree s on a.parent_agent_id = s.agent_id or si.forked_from = s.agent_id
+    )
+    select agent_id from subtree order by agent_id
+  loop
+    v_key_count := v_key_count
+      + agent_board._revoke_agent_principal(v_agent, p_revoked_by_agent_id, p_reason);
+    v_agent_count := v_agent_count + 1;
+  end loop;
+
+  return query select v_agent_count, v_key_count;
+end;
+$$;
+revoke all on function agent_board.revoke_agent_subtree(uuid, uuid, text) from public, anon, authenticated, service_role;
+grant execute on function agent_board.revoke_agent_subtree(uuid, uuid, text) to service_role;
+comment on function agent_board.revoke_agent_subtree(uuid, uuid, text) is 'Service-only root and descendant revocation, including transitive forks. Root-before-identity lock order and the shared principal primitive serialize renewals; returned agent and key counts cover the full closure.';
+
+create function agent_board._revoke_session_identity_family(p_agent_id uuid, p_actor uuid, p_reason text)
+returns void language plpgsql security definer set search_path = '' as $$
+declare v_id uuid;
+begin
+  -- A legacy ledger-only revoke keeps its legacy principal/key state. New
+  -- session descendants still receive the full physical write-through.
+  for v_id in
+    with recursive family(agent_id) as (
+      select p_agent_id
+      union
+      select a.id from agent_board.agents a left join agent_board.session_identities si on si.agent_id = a.id
+        join family f on a.parent_agent_id = f.agent_id or si.forked_from = f.agent_id
+    )
+    select si.agent_id from family f join agent_board.session_identities si on si.agent_id = f.agent_id
+     where si.identity_kind = 'session' order by si.agent_id
+  loop
+    perform agent_board._revoke_agent_principal(v_id, p_actor, p_reason);
+  end loop;
+end;
+$$;
+revoke all on function agent_board._revoke_session_identity_family(uuid, uuid, text) from public, anon, authenticated;
+grant execute on function agent_board._revoke_session_identity_family(uuid, uuid, text) to service_role;
+comment on function agent_board._revoke_session_identity_family(uuid, uuid, text) is 'Closes session identities and transitive forks/descendants through the principal primitive without changing the pre-SIDSCHEMA state semantics of a legacy parent. Internal verified-actor helper for fleet and platform-admin revocation.';
+
+create or replace function agent_board.revoke_fleet_subject(
+  p_subject_kind text,
+  p_subject_id uuid,
+  p_revoked_by_agent_id uuid,
+  p_revocation_reason text,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(revocation_event_id uuid, subject_kind text, effective_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_event agent_board.fleet_revocation_events%rowtype;
+  v_actor_agent_id uuid;
+  v_lock_machine_id uuid;
+  v_lock_agent_id uuid;
+begin
+  if trim(p_revocation_reason) = 'superseded_unclaimed' then
+    raise exception 'superseded_unclaimed is reserved for the supersede path' using errcode = '22023';
+  end if;
+  if p_subject_kind not in ('trust_domain', 'machine', 'harness', 'repo_scope', 'agent', 'signing_key', 'credential') then
+    raise exception 'unsupported fleet revocation subject' using errcode = '22023';
+  end if;
+
+  if p_subject_kind in ('machine', 'harness', 'repo_scope') then
+    v_lock_machine_id := case
+      when p_subject_kind = 'machine' then p_subject_id
+      when p_subject_kind = 'harness' then (
+        select fhr.machine_id
+          from agent_board.fleet_harness_registrations fhr
+         where fhr.id = p_subject_id)
+      when p_subject_kind = 'repo_scope' then (
+        select fhr.machine_id
+          from agent_board.fleet_repo_scopes frs
+          join agent_board.fleet_harness_registrations fhr
+            on fhr.id = frs.harness_registration_id
+         where frs.id = p_subject_id)
+    end;
+    if v_lock_machine_id is not null then
+      perform 1
+        from agent_board.fleet_machines fm
+       where fm.id = v_lock_machine_id
+       for update;
+    end if;
+  elsif p_subject_kind = 'agent' then
+    for v_lock_machine_id in
+      select distinct fma.machine_id
+        from agent_board.fleet_machine_agents fma
+       where fma.agent_id = p_subject_id
+       order by fma.machine_id
+    loop
+      perform 1
+        from agent_board.fleet_machines fm
+       where fm.id = v_lock_machine_id
+       for update;
+    end loop;
+  perform 1 from agent_board.agents a where a.id = (
+    select si.root_agent_id from agent_board.session_identities si where si.agent_id = p_subject_id
+  ) for no key update;
+    perform 1 from agent_board.agents a where a.id = p_subject_id for update;
+    perform 1
