@consiliency/agent-board-schema 1.60.0 → 1.64.0

package/tests/isolation/expected/session_identity_limits.out

@@ -0,0 +1,165 @@
+Parsed test spec with 3 sessions
+
+starting permutation: a_begin a_mint b_begin b_mint a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_mint: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-a', '[]',
+      public.test_pubkey('sid-limit-a'), interval '1 hour', false, 'codex', 'limit-a');
+  end $$;
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_mint: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-b', '[]',
+      public.test_pubkey('sid-limit-b'), interval '1 hour', false, 'codex', 'limit-b');
+  end $$;
+ <waiting ...>
+step a_commit: COMMIT;
+step b_mint: <... completed>
+ERROR:  identity_limit_hourly_exceeded
+step b_commit: COMMIT;
+step check: 
+  select count(*) as mixed_hourly, count(*) filter (where revoked_at is not null) as tombstoned_hourly
+  from agent_board.delegation_grants where root_agent_id = '78000000-0000-4000-8000-000000000001';
+  select count(*) as new_principals from agent_board.agents where handle in ('sid-limit-a', 'sid-limit-b');
+  select count(*) as aliases from agent_board.session_id_aliases where root_agent_id = '78000000-0000-4000-8000-000000000001';
+
+mixed_hourly|tombstoned_hourly
+------------+-----------------
+          60|               29
+(1 row)
+
+new_principals
+--------------
+             1
+(1 row)
+
+aliases
+-------
+      1
+(1 row)
+
+
+starting permutation: b_begin b_mint a_begin a_mint b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_mint: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-b', '[]',
+      public.test_pubkey('sid-limit-b'), interval '1 hour', false, 'codex', 'limit-b');
+  end $$;
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_mint: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-a', '[]',
+      public.test_pubkey('sid-limit-a'), interval '1 hour', false, 'codex', 'limit-a');
+  end $$;
+ <waiting ...>
+step b_commit: COMMIT;
+step a_mint: <... completed>
+ERROR:  identity_limit_hourly_exceeded
+step a_commit: COMMIT;
+step check: 
+  select count(*) as mixed_hourly, count(*) filter (where revoked_at is not null) as tombstoned_hourly
+  from agent_board.delegation_grants where root_agent_id = '78000000-0000-4000-8000-000000000001';
+  select count(*) as new_principals from agent_board.agents where handle in ('sid-limit-a', 'sid-limit-b');
+  select count(*) as aliases from agent_board.session_id_aliases where root_agent_id = '78000000-0000-4000-8000-000000000001';
+
+mixed_hourly|tombstoned_hourly
+------------+-----------------
+          60|               29
+(1 row)
+
+new_principals
+--------------
+             1
+(1 row)
+
+aliases
+-------
+      1
+(1 row)
+
+
+starting permutation: a_begin a_mint b_begin b_duplicate a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_mint: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-a', '[]',
+      public.test_pubkey('sid-limit-a'), interval '1 hour', false, 'codex', 'limit-a');
+  end $$;
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_duplicate: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-b', '[]',
+      public.test_pubkey('sid-limit-b'), interval '1 hour', false, 'codex', 'limit-a');
+  end $$;
+ <waiting ...>
+step a_commit: COMMIT;
+step b_duplicate: <... completed>
+ERROR:  identity_lease_live
+step b_commit: COMMIT;
+step check: 
+  select count(*) as mixed_hourly, count(*) filter (where revoked_at is not null) as tombstoned_hourly
+  from agent_board.delegation_grants where root_agent_id = '78000000-0000-4000-8000-000000000001';
+  select count(*) as new_principals from agent_board.agents where handle in ('sid-limit-a', 'sid-limit-b');
+  select count(*) as aliases from agent_board.session_id_aliases where root_agent_id = '78000000-0000-4000-8000-000000000001';
+
+mixed_hourly|tombstoned_hourly
+------------+-----------------
+          60|               29
+(1 row)
+
+new_principals
+--------------
+             1
+(1 row)
+
+aliases
+-------
+      1
+(1 row)
+
+
+starting permutation: b_begin b_duplicate a_begin a_mint b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_duplicate: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-b', '[]',
+      public.test_pubkey('sid-limit-b'), interval '1 hour', false, 'codex', 'limit-a');
+  end $$;
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_mint: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('78000000-0000-4000-8000-000000000001', 'sid-limit-a', '[]',
+      public.test_pubkey('sid-limit-a'), interval '1 hour', false, 'codex', 'limit-a');
+  end $$;
+ <waiting ...>
+step b_commit: COMMIT;
+step a_mint: <... completed>
+ERROR:  identity_lease_live
+step a_commit: COMMIT;
+step check: 
+  select count(*) as mixed_hourly, count(*) filter (where revoked_at is not null) as tombstoned_hourly
+  from agent_board.delegation_grants where root_agent_id = '78000000-0000-4000-8000-000000000001';
