@hraness/peopleblade 0.1.0

package/dist/migrations/013_source_binding_incarnations.sql

@@ -0,0 +1,339 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE source_binding_incarnations (
+    id INTEGER PRIMARY KEY,
+    source_binding_id INTEGER NOT NULL REFERENCES source_bindings(id) ON DELETE RESTRICT,
+    authority TEXT NOT NULL CHECK(length(authority) BETWEEN 1 AND 64),
+    ordinal INTEGER NOT NULL CHECK(ordinal >= 1),
+    subject_sha256 TEXT NOT NULL CHECK(length(subject_sha256) = 64 AND subject_sha256 NOT GLOB '*[^0-9a-f]*'),
+    auth_sha256 TEXT NOT NULL CHECK(length(auth_sha256) = 64 AND auth_sha256 NOT GLOB '*[^0-9a-f]*'),
+    previous_incarnation_id INTEGER REFERENCES source_binding_incarnations(id) ON DELETE RESTRICT,
+    transition_kind TEXT NOT NULL CHECK(transition_kind IN ('initial','explicit-rebind')),
+    transition_evidence_sha256 TEXT CHECK(
+      transition_evidence_sha256 IS NULL OR (
+        length(transition_evidence_sha256) = 64
+        AND transition_evidence_sha256 NOT GLOB '*[^0-9a-f]*'
+      )
+    ),
+    transition_evidence_json TEXT CHECK(
+      transition_evidence_json IS NULL OR json_valid(transition_evidence_json)
+    ),
+    first_seen_at TEXT NOT NULL,
+    last_seen_at TEXT NOT NULL,
+    retired_at TEXT,
+    metadata_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(metadata_json)),
+    CHECK(
+      (transition_kind = 'initial' AND ordinal=1 AND previous_incarnation_id IS NULL
+        AND transition_evidence_sha256 IS NULL AND transition_evidence_json IS NULL)
+      OR
+      (transition_kind = 'explicit-rebind' AND ordinal>=2 AND previous_incarnation_id IS NOT NULL
+        AND transition_evidence_sha256 IS NOT NULL AND transition_evidence_json IS NOT NULL)
+    ),
+    UNIQUE(source_binding_id, ordinal)
+) STRICT;
+
+CREATE UNIQUE INDEX source_binding_incarnations_current
+ON source_binding_incarnations(source_binding_id) WHERE retired_at IS NULL;
+CREATE INDEX source_binding_incarnations_history
+ON source_binding_incarnations(source_binding_id, ordinal DESC);
+CREATE INDEX source_binding_incarnations_subject_owner
+ON source_binding_incarnations(authority, subject_sha256, source_binding_id);
+
+CREATE TABLE source_binding_transition_guards (
+    source_binding_id INTEGER PRIMARY KEY REFERENCES source_bindings(id) ON DELETE RESTRICT,
+    retiring_incarnation_id INTEGER NOT NULL UNIQUE REFERENCES source_binding_incarnations(id) ON DELETE RESTRICT,
+    next_ordinal INTEGER NOT NULL CHECK(next_ordinal >= 2),
+    authority TEXT NOT NULL CHECK(length(authority) BETWEEN 1 AND 64),
+    next_subject_sha256 TEXT NOT NULL CHECK(length(next_subject_sha256) = 64 AND next_subject_sha256 NOT GLOB '*[^0-9a-f]*'),
+    next_auth_sha256 TEXT NOT NULL CHECK(length(next_auth_sha256) = 64 AND next_auth_sha256 NOT GLOB '*[^0-9a-f]*'),
+    transition_evidence_sha256 TEXT NOT NULL CHECK(
+      length(transition_evidence_sha256) = 64
+      AND transition_evidence_sha256 NOT GLOB '*[^0-9a-f]*'
+    ),
+    transition_evidence_json TEXT NOT NULL CHECK(json_valid(transition_evidence_json)),
+    observed_at TEXT NOT NULL CHECK(julianday(observed_at) IS NOT NULL),
