@consiliency/agent-board-schema 1.60.0 → 1.64.0

package/tests/isolation/expected/session_identity_renew_revoke.out

@@ -0,0 +1,115 @@
+Parsed test spec with 3 sessions
+
+starting permutation: renew_begin renew revoke_begin revoke renew_commit revoke_commit check
+step renew_begin: 
+  BEGIN;
+  select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where handle = 'sid-renew-child'), true) is not null as holder_forwarded;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+
+holder_forwarded
+----------------
+t               
+(1 row)
+
+step renew: 
+  select agent_board.renew_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'), 'approved');
+
+renew_session_identity
+----------------------
+                      
+(1 row)
+
+step revoke_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '81000000-0000-4000-8000-000000000001';
+
+step revoke: 
+  select agent_board.revoke_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'));
+ <waiting ...>
+step renew_commit: COMMIT;
+step revoke: <... completed>
+revoke_session_identity
+-----------------------
+                       
+(1 row)
+
+step revoke_commit: COMMIT;
+step check: 
+  select si.tombstone_reason, si.credential_epoch, a.status, g.revoked_at is not null as grant_revoked,
+    g.last_renewed_at is not null as renewal_preceded_revoke,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations,
+    (select count(*) from agent_board.agent_signing_keys k where k.agent_id = a.id and k.status <> 'revoked') as active_keys
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id
+    join agent_board.delegation_grants g on g.child_agent_id = a.id where a.handle = 'sid-renew-child';
+  select bool_and(expires_at <= issued_at + interval '900 seconds') as bounded_pre_revoke_tokens
+  from agent_board.nonfleet_sessions where agent_id = (select id from agent_board.agents where handle = 'sid-renew-child');
+
+tombstone_reason|credential_epoch|status |grant_revoked|renewal_preceded_revoke|permanent_revocations|active_keys
+----------------+----------------+-------+-------------+-----------------------+---------------------+-----------
+revoked         |               1|revoked|t            |t                      |                    1|          0
+(1 row)
+
+bounded_pre_revoke_tokens
+-------------------------
+t                        
+(1 row)
+
+
+starting permutation: revoke_begin revoke renew_begin renew revoke_commit renew_commit check
+step revoke_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '81000000-0000-4000-8000-000000000001';
+
+step revoke: 
+  select agent_board.revoke_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'));
+
+revoke_session_identity
+-----------------------
+                       
+(1 row)
+
+step renew_begin: 
+  BEGIN;
+  select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where handle = 'sid-renew-child'), true) is not null as holder_forwarded;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+
+holder_forwarded
+----------------
+t               
+(1 row)
+
+step renew: 
+  select agent_board.renew_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'), 'approved');
+ <waiting ...>
+step revoke_commit: COMMIT;
+step renew: <... completed>
+ERROR:  identity_tombstoned
+step renew_commit: COMMIT;
+step check: 
+  select si.tombstone_reason, si.credential_epoch, a.status, g.revoked_at is not null as grant_revoked,
+    g.last_renewed_at is not null as renewal_preceded_revoke,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations,
+    (select count(*) from agent_board.agent_signing_keys k where k.agent_id = a.id and k.status <> 'revoked') as active_keys
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id
+    join agent_board.delegation_grants g on g.child_agent_id = a.id where a.handle = 'sid-renew-child';
+  select bool_and(expires_at <= issued_at + interval '900 seconds') as bounded_pre_revoke_tokens
+  from agent_board.nonfleet_sessions where agent_id = (select id from agent_board.agents where handle = 'sid-renew-child');
+
+tombstone_reason|credential_epoch|status |grant_revoked|renewal_preceded_revoke|permanent_revocations|active_keys
+----------------+----------------+-------+-------------+-----------------------+---------------------+-----------
+revoked         |               1|revoked|t            |f                      |                    1|          0
+(1 row)
+
+bounded_pre_revoke_tokens
+-------------------------
+t                        
+(1 row)
+