+  select count(*) as new_principals from agent_board.agents where handle in ('sid-limit-a', 'sid-limit-b');
+  select count(*) as aliases from agent_board.session_id_aliases where root_agent_id = '78000000-0000-4000-8000-000000000001';
+
+mixed_hourly|tombstoned_hourly
+------------+-----------------
+          60|               29
+(1 row)
+
+new_principals
+--------------
+             1
+(1 row)
+
+aliases
+-------
+      1
+(1 row)
+

package/tests/isolation/expected/session_identity_links.out

@@ -0,0 +1,235 @@
+Parsed test spec with 3 sessions
+
+starting permutation: a_begin a_link b_begin b_same a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_same: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a'); <waiting ...>
+step a_commit: COMMIT;
+step b_same: <... completed>
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_commit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      2|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes   |role 
+-----------------+-----
+["read", "write"]|admin
+(1 row)
+
+
+starting permutation: b_begin b_same a_begin a_link b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_same: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a'); <waiting ...>
+step b_commit: COMMIT;
+step a_link: <... completed>
+link_session_alias
+------------------
+                  
+(1 row)
+
+step a_commit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      2|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes   |role 
+-----------------+-----
+["read", "write"]|admin
+(1 row)
+
+
+starting permutation: a_begin a_link b_begin b_other a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_other: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-b'); <waiting ...>
+step a_commit: COMMIT;
+step b_other: <... completed>
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_commit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      3|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes   |role 
+-----------------+-----
+["read", "write"]|admin
+(1 row)
+
+
+starting permutation: a_begin a_link b_begin b_narrow a_commit b_commit a_rebegin a_relink a_recommit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_narrow: 
+  select role from agent_board.grant_board_role('74000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000001', 'observer', '72000000-0000-4000-8000-000000000001');
+  select allowed_scopes from agent_board.upsert_delegation_policy('72000000-0000-4000-8000-000000000001', 'root_minted', '["read"]', 200, interval '8 hours', true);
+ <waiting ...>
+step a_commit: COMMIT;
+step b_narrow: <... completed>
+role    
+--------
+observer
+(1 row)
+
+allowed_scopes
+--------------
+["read"]      
+(1 row)
+
+step b_commit: COMMIT;
+step a_rebegin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_relink: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a');
+link_session_alias
+------------------
+                  
+(1 row)
+
+step a_recommit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      2|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes|role    
+--------------+--------
+["read"]      |observer
+(1 row)
+
+
+starting permutation: b_begin b_narrow a_begin a_link b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step b_narrow: 
+  select role from agent_board.grant_board_role('74000000-0000-4000-8000-000000000002', '72000000-0000-4000-8000-000000000001', 'observer', '72000000-0000-4000-8000-000000000001');
+  select allowed_scopes from agent_board.upsert_delegation_policy('72000000-0000-4000-8000-000000000001', 'root_minted', '["read"]', 200, interval '8 hours', true);
+
+role    
+--------
+observer
+(1 row)
+
+allowed_scopes
+--------------
+["read"]      
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role'; SET LOCAL "request.jwt.claim.sub" = '71000000-0000-4000-8000-000000000001';
+step a_link: select agent_board.link_session_alias('72000000-0000-4000-8000-000000000002', '0', 'continued-a'); <waiting ...>
+step b_commit: COMMIT;
+step a_link: <... completed>
+link_session_alias
+------------------
+                  
+(1 row)
+
+step a_commit: COMMIT;
+step check: 
+  select count(*) as aliases, count(distinct identity_agent_id) as identities
+  from agent_board.session_id_aliases where root_agent_id = '72000000-0000-4000-8000-000000000001';
+  select credential_epoch, holder_secret_hash = extensions.digest('isolation-holder', 'sha256') as unchanged_holder
+  from agent_board.session_identities where agent_id = '72000000-0000-4000-8000-000000000002';
+  select granted_scopes, role from agent_board.delegation_grants g join agent_board.board_memberships bm on bm.agent_id = g.child_agent_id
+  where g.child_agent_id = '72000000-0000-4000-8000-000000000002' and bm.board_id = '74000000-0000-4000-8000-000000000002';
+
+aliases|identities
+-------+----------
+      2|         1
+(1 row)
+
+credential_epoch|unchanged_holder
+----------------+----------------
+               0|t               
+(1 row)
+
+granted_scopes|role    