+    expected_last_seen_at TEXT NOT NULL CHECK(julianday(expected_last_seen_at) IS NOT NULL),
+    expected_metadata_json TEXT NOT NULL CHECK(json_valid(expected_metadata_json)),
+    expected_complete_realm_inventory_observed_at TEXT,
+    expected_complete_realm_inventory_sha256 TEXT,
+    complete_realm_inventory_sha256 TEXT NOT NULL CHECK(
+      length(complete_realm_inventory_sha256) = 64
+      AND complete_realm_inventory_sha256 NOT GLOB '*[^0-9a-f]*'
+    ),
+    metadata_json TEXT NOT NULL CHECK(json_valid(metadata_json)),
+    CHECK(
+      (expected_complete_realm_inventory_observed_at IS NULL
+        AND expected_complete_realm_inventory_sha256 IS NULL)
+      OR
+      (julianday(expected_complete_realm_inventory_observed_at) IS NOT NULL
+        AND length(expected_complete_realm_inventory_sha256) = 64
+        AND expected_complete_realm_inventory_sha256 NOT GLOB '*[^0-9a-f]*')
+    )
+) STRICT;
+
+INSERT INTO source_binding_incarnations(
+  source_binding_id,authority,ordinal,subject_sha256,auth_sha256,transition_kind,
+  first_seen_at,last_seen_at,metadata_json
+)
+SELECT id,authority,1,subject_sha256,auth_sha256,'initial',first_seen_at,last_seen_at,metadata_json
+FROM source_bindings;
+
+DROP TRIGGER source_bindings_identity_immutable;
+
+CREATE TRIGGER source_bindings_stable_identity_immutable
+BEFORE UPDATE OF authority,auth_id ON source_bindings FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source binding authority and authorization ID are immutable'); END;
+
+CREATE TRIGGER source_bindings_initial_incarnation
+AFTER INSERT ON source_bindings FOR EACH ROW
+BEGIN
+  INSERT INTO source_binding_incarnations(
+    source_binding_id,authority,ordinal,subject_sha256,auth_sha256,transition_kind,
+    first_seen_at,last_seen_at,metadata_json
+  ) VALUES (
+    NEW.id,NEW.authority,1,NEW.subject_sha256,NEW.auth_sha256,'initial',
+    NEW.first_seen_at,NEW.last_seen_at,NEW.metadata_json
+  );
+END;
+
+CREATE TRIGGER source_binding_incarnations_no_replace
+BEFORE INSERT ON source_binding_incarnations FOR EACH ROW
+WHEN EXISTS (
+  SELECT 1 FROM source_binding_incarnations
+  WHERE id=NEW.id
+    OR (source_binding_id=NEW.source_binding_id AND ordinal=NEW.ordinal)
+)
+BEGIN SELECT RAISE(ABORT, 'source binding incarnation history cannot be replaced'); END;
+
+CREATE TRIGGER source_binding_incarnations_identity_immutable
+BEFORE UPDATE ON source_binding_incarnations FOR EACH ROW
+WHEN NEW.id IS NOT OLD.id
+  OR NEW.source_binding_id IS NOT OLD.source_binding_id
+  OR NEW.authority IS NOT OLD.authority
+  OR NEW.ordinal IS NOT OLD.ordinal
+  OR NEW.subject_sha256 IS NOT OLD.subject_sha256
+  OR NEW.auth_sha256 IS NOT OLD.auth_sha256
+  OR NEW.previous_incarnation_id IS NOT OLD.previous_incarnation_id
+  OR NEW.transition_kind IS NOT OLD.transition_kind
+  OR NEW.transition_evidence_sha256 IS NOT OLD.transition_evidence_sha256
+  OR NEW.transition_evidence_json IS NOT OLD.transition_evidence_json
+  OR NEW.first_seen_at IS NOT OLD.first_seen_at
+BEGIN SELECT RAISE(ABORT, 'source binding incarnation identity is immutable'); END;
+
+CREATE TRIGGER source_binding_incarnations_retired_state_immutable
+BEFORE UPDATE OF last_seen_at,metadata_json ON source_binding_incarnations FOR EACH ROW