package/tests/isolation/expected/session_identity_renew_revoke_key_gate.out

@@ -0,0 +1,138 @@
+Parsed test spec with 4 sessions
+
+starting permutation: key_begin key_hold revoke_begin revoke renew_begin renew key_commit revoke_commit renew_commit check
+step key_begin: BEGIN;
+step key_hold: 
+  select 1 as held from agent_board.agent_signing_keys
+  where agent_id = (select id from agent_board.agents where handle = 'sid-renew-child') for update;
+
+held
+----
+   1
+(1 row)
+
+step revoke_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '81000000-0000-4000-8000-000000000001';
+
+step revoke: 
+  select agent_board.revoke_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'));
+ <waiting ...>
+step renew_begin: 
+  BEGIN;
+  select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where handle = 'sid-renew-child'), true) is not null as holder_forwarded;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+
+holder_forwarded
+----------------
+t               
+(1 row)
+
+step renew: 
+  select agent_board.renew_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'), 'approved');
+ <waiting ...>
+step key_commit: COMMIT;
+step revoke: <... completed>
+revoke_session_identity
+-----------------------
+                       
+(1 row)
+
+step revoke_commit: COMMIT;
+step renew: <... completed>
+ERROR:  identity_tombstoned
+step renew_commit: COMMIT;
+step check: 
+  select si.tombstone_reason, si.credential_epoch, a.status, g.revoked_at is not null as grant_revoked,
+    g.last_renewed_at is not null as renewal_preceded_revoke,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations,
+    (select count(*) from agent_board.agent_signing_keys k where k.agent_id = a.id and k.status <> 'revoked') as active_keys
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id
+    join agent_board.delegation_grants g on g.child_agent_id = a.id where a.handle = 'sid-renew-child';
+  select bool_and(expires_at <= issued_at + interval '900 seconds') as bounded_pre_revoke_tokens
+  from agent_board.nonfleet_sessions where agent_id = (select id from agent_board.agents where handle = 'sid-renew-child');
+
+tombstone_reason|credential_epoch|status |grant_revoked|renewal_preceded_revoke|permanent_revocations|active_keys
+----------------+----------------+-------+-------------+-----------------------+---------------------+-----------
+revoked         |               1|revoked|t            |f                      |                    1|          0
+(1 row)
+
+bounded_pre_revoke_tokens
+-------------------------
+t                        
+(1 row)
+
+
+starting permutation: key_begin key_hold renew_begin renew revoke_begin revoke key_commit renew_commit revoke_commit check
+step key_begin: BEGIN;
+step key_hold: 
+  select 1 as held from agent_board.agent_signing_keys
+  where agent_id = (select id from agent_board.agents where handle = 'sid-renew-child') for update;
+
+held
+----
+   1
+(1 row)
+
+step renew_begin: 
+  BEGIN;
+  select set_config('request.jwt.claim.sub', (select auth_user_id::text from agent_board.agents where handle = 'sid-renew-child'), true) is not null as holder_forwarded;
+  SET LOCAL ROLE service_role;
+  SET LOCAL "request.jwt.claim.role" = 'service_role';
+  SET LOCAL "request.jwt.claim.identity_lease_epoch" = '0';
+
+holder_forwarded
+----------------
+t               
+(1 row)
+
+step renew: 
+  select agent_board.renew_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'), 'approved');
+
+renew_session_identity
+----------------------
+                      
+(1 row)
+
+step revoke_begin: 
+  BEGIN;
+  SET LOCAL ROLE authenticated;
+  SET LOCAL "request.jwt.claim.role" = 'authenticated';
+  SET LOCAL "request.jwt.claim.sub" = '81000000-0000-4000-8000-000000000001';
+
+step revoke: 
+  select agent_board.revoke_session_identity((select id from agent_board.agents where handle = 'sid-renew-child'));
+ <waiting ...>
+step key_commit: COMMIT;
+step renew_commit: COMMIT;
+step revoke: <... completed>
+revoke_session_identity
+-----------------------
+                       
+(1 row)
+
+step revoke_commit: COMMIT;
+step check: 
+  select si.tombstone_reason, si.credential_epoch, a.status, g.revoked_at is not null as grant_revoked,
+    g.last_renewed_at is not null as renewal_preceded_revoke,
+    (select count(*) from agent_board.fleet_revocation_events e where e.subject_id = a.id) as permanent_revocations,
+    (select count(*) from agent_board.agent_signing_keys k where k.agent_id = a.id and k.status <> 'revoked') as active_keys
+  from agent_board.agents a join agent_board.session_identities si on si.agent_id = a.id
+    join agent_board.delegation_grants g on g.child_agent_id = a.id where a.handle = 'sid-renew-child';
+  select bool_and(expires_at <= issued_at + interval '900 seconds') as bounded_pre_revoke_tokens
+  from agent_board.nonfleet_sessions where agent_id = (select id from agent_board.agents where handle = 'sid-renew-child');
+
+tombstone_reason|credential_epoch|status |grant_revoked|renewal_preceded_revoke|permanent_revocations|active_keys
+----------------+----------------+-------+-------------+-----------------------+---------------------+-----------
+revoked         |               1|revoked|t            |t                      |                    1|          0
+(1 row)
+
+bounded_pre_revoke_tokens
+-------------------------
+t                        
+(1 row)
+