+--------------+--------
+["read"]      |observer
+(1 row)
+

package/tests/isolation/expected/session_identity_reclaim.out

@@ -0,0 +1,253 @@
+Parsed test spec with 3 sessions
+
+starting permutation: a_begin a_reclaim b_begin b_reclaim a_commit b_commit check
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_reclaim: 
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-a');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000001', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_reclaim: 
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-b');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000002', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+ <waiting ...>
+step a_commit: COMMIT;
+step b_reclaim: <... completed>
+ERROR:  duplicate_live_session
+step b_commit: COMMIT;
+step check: 
+  select credential_epoch, holder_secret_hash <> extensions.digest('old-holder', 'sha256') as rotated_holder,
+    a.session_id as bound_alias
+  from agent_board.session_identities si join agent_board.session_id_aliases a on a.id = si.lease_alias_id
+  where si.agent_id = '75000000-0000-4000-8000-000000000002';
+  select count(*) as tokens from agent_board.nonfleet_sessions where agent_id = '75000000-0000-4000-8000-000000000002';
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '74000000-0000-4000-8000-000000000001';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+  select agent_board.current_agent_id() is null as old_epoch_fenced;
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '1';
+  select agent_board.current_agent_id() = '75000000-0000-4000-8000-000000000002'::uuid as new_epoch_resolves;
+  COMMIT;
+
+credential_epoch|rotated_holder|bound_alias
+----------------+--------------+-----------
+               1|t             |resumed    
+(1 row)
+
+tokens
+------
+     1
+(1 row)
+
+old_epoch_fenced
+----------------
+t               
+(1 row)
+
+new_epoch_resolves
+------------------
+t                 
+(1 row)
+
+
+starting permutation: b_begin b_reclaim a_begin a_reclaim b_commit a_commit check
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_reclaim: 
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-b');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000002', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_reclaim: 
+  do $$ declare c record; begin
+    select * into c from agent_board.issue_signing_key_challenge('75000000-0000-4000-8000-000000000002', 'holder-a');
+    perform * from agent_board.mint_fleet_agent_session(c.challenge_id, split_part(c.challenge, ':', 3),
+      '76000000-0000-4000-8000-000000000001', '75000000-0000-4000-8000-000000000002', 900, null, 'resumed');
+  end; $$;
+ <waiting ...>
+step b_commit: COMMIT;
+step a_reclaim: <... completed>
+ERROR:  duplicate_live_session
+step a_commit: COMMIT;
+step check: 
+  select credential_epoch, holder_secret_hash <> extensions.digest('old-holder', 'sha256') as rotated_holder,
+    a.session_id as bound_alias
+  from agent_board.session_identities si join agent_board.session_id_aliases a on a.id = si.lease_alias_id
+  where si.agent_id = '75000000-0000-4000-8000-000000000002';
+  select count(*) as tokens from agent_board.nonfleet_sessions where agent_id = '75000000-0000-4000-8000-000000000002';
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '74000000-0000-4000-8000-000000000001';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+  select agent_board.current_agent_id() is null as old_epoch_fenced;
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '1';
+  select agent_board.current_agent_id() = '75000000-0000-4000-8000-000000000002'::uuid as new_epoch_resolves;
+  COMMIT;
+
+credential_epoch|rotated_holder|bound_alias
+----------------+--------------+-----------
+               1|t             |resumed    
+(1 row)
+
+tokens
+------
+     1
+(1 row)
+
+old_epoch_fenced
+----------------
+t               
+(1 row)
+
+new_epoch_resolves
+------------------
+t                 
+(1 row)
+
+
+starting permutation: prepare_stale a_begin a_first_claim b_begin b_supersede a_commit b_commit check_stale
+step prepare_stale: 
+  update agent_board.agents set owner_user_id = '74000000-0000-4000-8000-000000000001'
+  where id = '75000000-0000-4000-8000-000000000001';
+  BEGIN;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  select count(*) from agent_board.upsert_delegation_policy('75000000-0000-4000-8000-000000000001', 'root_minted', '[]', 200, interval '8 hours', true);
+  do $$ declare m record; begin
+    select * into m from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-old', '[]',
+      public.test_pubkey('sid-stale-old'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+    perform * from agent_board.issue_signing_key_challenge(m.child_agent_id, 'delegated-ephemeral');
+  end $$;
+  COMMIT;
+  update agent_board.session_identities set created_at = now() - interval '181 seconds'
+  where agent_id = (select id from agent_board.agents where handle = 'sid-stale-old');
+
+count