+WHEN OLD.retired_at IS NOT NULL OR NEW.retired_at IS NOT NULL
+BEGIN SELECT RAISE(ABORT, 'retired source binding incarnation state is immutable'); END;
+
+CREATE TRIGGER source_binding_incarnations_current_state_shadow
+BEFORE UPDATE OF last_seen_at,metadata_json ON source_binding_incarnations FOR EACH ROW
+WHEN OLD.retired_at IS NULL AND NOT EXISTS (
+  SELECT 1 FROM source_bindings binding
+  WHERE binding.id=OLD.source_binding_id
+    AND binding.authority=OLD.authority
+    AND binding.last_seen_at=NEW.last_seen_at
+    AND binding.metadata_json=NEW.metadata_json
+)
+BEGIN SELECT RAISE(ABORT, 'current source binding incarnation state must shadow its binding'); END;
+
+CREATE TRIGGER source_binding_incarnations_retirement_monotonic
+BEFORE UPDATE OF retired_at ON source_binding_incarnations FOR EACH ROW
+WHEN OLD.retired_at IS NOT NULL OR NEW.retired_at IS NULL
+BEGIN SELECT RAISE(ABORT, 'source binding incarnation retirement is monotonic'); END;
+
+CREATE TRIGGER source_binding_incarnations_retirement_authorized
+BEFORE UPDATE OF retired_at ON source_binding_incarnations FOR EACH ROW
+WHEN OLD.retired_at IS NULL AND NEW.retired_at IS NOT NULL AND NOT EXISTS (
+  SELECT 1 FROM source_binding_transition_guards guard
+  JOIN source_bindings binding ON binding.id=guard.source_binding_id
+  WHERE guard.source_binding_id=OLD.source_binding_id
+    AND guard.retiring_incarnation_id=OLD.id AND guard.next_ordinal=OLD.ordinal+1
+    AND guard.authority=OLD.authority
+    AND guard.observed_at=NEW.retired_at
+    AND julianday(guard.observed_at)>=julianday(OLD.last_seen_at)
+    AND guard.expected_last_seen_at=OLD.last_seen_at
+    AND guard.expected_metadata_json=OLD.metadata_json
+    AND binding.authority=OLD.authority
+    AND binding.subject_sha256=OLD.subject_sha256
+    AND binding.auth_sha256=OLD.auth_sha256
+    AND binding.last_seen_at=guard.expected_last_seen_at
+    AND binding.metadata_json=guard.expected_metadata_json
+    AND binding.complete_realm_inventory_observed_at
+      IS guard.expected_complete_realm_inventory_observed_at
+    AND binding.complete_realm_inventory_sha256
+      IS guard.expected_complete_realm_inventory_sha256
+)
+BEGIN SELECT RAISE(ABORT, 'current source binding incarnation requires an atomic successor'); END;
+
+CREATE TRIGGER source_binding_transition_guards_snapshot_insert
+BEFORE INSERT ON source_binding_transition_guards FOR EACH ROW
+WHEN NOT EXISTS (
+  SELECT 1 FROM source_binding_incarnations incarnation
+  JOIN source_bindings binding ON binding.id=incarnation.source_binding_id
+  WHERE incarnation.id=NEW.retiring_incarnation_id
+    AND incarnation.source_binding_id=NEW.source_binding_id
+    AND incarnation.retired_at IS NULL
+    AND incarnation.ordinal+1=NEW.next_ordinal
+    AND incarnation.authority=NEW.authority
+    AND incarnation.last_seen_at=NEW.expected_last_seen_at
+    AND incarnation.metadata_json=NEW.expected_metadata_json
+    AND binding.authority=NEW.authority
+    AND binding.subject_sha256=incarnation.subject_sha256
+    AND binding.auth_sha256=incarnation.auth_sha256
+    AND binding.last_seen_at=NEW.expected_last_seen_at
+    AND binding.metadata_json=NEW.expected_metadata_json