+      from agent_board.fleet_machine_agents fma
+     where fma.agent_id = p_subject_id
+     order by fma.id
+     for update;
+  elsif p_subject_kind = 'signing_key' then
+    select ask.agent_id
+      into v_lock_agent_id
+      from agent_board.agent_signing_keys ask
+     where ask.id = p_subject_id;
+    if v_lock_agent_id is not null then
+      perform 1 from agent_board.agents a where a.id = v_lock_agent_id for update;
+    end if;
+    perform 1 from agent_board.agent_signing_keys ask where ask.id = p_subject_id for update;
+  end if;
+
+  if p_subject_kind = 'trust_domain' then
+    perform 1
+      from agent_board.fleet_trust_domains ftd
+     where ftd.id = p_subject_id
+     for update;
+  end if;
+
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(
+    p_revoked_by_agent_id,
+    'p_revoked_by_agent_id'
+  );
+
+  if not agent_board._is_service_role() then
+    if p_subject_kind = 'trust_domain' and not exists (
+      select 1 from agent_board.fleet_trust_domains ftd
+       where ftd.id = p_subject_id and ftd.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'trust domain is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'machine' and not exists (
+      select 1 from agent_board.fleet_machines fm
+       where fm.id = p_subject_id and fm.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'machine is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'harness' and not exists (
+      select 1
+        from agent_board.fleet_harness_registrations fhr
+        join agent_board.fleet_machines fm on fm.id = fhr.machine_id
+       where fhr.id = p_subject_id and fm.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'harness is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'repo_scope' and not exists (
+      select 1
+        from agent_board.fleet_repo_scopes frs
+        join agent_board.fleet_harness_registrations fhr
+          on fhr.id = frs.harness_registration_id
+        join agent_board.fleet_machines fm on fm.id = fhr.machine_id
+       where frs.id = p_subject_id and fm.owner_agent_id = v_actor_agent_id
+    ) then
+      raise exception 'repo scope is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'agent' and p_subject_id <> v_actor_agent_id then
+      raise exception 'agent revocation must target current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'signing_key' and not exists (
+      select 1 from agent_board.agent_signing_keys ask
+       where ask.id = p_subject_id and ask.agent_id = v_actor_agent_id
+    ) then
+      raise exception 'signing key is not owned by current_agent_id()' using errcode = '42501';
+    elsif p_subject_kind = 'credential' and not exists (
+      select 1 from agent_board.agent_credentials ac
+       where ac.id = p_subject_id and ac.agent_id = v_actor_agent_id
+    ) then
+      raise exception 'credential is not owned by current_agent_id()' using errcode = '42501';
+    end if;
+  end if;
+
+  select *
+    into v_event
+    from agent_board.fleet_revocation_events fre
+   where fre.subject_kind = p_subject_kind
+     and fre.subject_id = p_subject_id
+   limit 1;
+
+  if v_event.id is null then
+    insert into agent_board.fleet_revocation_events(
+      subject_kind,
+      subject_id,
+      trust_domain_id,
+      machine_id,
+      harness_registration_id,
+      repo_scope_id,
+      agent_id,
+      signing_key_id,
+      revoked_by_agent_id,
+      revocation_reason,
+      metadata
+    )
+    values (
+      p_subject_kind,
+      p_subject_id,
+      case when p_subject_kind = 'trust_domain' then p_subject_id end,
+      case when p_subject_kind = 'machine' then p_subject_id end,
+      case when p_subject_kind = 'harness' then p_subject_id end,
+      case when p_subject_kind = 'repo_scope' then p_subject_id end,
+      case when p_subject_kind = 'agent' then p_subject_id end,
+      case when p_subject_kind = 'signing_key' then p_subject_id end,
+      p_revoked_by_agent_id,
+      trim(coalesce(p_revocation_reason, 'operator revocation')),
+      coalesce(p_metadata, '{}'::jsonb)
+        || jsonb_build_object('redacted', true, 'metadata-safe', true)
+    )
+    returning * into v_event;
+  else
+    update agent_board.fleet_revocation_events fre
+       set effective_at = now(),
+           revoked_by_agent_id = p_revoked_by_agent_id,
+           revocation_reason = trim(coalesce(p_revocation_reason, 'operator revocation')),
+           metadata = coalesce(p_metadata, '{}'::jsonb)
+             || jsonb_build_object('redacted', true, 'metadata-safe', true)
+     where fre.id = v_event.id
+    returning * into v_event;
+  end if;
+
+  if p_subject_kind = 'trust_domain' then
+    update agent_board.fleet_trust_domains