package/tests/isolation/expected/session_identity_tombstone_onboarding.out

@@ -0,0 +1,247 @@
+Parsed test spec with 3 sessions
+
+starting permutation: o_begin o_advisory o_agents t_begin t_tomb o_membership o_commit t_commit check
+step o_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step o_advisory: 
+  select agent_board._lock_board_authority_ceiling('85000000-0000-4000-8000-000000000002') is null as advisory_taken;
+
+advisory_taken
+--------------
+f             
+(1 row)
+
+step o_agents: 
+  select count(*)::int as locked_agents from (
+    select 1 from agent_board.agents where id='85000000-0000-4000-8000-000000000001' for update) s;
+
+locked_agents
+-------------
+            1
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'sid_ti_instance_00001','urn:sid-ti:issuer','sid-ti-owner','owner_revoked');
+ <waiting ...>
+step o_membership: 
+  select count(*)::int as locked_memberships from (
+    select 1 from agent_board.board_memberships
+      where board_id='85000000-0000-4000-8000-000000000002'
+        and agent_id='85000000-0000-4000-8000-000000000001' for update) s;
+
+locked_memberships
+------------------
+                 1
+(1 row)
+
+step o_commit: COMMIT;
+step t_tomb: <... completed>
+first
+-----
+t    
+(1 row)
+
+step t_commit: COMMIT;
+step check: 
+  select tombstoned_at is not null as instance_tombstoned from agent_board.delegate_instances
+    where instance_id='sid_ti_instance_00001';
+  select status from agent_board.agents where id='85000000-0000-4000-8000-000000000001';
+  select membership_state from agent_board.board_memberships
+    where board_id='85000000-0000-4000-8000-000000000002'
+      and agent_id='85000000-0000-4000-8000-000000000001';
+  select si.tombstoned_at is not null as child_tombstoned,si.credential_epoch,
+    (select count(*) from agent_board.agent_credentials ac where ac.agent_id=si.agent_id and ac.revoked_at is null) as live_credentials
+    from agent_board.session_identities si join agent_board.agents a on a.id=si.agent_id where a.handle='sid-ti-child';
+  select count(*) as withdrawal_events from agent_board.board_membership_events
+    where board_id='85000000-0000-4000-8000-000000000002' and event_kind='operator_removal';
+
+instance_tombstoned
+-------------------
+t                  
+(1 row)
+
+status 
+-------
+revoked
+(1 row)
+
+membership_state
+----------------
+left            
+(1 row)
+
+child_tombstoned|credential_epoch|live_credentials
+----------------+----------------+----------------
+t               |               1|               0
+(1 row)
+
+withdrawal_events
+-----------------
+                1
+(1 row)
+
+
+starting permutation: t_begin t_tomb o_begin o_advisory t_commit o_agents o_membership o_commit check
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'sid_ti_instance_00001','urn:sid-ti:issuer','sid-ti-owner','owner_revoked');
+
+first
+-----
+t    
+(1 row)
+
+step o_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step o_advisory: 
+  select agent_board._lock_board_authority_ceiling('85000000-0000-4000-8000-000000000002') is null as advisory_taken;
+ <waiting ...>
+step t_commit: COMMIT;
+step o_advisory: <... completed>
+advisory_taken
+--------------
+f             
+(1 row)
+
+step o_agents: 
+  select count(*)::int as locked_agents from (
+    select 1 from agent_board.agents where id='85000000-0000-4000-8000-000000000001' for update) s;
+
+locked_agents
+-------------
+            1
+(1 row)
+
+step o_membership: 
+  select count(*)::int as locked_memberships from (
+    select 1 from agent_board.board_memberships
+      where board_id='85000000-0000-4000-8000-000000000002'
+        and agent_id='85000000-0000-4000-8000-000000000001' for update) s;
+
+locked_memberships
+------------------
+                 1
+(1 row)
+
+step o_commit: COMMIT;
+step check: 
+  select tombstoned_at is not null as instance_tombstoned from agent_board.delegate_instances
+    where instance_id='sid_ti_instance_00001';
+  select status from agent_board.agents where id='85000000-0000-4000-8000-000000000001';
+  select membership_state from agent_board.board_memberships
+    where board_id='85000000-0000-4000-8000-000000000002'