+    AND binding.complete_realm_inventory_observed_at
+      IS NEW.expected_complete_realm_inventory_observed_at
+    AND binding.complete_realm_inventory_sha256
+      IS NEW.expected_complete_realm_inventory_sha256
+)
+BEGIN SELECT RAISE(ABORT, 'source binding transition guard does not match current reviewed state'); END;
+
+CREATE TRIGGER source_binding_transition_guards_immutable
+BEFORE UPDATE ON source_binding_transition_guards FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source binding transition guard is immutable'); END;
+
+CREATE TRIGGER source_binding_transition_guards_no_replace
+BEFORE INSERT ON source_binding_transition_guards FOR EACH ROW
+WHEN EXISTS (
+  SELECT 1 FROM source_binding_transition_guards
+  WHERE source_binding_id=NEW.source_binding_id
+    OR retiring_incarnation_id=NEW.retiring_incarnation_id
+)
+BEGIN SELECT RAISE(ABORT, 'source binding transition guard cannot be replaced'); END;
+
+CREATE TRIGGER source_binding_transition_guards_consumed_delete
+BEFORE DELETE ON source_binding_transition_guards FOR EACH ROW
+WHEN NOT (
+  EXISTS (
+    SELECT 1 FROM source_binding_incarnations predecessor
+    WHERE predecessor.id=OLD.retiring_incarnation_id
+      AND predecessor.source_binding_id=OLD.source_binding_id
+      AND predecessor.authority=OLD.authority
+      AND predecessor.ordinal=OLD.next_ordinal-1
+      AND predecessor.retired_at=OLD.observed_at
+      AND predecessor.last_seen_at=OLD.expected_last_seen_at
+      AND predecessor.metadata_json=OLD.expected_metadata_json
+  )
+  AND EXISTS (
+    SELECT 1 FROM source_binding_incarnations successor
+    WHERE successor.source_binding_id=OLD.source_binding_id
+      AND successor.authority=OLD.authority
+      AND successor.ordinal=OLD.next_ordinal
+      AND successor.subject_sha256=OLD.next_subject_sha256
+      AND successor.auth_sha256=OLD.next_auth_sha256
+      AND successor.previous_incarnation_id=OLD.retiring_incarnation_id
+      AND successor.transition_kind='explicit-rebind'
+      AND successor.transition_evidence_sha256=OLD.transition_evidence_sha256
+      AND successor.transition_evidence_json=OLD.transition_evidence_json
+      AND successor.first_seen_at=OLD.observed_at
+      AND successor.last_seen_at=OLD.observed_at
+      AND successor.retired_at IS NULL
+      AND successor.metadata_json=OLD.metadata_json
+  )
+  AND EXISTS (
+    SELECT 1 FROM source_bindings binding
+    WHERE binding.id=OLD.source_binding_id
+      AND binding.authority=OLD.authority
+      AND binding.subject_sha256=OLD.next_subject_sha256
+      AND binding.auth_sha256=OLD.next_auth_sha256
+      AND binding.last_seen_at=OLD.observed_at
+      AND binding.complete_realm_inventory_observed_at=OLD.observed_at
+      AND binding.complete_realm_inventory_sha256=OLD.complete_realm_inventory_sha256
+      AND binding.metadata_json=OLD.metadata_json
+  )
+)
+BEGIN SELECT RAISE(ABORT, 'source binding transition guard can only be deleted after exact consumption'); END;
+
+CREATE TRIGGER source_binding_incarnations_no_delete
+BEFORE DELETE ON source_binding_incarnations FOR EACH ROW
+BEGIN SELECT RAISE(ABORT, 'source binding incarnation history is immutable'); END;
+