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'machine' then
+    update agent_board.fleet_machines
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'harness' then
+    update agent_board.fleet_harness_registrations
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'repo_scope' then
+    update agent_board.fleet_repo_scopes
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where id = p_subject_id;
+  elsif p_subject_kind = 'agent' then
+    update agent_board.fleet_machine_agents
+       set lifecycle_state = 'revoked', revoked_at = v_event.effective_at, updated_at = now()
+     where agent_id = p_subject_id;
+  elsif p_subject_kind = 'signing_key' then
+    update agent_board.agent_signing_keys
+       set status = case when status = 'compromised' then status else 'revoked' end,
+           proof_state = 'revoked',
+           revoked_at = coalesce(revoked_at, v_event.effective_at),
+           revoked_by_agent_id = p_revoked_by_agent_id,
+           revocation_reason = trim(coalesce(p_revocation_reason, 'operator revocation')),
+           updated_at = now()
+     where id = p_subject_id;
+  end if;
+
+  if p_subject_kind = 'agent' then
+    perform agent_board._revoke_session_identity_family(p_subject_id, v_actor_agent_id, p_revocation_reason);
+  end if;
+  return query select v_event.id, v_event.subject_kind, v_event.effective_at;
+end;
+$$;
+revoke all on function agent_board.revoke_fleet_subject(text, uuid, uuid, text, jsonb) from public, anon, authenticated, service_role;
+grant execute on function agent_board.revoke_fleet_subject(text, uuid, uuid, text, jsonb) to authenticated, service_role;
+comment on function agent_board.revoke_fleet_subject(text, uuid, uuid, text, jsonb) is 'Effective fleet revocation preserving existing actor ownership and machine-before-agent locking. Agent subjects additionally take their lineage root before the agent and close identity aliases, forks, descendants, epochs and all principal credential state through the shared primitive.';
+
+create or replace function agent_board.revoke_agent(
+  p_agent_id uuid,
+  p_reason text default null
+)
+returns table(
+  agent_id uuid,
+  status text,
+  revoked_credential_count integer,
+  revoked_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_admin_user_id uuid;
+  v_agent agent_board.agents%rowtype;
+  v_revoked_at timestamptz := now();
+  v_revoked_count integer := 0;
+  v_actor uuid;
+begin
+  v_admin_user_id := agent_board._require_platform_admin_user_id();
+  v_actor := agent_board.current_agent_id();
+  if trim(p_reason) = 'superseded_unclaimed' then
+    raise exception 'superseded_unclaimed is reserved for the supersede path' using errcode = '22023';
+  end if;
+  if v_actor is not null then
+    perform agent_board._assert_actor_not_fleet_revoked(v_actor, 'revoke_agent');
+  end if;
+
+  perform 1 from agent_board.agents a where a.id = (
+    select si.root_agent_id from agent_board.session_identities si where si.agent_id = p_agent_id
+  ) for no key update;
+
+  -- Legacy service scripts and Portal admins need no board actor. Only a
+  -- session family writes the permanent ledger, whose attribution is required.
+  if v_actor is null and exists (
+    with recursive family(agent_id) as (
+      select p_agent_id
+      union
+      select a.id from agent_board.agents a left join agent_board.session_identities si on si.agent_id = a.id
+        join family f on a.parent_agent_id = f.agent_id or si.forked_from = f.agent_id
+    )
+    select 1 from family f join agent_board.session_identities si on si.agent_id = f.agent_id
+     where si.identity_kind = 'session'
+  ) then raise exception 'revocation requires a resolved actor' using errcode = '42501'; end if;
+
+  select count(*)::integer into v_revoked_count from agent_board.agent_credentials ac
+   where ac.agent_id = p_agent_id and ac.revoked_at is null;
+  perform agent_board._revoke_session_identity_family(p_agent_id,
+    v_actor, coalesce(p_reason, 'operator revocation'));
+  update agent_board.agents a
+     set status = case when exists (select 1 from agent_board.session_identities si
+       where si.agent_id = p_agent_id and si.identity_kind = 'session') then 'revoked' else 'suspended' end,
+         updated_at = v_revoked_at,
+         metadata = coalesce(a.metadata, '{}'::jsonb)
+           || jsonb_build_object(
+             'revokedByUserId', v_admin_user_id,
+             'revokedAt', v_revoked_at,
+             'revocationReason', nullif(trim(p_reason), '')
+           )
+   where a.id = p_agent_id
+   returning * into v_agent;
+
+  if v_agent.id is null then
+    raise exception 'agent not found' using errcode = 'P0002';
+  end if;
+