+      and agent_id='85000000-0000-4000-8000-000000000001';
+  select si.tombstoned_at is not null as child_tombstoned,si.credential_epoch,
+    (select count(*) from agent_board.agent_credentials ac where ac.agent_id=si.agent_id and ac.revoked_at is null) as live_credentials
+    from agent_board.session_identities si join agent_board.agents a on a.id=si.agent_id where a.handle='sid-ti-child';
+  select count(*) as withdrawal_events from agent_board.board_membership_events
+    where board_id='85000000-0000-4000-8000-000000000002' and event_kind='operator_removal';
+
+instance_tombstoned
+-------------------
+t                  
+(1 row)
+
+status 
+-------
+revoked
+(1 row)
+
+membership_state
+----------------
+left            
+(1 row)
+
+child_tombstoned|credential_epoch|live_credentials
+----------------+----------------+----------------
+t               |               1|               0
+(1 row)
+
+withdrawal_events
+-----------------
+                1
+(1 row)
+
+
+starting permutation: o_begin o_advisory t_begin t_tomb o_agents o_membership o_commit t_commit check
+step o_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step o_advisory: 
+  select agent_board._lock_board_authority_ceiling('85000000-0000-4000-8000-000000000002') is null as advisory_taken;
+
+advisory_taken
+--------------
+f             
+(1 row)
+
+step t_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step t_tomb: 
+  select first from agent_board.tombstone_delegate_instance(
+    'sid_ti_instance_00001','urn:sid-ti:issuer','sid-ti-owner','owner_revoked');
+ <waiting ...>
+step o_agents: 
+  select count(*)::int as locked_agents from (
+    select 1 from agent_board.agents where id='85000000-0000-4000-8000-000000000001' for update) s;
+
+locked_agents
+-------------
+            1
+(1 row)
+
+step o_membership: 
+  select count(*)::int as locked_memberships from (
+    select 1 from agent_board.board_memberships
+      where board_id='85000000-0000-4000-8000-000000000002'
+        and agent_id='85000000-0000-4000-8000-000000000001' for update) s;
+
+locked_memberships
+------------------
+                 1
+(1 row)
+
+step o_commit: COMMIT;
+step t_tomb: <... completed>
+first
+-----
+t    
+(1 row)
+
+step t_commit: COMMIT;
+step check: 
+  select tombstoned_at is not null as instance_tombstoned from agent_board.delegate_instances
+    where instance_id='sid_ti_instance_00001';
+  select status from agent_board.agents where id='85000000-0000-4000-8000-000000000001';
+  select membership_state from agent_board.board_memberships
+    where board_id='85000000-0000-4000-8000-000000000002'
+      and agent_id='85000000-0000-4000-8000-000000000001';
+  select si.tombstoned_at is not null as child_tombstoned,si.credential_epoch,
+    (select count(*) from agent_board.agent_credentials ac where ac.agent_id=si.agent_id and ac.revoked_at is null) as live_credentials
+    from agent_board.session_identities si join agent_board.agents a on a.id=si.agent_id where a.handle='sid-ti-child';
+  select count(*) as withdrawal_events from agent_board.board_membership_events
+    where board_id='85000000-0000-4000-8000-000000000002' and event_kind='operator_removal';
+
+instance_tombstoned
+-------------------
+t                  
+(1 row)
+
+status 
+-------
+revoked
+(1 row)
+
+membership_state
+----------------
+left            
+(1 row)
+
+child_tombstoned|credential_epoch|live_credentials
+----------------+----------------+----------------
+t               |               1|               0
+(1 row)
+
+withdrawal_events
+-----------------
+                1
+(1 row)
+

package/tests/isolation/specs/atomic_fleet_authority_races.spec

@@ -49,6 +49,10 @@ setup
   values ('16250000-0000-0000-0000-000000000001', 'agent', 'agent',
           'atomic-authority-owner', 'Atomic Authority Owner', 'active',
           '16250000-0000-0000-0000-0000000000a1');
+  -- ROLEGUARD: isolate creator authority loss while another owner preserves the board.
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status)
+  values ('16250000-0000-0000-0000-000000000004', 'agent', 'agent',
+          'atomic-authority-coowner', 'Atomic Authority Coowner', 'active');
 