+CREATE TRIGGER source_binding_incarnations_subject_owner_insert
+BEFORE INSERT ON source_binding_incarnations FOR EACH ROW
+WHEN EXISTS (
+  SELECT 1 FROM source_binding_incarnations
+  WHERE authority=NEW.authority AND subject_sha256=NEW.subject_sha256
+    AND source_binding_id<>NEW.source_binding_id
+)
+BEGIN SELECT RAISE(ABORT, 'source binding subject belongs to another binding'); END;
+
+CREATE TRIGGER source_binding_incarnations_chain_insert
+BEFORE INSERT ON source_binding_incarnations FOR EACH ROW
+WHEN NEW.transition_kind='explicit-rebind' AND NOT EXISTS (
+  SELECT 1 FROM source_binding_incarnations previous
+  WHERE previous.id=NEW.previous_incarnation_id
+    AND previous.source_binding_id=NEW.source_binding_id
+    AND previous.authority=NEW.authority
+    AND previous.ordinal=NEW.ordinal-1 AND previous.retired_at IS NOT NULL
+    AND (previous.subject_sha256<>NEW.subject_sha256 OR previous.auth_sha256<>NEW.auth_sha256)
+    AND EXISTS (
+      SELECT 1 FROM source_bindings binding
+      WHERE binding.id=NEW.source_binding_id AND binding.authority=NEW.authority
+    )
+)
+BEGIN SELECT RAISE(ABORT, 'source binding incarnation predecessor is invalid'); END;
+
+CREATE TRIGGER source_binding_incarnations_atomic_successor
+AFTER UPDATE OF retired_at ON source_binding_incarnations FOR EACH ROW
+WHEN OLD.retired_at IS NULL AND NEW.retired_at IS NOT NULL
+BEGIN
+  INSERT INTO source_binding_incarnations(
+    source_binding_id,authority,ordinal,subject_sha256,auth_sha256,previous_incarnation_id,
+    transition_kind,transition_evidence_sha256,transition_evidence_json,
+    first_seen_at,last_seen_at,metadata_json
+  )
+  SELECT source_binding_id,authority,next_ordinal,next_subject_sha256,next_auth_sha256,
+    retiring_incarnation_id,'explicit-rebind',transition_evidence_sha256,
+    transition_evidence_json,observed_at,observed_at,metadata_json
+  FROM source_binding_transition_guards
+  WHERE source_binding_id=NEW.source_binding_id
+    AND retiring_incarnation_id=NEW.id AND next_ordinal=NEW.ordinal+1;
+
+  UPDATE source_bindings
+  SET subject_sha256=(SELECT next_subject_sha256 FROM source_binding_transition_guards
+        WHERE source_binding_id=NEW.source_binding_id),
+      auth_sha256=(SELECT next_auth_sha256 FROM source_binding_transition_guards
+        WHERE source_binding_id=NEW.source_binding_id),
+      last_seen_at=(SELECT observed_at FROM source_binding_transition_guards
+        WHERE source_binding_id=NEW.source_binding_id),
+      complete_realm_inventory_observed_at=(SELECT observed_at FROM source_binding_transition_guards
+        WHERE source_binding_id=NEW.source_binding_id),
+      complete_realm_inventory_sha256=(SELECT complete_realm_inventory_sha256
+        FROM source_binding_transition_guards WHERE source_binding_id=NEW.source_binding_id),
+      metadata_json=(SELECT metadata_json FROM source_binding_transition_guards
+        WHERE source_binding_id=NEW.source_binding_id)
+  WHERE id=NEW.source_binding_id;
+
+  DELETE FROM source_binding_transition_guards WHERE source_binding_id=NEW.source_binding_id;
+END;
+
+CREATE TRIGGER source_bindings_identity_shadow_guard
+BEFORE UPDATE OF subject_sha256,auth_sha256 ON source_bindings FOR EACH ROW