+  update agent_board.agent_credentials ac
+     set revoked_at = coalesce(ac.revoked_at, v_revoked_at),
+         updated_at = v_revoked_at,
+         metadata = coalesce(ac.metadata, '{}'::jsonb)
+           || jsonb_build_object(
+             'revokedByUserId', v_admin_user_id,
+             'revokedAt', v_revoked_at,
+             'revocationReason', nullif(trim(p_reason), '')
+           )
+   where ac.agent_id = p_agent_id
+     and ac.revoked_at is null;
+
+  return query
+  select v_agent.id, v_agent.status, v_revoked_count, v_revoked_at;
+end;
+$$;
+revoke all on function agent_board.revoke_agent(uuid, text) from public, anon, authenticated, service_role;
+grant execute on function agent_board.revoke_agent(uuid, text) to authenticated, service_role;
+comment on function agent_board.revoke_agent(uuid, text) is 'Platform-admin agent revocation preserves its admin gate and returned credential count while closing the full identity fork and descendant closure under root-before-identity locks; returns the final revoked principal status.';
+
+create function agent_board.revoke_session_identity(p_identity_agent_id uuid)
+returns void language plpgsql security definer set search_path = agent_board, public as $$
+declare v_target agent_board.session_identities%rowtype; v_id uuid; v_actor uuid := agent_board.current_agent_id();
+begin
+  if not agent_board._session_identity_owner(p_identity_agent_id)
+     and not agent_board._session_identity_revocation_actor(p_identity_agent_id) then
+    raise exception 'identity revocation requires the owner or an ancestor' using errcode = '42501';
+  end if;
+  perform 1 from agent_board.agents where id = (
+    select root_agent_id from agent_board.session_identities where agent_id = p_identity_agent_id
+  ) for update;
+  select * into v_target from agent_board.session_identities where agent_id = p_identity_agent_id for update;
+  if not found then raise exception 'identity not found' using errcode = 'P0002'; end if;
+  if not agent_board._session_identity_owner(p_identity_agent_id)
+     and not agent_board._session_identity_revocation_actor(p_identity_agent_id) then
+    raise exception 'identity revocation requires the owner or an ancestor' using errcode = '42501';
+  end if;
+  if agent_board._session_identity_owner(p_identity_agent_id) then
+    perform agent_board._assert_actor_not_fleet_revoked(v_actor, 'revoke_session_identity');
+  end if;
+  perform agent_board._revoke_agent_principal(p_identity_agent_id,
+    coalesce(v_actor, v_target.root_agent_id), 'session_identity_revoked');
+end;
+$$;
+revoke all on function agent_board.revoke_session_identity(uuid) from public, anon;
+grant execute on function agent_board.revoke_session_identity(uuid) to authenticated;
+comment on function agent_board.revoke_session_identity(uuid) is 'Owner or ancestor revocation of an identity, its descendants and its transitive forks. Each affected principal is revoked through _revoke_agent_principal and has its lease epoch fenced.';
+
+create function agent_board.readmit_session_identity(
+  p_identity_agent_id uuid, p_child_slug text, p_child_public_key text,
+  p_requested_scopes jsonb default '[]'::jsonb,
+  p_requested_rooms jsonb default '[]'::jsonb, p_ttl interval default null
+)
+returns table(child_agent_id uuid, grant_expires_at timestamptz, signing_key_id uuid)
+language plpgsql security definer set search_path = agent_board, public as $$
+declare
+  v_old agent_board.session_identities%rowtype;
+  v_parent agent_board.agents%rowtype;
+  v_original_grant agent_board.delegation_grants%rowtype;
+  v_policy agent_board.delegation_policies%rowtype;
+  v_root uuid;
+  v_owner uuid;
+  v_parent_scopes jsonb;
+  v_requested jsonb := coalesce(p_requested_scopes, '[]'::jsonb);
+  v_rooms jsonb := coalesce(p_requested_rooms, '[]'::jsonb);
+  v_alias uuid;
+  v_new_id uuid := gen_random_uuid();
+  v_new_auth uuid;
+  v_key_id uuid;
+  v_slug text;
+  v_expires timestamptz;
+  v_ceiling interval;
+  v_ancestor_expires timestamptz;
+  v_room jsonb;
+  v_board uuid;
+  v_role text;
+  v_old_role text;
+  v_membership agent_board.board_memberships%rowtype;
+begin
+  -- Owner identity comes from this authenticated session, never from an argument.
+  if not agent_board._session_identity_owner(p_identity_agent_id) then
+    raise exception 'identity readmission requires the human owner' using errcode = '42501';
+  end if;
+  if jsonb_typeof(v_requested) <> 'array' or jsonb_typeof(v_rooms) <> 'array'
+     or p_ttl <= interval '0' then raise exception 'invalid readmission authority request' using errcode = '22023'; end if;
+  -- All board locks precede the root/accounting lock and identity rows.