+-----
+    1
+(1 row)
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_first_claim: 
+  do $$ declare a uuid; k uuid; c record; begin
+    select id into a from agent_board.agents where handle = 'sid-stale-old';
+    select id into k from agent_board.agent_signing_keys where agent_id = a;
+    select id, challenge_nonce into c from agent_board.agent_signing_key_challenges where agent_id = a order by created_at desc limit 1;
+    perform * from agent_board.mint_fleet_agent_session(c.id, c.challenge_nonce, k, a, 900, null, 'stale-reservation');
+  end $$;
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_supersede: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-new', '[]',
+      public.test_pubkey('sid-stale-new'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+  end $$;
+ <waiting ...>
+step a_commit: COMMIT;
+step b_supersede: <... completed>
+ERROR:  duplicate_live_session
+step b_commit: COMMIT;
+step check_stale: 
+  select a.status, si.tombstone_reason, si.credential_epoch, si.holder_secret_hash is not null as claimed,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id where a.handle = 'sid-stale-old';
+  select a.handle as bound_principal from agent_board.session_id_aliases al join agent_board.agents a on a.id = al.identity_agent_id
+  where al.root_agent_id = '75000000-0000-4000-8000-000000000001' and al.session_id = 'stale-reservation';
+  select count(*) as successor_principals from agent_board.agents where handle = 'sid-stale-new';
+
+status|tombstone_reason|credential_epoch|claimed|permanent_revocations
+------+----------------+----------------+-------+---------------------
+active|                |               0|t      |                    0
+(1 row)
+
+bound_principal
+---------------
+sid-stale-old  
+(1 row)
+
+successor_principals
+--------------------
+                   0
+(1 row)
+
+
+starting permutation: prepare_stale b_begin b_supersede a_begin a_first_claim b_commit a_commit check_stale
+step prepare_stale: 
+  update agent_board.agents set owner_user_id = '74000000-0000-4000-8000-000000000001'
+  where id = '75000000-0000-4000-8000-000000000001';
+  BEGIN;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  select count(*) from agent_board.upsert_delegation_policy('75000000-0000-4000-8000-000000000001', 'root_minted', '[]', 200, interval '8 hours', true);
+  do $$ declare m record; begin
+    select * into m from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-old', '[]',
+      public.test_pubkey('sid-stale-old'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+    perform * from agent_board.issue_signing_key_challenge(m.child_agent_id, 'delegated-ephemeral');
+  end $$;
+  COMMIT;
+  update agent_board.session_identities set created_at = now() - interval '181 seconds'
+  where agent_id = (select id from agent_board.agents where handle = 'sid-stale-old');
+
+count
+-----
+    1
+(1 row)
+
+step b_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step b_supersede: 
+  do $$ begin
+    perform * from agent_board.mint_delegated_child('75000000-0000-4000-8000-000000000001', 'sid-stale-new', '[]',
+      public.test_pubkey('sid-stale-new'), interval '1 hour', false, 'claude', 'stale-reservation', null, '[]',
+      jsonb_build_object('resolution', 'resolved', 'risky_digest', 'approved'));
+  end $$;
+
+step a_begin: BEGIN; SET LOCAL ROLE service_role; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step a_first_claim: 
+  do $$ declare a uuid; k uuid; c record; begin
+    select id into a from agent_board.agents where handle = 'sid-stale-old';
+    select id into k from agent_board.agent_signing_keys where agent_id = a;
+    select id, challenge_nonce into c from agent_board.agent_signing_key_challenges where agent_id = a order by created_at desc limit 1;
+    perform * from agent_board.mint_fleet_agent_session(c.id, c.challenge_nonce, k, a, 900, null, 'stale-reservation');
+  end $$;
+ <waiting ...>
+step b_commit: COMMIT;
+step a_first_claim: <... completed>
+ERROR:  identity_tombstoned
+step a_commit: COMMIT;
+step check_stale: 
+  select a.status, si.tombstone_reason, si.credential_epoch, si.holder_secret_hash is not null as claimed,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id where a.handle = 'sid-stale-old';
+  select a.handle as bound_principal from agent_board.session_id_aliases al join agent_board.agents a on a.id = al.identity_agent_id
+  where al.root_agent_id = '75000000-0000-4000-8000-000000000001' and al.session_id = 'stale-reservation';
+  select count(*) as successor_principals from agent_board.agents where handle = 'sid-stale-new';
+
+status |tombstone_reason    |credential_epoch|claimed|permanent_revocations
+-------+--------------------+----------------+-------+---------------------
+revoked|superseded_unclaimed|               1|f      |                    1
+(1 row)
+
+bound_principal
+---------------
+sid-stale-new  
+(1 row)
+
+successor_principals
+--------------------
+                   1
+(1 row)
+