   select count(*) from agent_board.create_board(
     '16250000-0000-0000-0000-000000000001',
@@ -56,6 +60,9 @@ setup
     'Consiliency/message-board#162 authority isolation proof',
     jsonb_build_object(), 'private'
   );
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state)
+  values ((select id from agent_board.boards where slug='atomic-authority-board'),
+          '16250000-0000-0000-0000-000000000004', 'owner', 'joined');
   insert into agent_board.fleet_trust_domains(
     id, slug, display_name, domain_kind, owner_agent_id, lifecycle_state, approved_at
   ) values (
@@ -120,9 +127,6 @@ teardown
   delete from agent_board.board_authority_ceilings where board_id in (
     select id from agent_board.boards where slug='atomic-authority-board'
   );
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug='atomic-authority-board'
-  );
   delete from agent_board.enrollment_federation_audit where agent_id in (
     select id from agent_board.agents where handle='atomic-authority-agent'
   );
@@ -134,6 +138,7 @@ teardown
   delete from agent_board.fleet_machines where id='16250000-0000-0000-0000-000000000003';
   delete from agent_board.fleet_trust_domains where id='16250000-0000-0000-0000-000000000002';
   delete from agent_board.agents where id='16250000-0000-0000-0000-000000000001';
+  delete from agent_board.agents where id='16250000-0000-0000-0000-000000000004';
   delete from auth.users where id='16250000-0000-0000-0000-0000000000a1';
   delete from agent_board.identity_providers where issuer='https://atomic-authority.test';
 }

package/tests/isolation/specs/atomic_fleet_binding_revoke.spec

@@ -70,9 +70,6 @@ teardown
   );
   truncate agent_board.fleet_onboarding_invite_bounds;
   delete from agent_board.board_invite_tokens where created_by_agent_id='16230000-0000-0000-0000-000000000001';
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug='atomic-binding-board'
-  );
   delete from agent_board.enrollment_federation_audit where agent_id in (
     select id from agent_board.agents where handle='atomic-binding-agent'
   );

package/tests/isolation/specs/atomic_fleet_board_archive.spec

@@ -70,9 +70,6 @@ teardown
   );
   truncate agent_board.fleet_onboarding_invite_bounds;
   delete from agent_board.board_invite_tokens where created_by_agent_id='16290000-0000-0000-0000-000000000001';
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug='atomic-archive-board'
-  );
   delete from agent_board.enrollment_federation_audit where issuer='https://atomic-archive.test';
   delete from agent_board.agent_signing_keys where agent_id in (
     select id from agent_board.agents where handle='atomic-archive-agent'

package/tests/isolation/specs/atomic_fleet_human_fresh_revoke.spec

@@ -68,9 +68,6 @@ teardown
   );
   truncate agent_board.fleet_onboarding_invite_bounds;
   delete from agent_board.board_invite_tokens where created_by_agent_id='16280000-0000-0000-0000-000000000001';
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug='atomic-human-board'
-  );
   delete from agent_board.enrollment_federation_audit where issuer='https://atomic-human.test';
   delete from agent_board.agent_signing_keys where agent_id in (
     select id from agent_board.agents where handle in ('atomic-human-existing','atomic-human-fresh')

package/tests/isolation/specs/atomic_fleet_identity_disposition.spec

@@ -57,9 +57,6 @@ teardown
   );
   truncate agent_board.fleet_onboarding_invite_bounds;
   delete from agent_board.board_invite_tokens where created_by_agent_id='16260000-0000-0000-0000-000000000001';
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug='atomic-disposition-board'
-  );
   delete from agent_board.enrollment_federation_audit where issuer='https://atomic-disposition.test';
   delete from agent_board.agent_signing_keys where agent_id in (
     select id from agent_board.agents where handle='atomic-disposition-agent'

package/tests/isolation/specs/atomic_fleet_lifecycle_races.spec

@@ -83,9 +83,6 @@ teardown
   );
   truncate agent_board.fleet_onboarding_invite_bounds;
   delete from agent_board.board_invite_tokens where created_by_agent_id='16240000-0000-0000-0000-000000000001';
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug='atomic-lifecycle-board'
-  );
   delete from agent_board.enrollment_federation_audit where agent_id in (
     select id from agent_board.agents where handle='atomic-lifecycle-agent'
   );