+  for v_board in select distinct (r ->> 'board_id')::uuid from jsonb_array_elements(v_rooms) r order by 1 loop
+    perform agent_board._lock_board_authority_ceiling(v_board);
+    perform 1 from agent_board.boards where id = v_board for key share;
+  end loop;
+  select root_agent_id into v_root from agent_board.session_identities where agent_id = p_identity_agent_id;
+  select owner_user_id into v_owner from agent_board.agents where id = v_root;
+  perform 1 from auth.users where id = v_owner for key share;
+  perform 1 from agent_board.agents where id = v_root for update;
+  select * into v_old from agent_board.session_identities where agent_id = p_identity_agent_id for update;
+  if v_old.tombstoned_at is null or v_old.tombstone_reason = 'superseded_unclaimed'
+     or v_old.forked_from is null then
+    raise exception 'identity readmission requires a revoked fork' using errcode = '42501';
+  end if;
+  if exists (select 1 from agent_board.session_identities where readmitted_from = p_identity_agent_id) then
+    raise exception 'identity_already_readmitted' using errcode = '42501';
+  end if;
+  select * into v_parent from agent_board.agents where id = v_old.parent_agent_id;
+  if v_parent.id is null or v_parent.status <> 'active' or exists (
+    select 1 from agent_board.session_identities where agent_id = v_parent.id and tombstoned_at is not null
+  ) then raise exception 'identity_parent_inactive' using errcode = '42501'; end if;
+  v_ancestor_expires := agent_board._session_identity_ancestor_ceiling(v_parent.id);
+  select * into v_original_grant from agent_board.delegation_grants g where g.child_agent_id = p_identity_agent_id;
+  select * into v_policy from agent_board.delegation_policies dp
+   where dp.root_agent_id = v_root and dp.revoked_at is null order by dp.created_at desc, dp.id desc limit 1 for update;
+  if not found or v_policy.mode <> 'root_minted' then
+    raise exception 'identity_parent_inactive' using errcode = '42501';
+  end if;
+  if v_parent.parent_agent_id is null then v_parent_scopes := v_policy.allowed_scopes;
+  else select g.granted_scopes into v_parent_scopes from agent_board.delegation_grants g where g.child_agent_id = v_parent.id;
+  end if;
+  if not (coalesce(v_parent_scopes, '[]'::jsonb) @> v_requested)
+     or not (coalesce(v_original_grant.granted_scopes, '[]'::jsonb) @> v_requested) then
+    raise exception 'scope_exceeded: readmission cannot widen original or parent scopes' using errcode = '42501';
+  end if;
+  perform agent_board._session_identity_check_limits(v_root, v_parent.id);
+  -- The most recently bound alias is reserved; no caller supplies a session id.
+  select a.id into v_alias from agent_board.session_id_aliases a
+   where a.identity_agent_id = p_identity_agent_id and a.id = v_old.lease_alias_id for update;
+  if v_alias is null then raise exception 'identity_continuity_refused' using errcode = '42501'; end if;
+  v_slug := agent_board._normalize_provision_slug(p_child_slug);
+  if exists (select 1 from agent_board.agents where handle = v_slug) then
+    raise exception 'readmission requires a new unique agent handle' using errcode = '23505';
+  end if;
+  if p_child_public_key is null or p_child_public_key = repeat('A', 43) then
+    raise exception 'readmission requires a fresh child public key' using errcode = '22023';
+  end if;
+  if exists (select 1 from agent_board.agent_signing_keys k where k.agent_id = p_identity_agent_id and k.public_key = p_child_public_key) then
+    raise exception 'readmission cannot reuse the revoked key' using errcode = '42501';
+  end if;
+  v_new_auth := agent_board._ensure_agent_auth_user(v_slug);
+  v_ceiling := least(v_policy.child_ttl_ceiling, v_policy.operator_child_ttl_ceiling, interval '24 hours');
+  v_expires := least(now() + least(coalesce(p_ttl, v_ceiling), v_ceiling), v_ancestor_expires);
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id,
+    parent_agent_id, root_agent_id, metadata)
+  values (v_new_id, 'agent', 'agent'::agent_board.agent_kind, v_slug, agent_board._default_provision_display_name(v_slug),
+    'active', v_new_auth, v_parent.owner_user_id, v_parent.id, v_root, jsonb_build_object('readmittedFrom', p_identity_agent_id));
+  insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format,
+    fingerprint, status, proof_state, metadata)
+  values (v_new_id, 'readmitted-ephemeral', 1, p_child_public_key, 'raw_ed25519_base64url',
+    agent_board._raw_key_fingerprint(p_child_public_key), 'pending_proof', 'unproven', jsonb_build_object('readmittedFrom', p_identity_agent_id))
+  returning id into v_key_id;
+  insert into agent_board.delegation_grants(child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id,
+    granted_scopes, grant_expires_at)
+  values (v_new_id, v_root, v_parent.id, v_policy.id, v_requested, v_expires);
+  insert into agent_board.session_identities(agent_id, parent_agent_id, root_agent_id, depth, identity_kind, harness,
+    forked_from, readmitted_from, current_risky_digest, recorded_fingerprint, resolution_state)
+  values (v_new_id, v_parent.id, v_root, v_old.depth, 'session', v_old.harness, v_old.forked_from,
+    p_identity_agent_id, v_old.current_risky_digest, v_old.recorded_fingerprint, 'frozen');
+  update agent_board.session_id_aliases set identity_agent_id = v_new_id where identity_agent_id = p_identity_agent_id;
+  update agent_board.session_identities set lease_alias_id = v_alias where agent_id = v_new_id;
+  perform agent_board._refuse_delegate_membership_target(v_new_id, 'readmit_session_identity');
+  for v_room in select value from jsonb_array_elements(v_rooms) order by value ->> 'board_id' loop
+    v_board := (v_room ->> 'board_id')::uuid;
+    v_role := v_room ->> 'role';
+    select bm.role into v_old_role from agent_board.board_memberships bm
+     where bm.board_id = v_board and bm.agent_id = p_identity_agent_id
+     order by case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+       bm.created_at desc, bm.id desc limit 1;
+    if v_role not in ('owner', 'admin', 'member', 'observer') or v_role is null or v_old_role is null
+       or agent_board._role_rank(v_role) > agent_board._role_rank(v_old_role)
+       or not agent_board._grant_within_ceiling(v_parent.id, v_board, v_role) then
+      raise exception 'room_authority_exceeded' using errcode = '42501';
+    end if;
+    select * into v_membership from agent_board._upsert_board_membership_state(v_board, v_new_id, 'joined');
+    update agent_board.board_memberships set role = v_role where id = v_membership.id;
+  end loop;
+  perform agent_board._assert_actor_not_fleet_revoked(agent_board.current_agent_id(), 'readmit_session_identity');
+  return query select v_new_id, v_expires, v_key_id;
+end;
+$$;
+revoke all on function agent_board.readmit_session_identity(uuid, text, text, jsonb, jsonb, interval) from public, anon, service_role;
+grant execute on function agent_board.readmit_session_identity(uuid, text, text, jsonb, jsonb, interval) to authenticated;
+comment on function agent_board.readmit_session_identity(uuid, text, text, jsonb, jsonb, interval) is 'Human root owner readmits a selected revoked fork by minting a fresh principal, unclaimed frozen identity and pending fresh key. The old principal, key and permanent ledger remain revoked. Parent/original scopes and roles only shrink, all ancestors and mint quotas are checked under the root lock, all aliases repoint and the latest is reserved. Approve the resolved fingerprint and prove the pending key via record_signing_key_proof_result before first claim.';
+
+create function agent_board.rename_agent(p_agent_id uuid, p_display_name text)
+returns void language plpgsql security definer set search_path = agent_board, public as $$
+begin
+  if p_display_name is null or length(trim(p_display_name)) = 0 then
+    raise exception 'display name is required' using errcode = '22023';
+  end if;
+  if not exists (
+    select 1 from agent_board.agents target join agent_board.agents human
+      on human.auth_user_id = auth.uid()
+     where target.id = p_agent_id and target.owner_user_id = auth.uid()
+       and human.agent_type = 'human' and human.status = 'active'
+  ) then
+    raise exception 'agent rename requires the human owner' using errcode = '42501';
+  end if;
+  perform agent_board._assert_actor_not_fleet_revoked(agent_board.current_agent_id(), 'rename_agent');
+  update agent_board.agents set display_name = p_display_name, updated_at = now() where id = p_agent_id;
+end;
+$$;
+revoke all on function agent_board.rename_agent(uuid, text) from public, anon;
+grant execute on function agent_board.rename_agent(uuid, text) to authenticated;
+comment on function agent_board.rename_agent(uuid, text) is 'Human-owner-only display-name update. Agent handles remain immutable.';
+
+create function agent_board.set_board_member_label(p_board_id uuid, p_agent_id uuid, p_label text)
+returns void language plpgsql security definer set search_path = agent_board, public as $$
+declare v_actor uuid := agent_board.current_agent_id();
+begin
+  if v_actor is null or not exists (
+    select 1 from agent_board.board_memberships bm
+     where bm.board_id = p_board_id and bm.agent_id = v_actor and bm.role in ('owner', 'admin')
+       and bm.membership_state in ('joined', 'subscribed')
+  ) then
+    raise exception 'board label requires a board owner or admin' using errcode = '42501';
+  end if;
+  if length(p_label) > 200 then raise exception 'board label exceeds 200 characters' using errcode = '22023'; end if;
+  perform agent_board._refuse_delegate_membership_target(p_agent_id, 'set_board_member_label');
+  update agent_board.board_memberships
+     set metadata = metadata || jsonb_build_object('label', p_label), updated_at = now()
+   where board_id = p_board_id and agent_id = p_agent_id;
+  if not found then raise exception 'membership not found on this board' using errcode = 'P0002'; end if;
+end;
+$$;
+revoke all on function agent_board.set_board_member_label(uuid, uuid, text) from public, anon;
+grant execute on function agent_board.set_board_member_label(uuid, uuid, text) to authenticated;
+comment on function agent_board.set_board_member_label(uuid, uuid, text) is 'Board-admin-only local membership label. It changes membership metadata on the named board and never the agent handle or global display name.';
+
+-- Catalog-derived by agent_board_atomic_fleet_onboarding.test.sql. Adding the
+-- three SIDSCHEMA readers changes the helper's machine-checked registry too.