package/tests/isolation/specs/atomic_fleet_subtree_lock_order.spec

@@ -81,9 +81,6 @@ teardown
   );
   truncate agent_board.fleet_onboarding_invite_bounds;
   delete from agent_board.board_invite_tokens where created_by_agent_id='ffffffff-ffff-ffff-ffff-ffffffffff01';
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug='atomic-subtree-board'
-  );
   delete from agent_board.enrollment_federation_audit where issuer='https://atomic-subtree.test';
   delete from agent_board.agent_signing_keys where agent_id in (
     select id from agent_board.agents where handle='atomic-subtree-agent'

package/tests/isolation/specs/ceiling_setter_lock_before_upsert.spec

@@ -53,9 +53,6 @@ teardown
   delete from agent_board.board_authority_ceilings where board_id in (
     select id from agent_board.boards where slug='ceiling-order-board'
   );
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug='ceiling-order-board'
-  );
   delete from agent_board.boards where slug='ceiling-order-board';
   delete from agent_board.agents where id='19600000-0000-0000-0000-000000000001';
   delete from auth.users where id='19600000-0000-0000-0000-0000000000a1';

package/tests/isolation/specs/claimpolicy_acquire_revert_race.spec

@@ -68,8 +68,6 @@ teardown
   delete from agent_board.threads where id = '40500000-0000-4000-8000-000000000010';
   delete from agent_board.board_membership_events where board_id in (
     select id from agent_board.boards where slug = 'cpr-acq-board');
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug = 'cpr-acq-board');
   delete from agent_board.boards where slug = 'cpr-acq-board';
   delete from agent_board.agents where id = '40500000-0000-4000-8000-000000000001';
   delete from auth.users where id = '40500000-0000-4000-8000-0000000000a1';

package/tests/isolation/specs/claimpolicy_board_scope.spec

@@ -60,8 +60,6 @@ teardown
                                                '40500000-0000-4000-8000-000000000042');
   delete from agent_board.board_membership_events where board_id in (
     select id from agent_board.boards where slug in ('cpr-scope-b1', 'cpr-scope-b2'));
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug in ('cpr-scope-b1', 'cpr-scope-b2'));
   delete from agent_board.boards where slug in ('cpr-scope-b1', 'cpr-scope-b2');
   delete from agent_board.agents where id = '40500000-0000-4000-8000-000000000003';
   delete from auth.users where id = '40500000-0000-4000-8000-0000000000c1';

package/tests/isolation/specs/claimpolicy_claimrow_lock_order.spec

@@ -133,8 +133,6 @@ teardown
   delete from agent_board.threads where id = '40500000-0000-4000-8000-000000000090';
   delete from agent_board.board_membership_events where board_id in (
     select id from agent_board.boards where slug = 'cpr-inv-board');
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug = 'cpr-inv-board');
   delete from agent_board.boards where slug = 'cpr-inv-board';
   delete from agent_board.fleet_revocation_events where subject_id = '40500000-0000-4000-8000-0000000000c0';
   delete from agent_board.fleet_machine_agents where machine_id = '40500000-0000-4000-8000-0000000000c0';

package/tests/isolation/specs/claimpolicy_isolation_refusal.spec

@@ -59,8 +59,6 @@ teardown
   delete from agent_board.threads where id = '40500000-0000-4000-8000-000000000050';
   delete from agent_board.board_membership_events where board_id in (
     select id from agent_board.boards where slug = 'cpr-iso-board');
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug = 'cpr-iso-board');
   delete from agent_board.boards where slug = 'cpr-iso-board';
   delete from agent_board.agents where id = '40500000-0000-4000-8000-000000000004';
   delete from auth.users where id = '40500000-0000-4000-8000-0000000000d1';

package/tests/isolation/specs/claimpolicy_renew_revert_race.spec

@@ -99,8 +99,6 @@ teardown
   delete from agent_board.threads where id = '40500000-0000-4000-8000-000000000020';
   delete from agent_board.board_membership_events where board_id in (
     select id from agent_board.boards where slug = 'cpr-ren-board');
-  delete from agent_board.board_memberships where board_id in (
-    select id from agent_board.boards where slug = 'cpr-ren-board');
   delete from agent_board.boards where slug = 'cpr-ren-board';
   delete from agent_board.agents where id = '40500000-0000-4000-8000-000000000002';
   delete from auth.users where id = '40500000-0000-4000-8000-0000000000b1';