+create or replace function agent_board.tombstone_delegate_instance(
+  p_instance_id text, p_issuer text, p_owner_sub text, p_reason text)
+returns table(instance_id text, tombstoned_at timestamptz, first boolean)
+language plpgsql
+security definer
+set search_path = ''
+as $fn$
+#variable_conflict use_column
+declare
+  v_owner uuid;
+  v_owner_slug text;
+  v_inserted boolean;
+  v_row agent_board.delegate_instances%rowtype;
+  v_board uuid;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'tombstone_delegate_instance is service_role-only' using errcode = '42501';
+  end if;
+  if p_instance_id is null or p_instance_id !~ '^[A-Za-z0-9_-]{16,128}$'
+     or coalesce(p_issuer, '') = '' or coalesce(p_owner_sub, '') = ''
+     or p_reason is null
+     or p_reason not in ('owner_revoked', 'owner_retired_after_upgrade', 'owner_account_closed', 'portal_admin') then
+    raise exception 'revocation_malformed' using errcode = '22023';
+  end if;
+
+  -- Board advisory mutexes precede every owner/instance and identity-family row lock,
+  -- as in onboarding and add_delegate_to_board. Lock all existing boards in UUID order:
+  -- an active-membership snapshot misses a concurrent placement onto another board,
+  -- which takes that board mutex and the owner's agents row before the instance row.
+  -- Taking a board mutex after the instance row would invert that established order.
+  for v_board in select b.id from agent_board.boards b order by b.id loop
+    perform agent_board._lock_board_authority_ceiling(v_board);
+  end loop;
+
+  -- The owner lock, then the owner, exactly as the exchange takes and derives them (same key,
+  -- same position: before the instance row), so a revocation and an exchange of a new owner's
+  -- instance never provision two auth users for one owner.
+  v_owner_slug := agent_board._federated_identity_slug(p_issuer, p_owner_sub);
+  perform pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended('agent_board.delegate_owner:' || v_owner_slug, 0));
+  v_owner := agent_board._ensure_agent_auth_user(v_owner_slug);
+
+  -- HOSTED #591: NO auth.users ROW LOCK here, deliberately, unlike the exchange. This function
+  -- reaches boards (update_board_membership below writes board_membership_events, whose foreign
+  -- key takes FOR KEY SHARE on the board), and every route that locks both a board and an owner
+  -- row must take the board first (agent_board_federated_lock_order_class EC-3):
+  -- enroll_federated_human holds its default board FOR UPDATE and then wants the owner's row FOR
+  -- UPDATE, so an owner-row lock taken here first closes a cycle with it. The deadlock against
+  -- revoke_human_subtree (#591 item 8) is closed by the agents-row order below instead
+  -- (hosted_delegate_tombstone_revoke_race P1, P2). What the owner-row lock would have added is
+  -- stated in AB15: see revoke_human_subtree (section 4).
+
+  -- A revocation BEFORE the first exchange creates the tombstoned row, so the first exchange
+  -- is refused. Insert-then-lock, as the exchange does, so a concurrent exchange serialises.
+  -- HOSTED #591: with the owner's verified (iss, sub) (section 1).
+  insert into agent_board.delegate_instances as di(
+    instance_id, owner_user_id, owner_issuer, owner_subject, tombstoned_at, tombstone_reason)
+  values (p_instance_id, v_owner, p_issuer, p_owner_sub, now(), p_reason)
+  on conflict (instance_id) do nothing
+  returning true into v_inserted;
+
+  if v_inserted then
+    return query select p_instance_id, now(), true;
+    return;
+  end if;
+
+  select * into v_row
+    from agent_board.delegate_instances di
+   where di.instance_id = p_instance_id
+   for update;
+
+  if v_row.owner_user_id is distinct from v_owner then
+    raise exception 'owner_mismatch' using errcode = '42501';
+  end if;
+
+  -- Idempotent: the key is the instance, and a tombstone is permanent.
+  if v_row.tombstoned_at is not null then
+    -- HOSTED #591: a legacy (pre-1.59.0) tombstoned row has no owner pair, and nothing else ever
+    -- writes it again: the exchange refuses it (instance_revoked) before its UPDATE. So a repeated
+    -- revocation fills the pair here, and nothing else about the row changes. Sound for the same
+    -- reason as the fill below: owner_mismatch above proved this row's uid is the one
+    -- (p_issuer, p_owner_sub) derives. A recorded pair is never touched (the trigger refuses).
+    if v_row.owner_issuer is null then
+      update agent_board.delegate_instances di
+         set owner_issuer = p_issuer,
+             owner_subject = p_owner_sub
+       where di.instance_id = p_instance_id;
+    end if;
+    return query select v_row.instance_id, v_row.tombstoned_at, false;
+    return;
+  end if;
+
+  update agent_board.delegate_instances di
+     set tombstoned_at = now(),
+         tombstone_reason = p_reason,
+         -- HOSTED #591: fills a legacy row's null pair; sound because owner_mismatch above
+         -- proved this row's uid is the one (p_issuer, p_owner_sub) derives.
+         owner_issuer = coalesce(di.owner_issuer, p_issuer),
+         owner_subject = coalesce(di.owner_subject, p_owner_sub),
+         updated_at = now()
+   where di.instance_id = p_instance_id;
+
+  if v_row.agent_id is not null then
+    for v_board in
+      select bm.board_id from agent_board.board_memberships bm
+       where bm.agent_id = v_row.agent_id and bm.membership_state in ('joined', 'subscribed')
+       order by bm.board_id
+    loop
+      perform 1 from agent_board.boards b where b.id = v_board for key share of b;
+    end loop;
+    perform agent_board._revoke_session_identity_family(v_row.agent_id, v_row.agent_id, 'instance_tombstoned');
+    -- HOSTED #591 (item 8): THE DELEGATE'S agents ROW FIRST, before any credential. Every other
+    -- writer of a delegate's agents row and its credentials takes the agents row first
+    -- (_revoke_agent_principal, for revoke_agent_subtree and revoke_human_subtree: FOR UPDATE,
+    -- then credentials; revoke_agent: its UPDATE, then credentials). This UPDATE used to come
+    -- last, after the credentials and the memberships, so either subtree revoker interleaved
+    -- with a tombstone of the same delegate deadlocked (hosted_delegate_tombstone_revoke_race
+    -- P1, P2). It is the same statement and the same FOR NO KEY UPDATE lock the 1.58.0 function
+    -- took, moved ahead; it adds no lock. FOR NO KEY UPDATE does not block the FOR KEY SHARE of a
+    -- foreign-key check, so add_delegate_to_board's sink insert is not newly blocked (the two
+    -- already serialise on the instance row above). An agent already revoked and committed is
+    -- not matched and not locked; its revoker has finished, so there is nothing to order against.
+    update agent_board.agents a
+       set status = 'revoked', updated_at = now()
+     where a.id = v_row.agent_id
+       and a.status <> 'revoked';
+
+    update agent_board.agent_credentials ac
+       set revoked_at = coalesce(ac.revoked_at, now()),
+           updated_at = now(),
+           metadata = coalesce(ac.metadata, '{}'::jsonb)
+             || jsonb_build_object('revocationReason', 'instance_tombstoned', 'tombstoneReason', p_reason)
+     where ac.agent_id = v_row.agent_id
+       and ac.revoked_at is null;
+
+    -- Every active membership ends through update_board_membership(..., 'left') under
+    -- service_role, so each ends with an append-only operator_removal event.
+    for v_board in
+      select bm.board_id
+        from agent_board.board_memberships bm
+       where bm.agent_id = v_row.agent_id
+         and bm.membership_state in ('joined', 'subscribed')
+       order by bm.board_id
+    loop
+      perform agent_board.update_board_membership(v_board, v_row.agent_id, 'left');
+    end loop;
+  end if;
+
+  return query select p_instance_id, now(), true;
+end;
+$fn$;
+
+revoke all on function agent_board.tombstone_delegate_instance(text, text, text, text) from public, anon, authenticated;
+grant execute on function agent_board.tombstone_delegate_instance(text, text, text, text) to service_role;
+
+comment on function agent_board.tombstone_delegate_instance(text,text,text,text) is 'Service-only verified Portal instance tombstone, preserving owner/instance gates, permanent instance state, legacy principal credential and membership behavior. Closes any session descendants and transitive forks through the shared identity-family primitive before principal credentials; never revives an identity.';
+
+comment on function agent_board._lock_board_authority_ceiling(uuid) is
+  'Board-keyed transaction advisory lock serializing the ABSENCE of a board_authority_ceilings row, held to commit. WRITERS[serialized: set_board_authority_ceiling][UNSERIALIZED: (none)] READERS[serialized: add_delegate_to_board, grant_board_role, link_session_alias, mint_delegated_child, onboard_federated_fleet_agent, readmit_session_identity][UNSERIALIZED: _redeem_unbounded_invite_for_agent, create_invite_link] The SIDSCHEMA readers take the mutexes for every requested or existing descendant room before root, identity and membership locks. The two UNSERIALIZED readers still evaluate a missing ceiling as default-owner without serializing its absence; that known race (message-board#277) is not changed here. Both lists are machine-compared against the catalog; a new reader/writer or changed serialization state fails by name. Internal invoker helper, not an authorization gate; caller privileges determine table access.';