+WHEN NOT EXISTS (
+  SELECT 1 FROM source_binding_incarnations
+  WHERE source_binding_id=NEW.id AND retired_at IS NULL
+    AND authority=NEW.authority
+    AND subject_sha256=NEW.subject_sha256 AND auth_sha256=NEW.auth_sha256
+)
+BEGIN SELECT RAISE(ABORT, 'source binding identity must shadow its current incarnation'); END;
+
+CREATE TRIGGER source_bindings_current_incarnation_metadata
+AFTER UPDATE OF last_seen_at,metadata_json ON source_bindings FOR EACH ROW
+BEGIN
+  UPDATE source_binding_incarnations
+  SET last_seen_at=NEW.last_seen_at,metadata_json=NEW.metadata_json
+  WHERE source_binding_id=NEW.id AND retired_at IS NULL;
+END;
+
+CREATE VIEW current_source_binding_incarnations AS
+SELECT incarnation.id,incarnation.source_binding_id,incarnation.authority,
+  incarnation.ordinal,incarnation.subject_sha256,incarnation.auth_sha256,
+  incarnation.first_seen_at,incarnation.last_seen_at,incarnation.metadata_json
+FROM source_binding_incarnations incarnation
+JOIN source_bindings binding
+  ON binding.id=incarnation.source_binding_id
+  AND binding.authority=incarnation.authority
+  AND binding.subject_sha256=incarnation.subject_sha256
+  AND binding.auth_sha256=incarnation.auth_sha256
+WHERE incarnation.retired_at IS NULL;

package/dist/migrations/014_source_binding_transition_guard_recovery.sql

@@ -0,0 +1,121 @@
+PRAGMA foreign_keys = ON;
+
+DROP TRIGGER source_binding_transition_guards_snapshot_insert;
+
+CREATE TRIGGER source_binding_transition_guards_snapshot_insert
+BEFORE INSERT ON source_binding_transition_guards FOR EACH ROW
+WHEN NOT EXISTS (
+  SELECT 1 FROM source_binding_incarnations incarnation
+  JOIN source_bindings binding ON binding.id=incarnation.source_binding_id
+  WHERE incarnation.id=NEW.retiring_incarnation_id
+    AND incarnation.source_binding_id=NEW.source_binding_id
+    AND incarnation.retired_at IS NULL
+    AND incarnation.ordinal+1=NEW.next_ordinal
+    AND incarnation.authority=NEW.authority
+    AND (incarnation.subject_sha256<>NEW.next_subject_sha256
+      OR incarnation.auth_sha256<>NEW.next_auth_sha256)
+    AND julianday(NEW.observed_at)>=julianday(incarnation.last_seen_at)
+    AND incarnation.last_seen_at=NEW.expected_last_seen_at
+    AND incarnation.metadata_json=NEW.expected_metadata_json
+    AND binding.authority=NEW.authority
+    AND binding.subject_sha256=incarnation.subject_sha256
+    AND binding.auth_sha256=incarnation.auth_sha256
+    AND binding.last_seen_at=NEW.expected_last_seen_at
+    AND binding.metadata_json=NEW.expected_metadata_json
+    AND binding.complete_realm_inventory_observed_at
+      IS NEW.expected_complete_realm_inventory_observed_at
+    AND binding.complete_realm_inventory_sha256
+      IS NEW.expected_complete_realm_inventory_sha256
+    AND NOT EXISTS (
+      SELECT 1 FROM source_binding_incarnations owner
+      WHERE owner.authority=NEW.authority
+        AND owner.subject_sha256=NEW.next_subject_sha256
+        AND owner.source_binding_id<>NEW.source_binding_id
+    )
+)
+BEGIN SELECT RAISE(ABORT, 'source binding transition guard does not match current reviewed state'); END;
+
+DROP TRIGGER source_binding_transition_guards_consumed_delete;
+
+CREATE TRIGGER source_binding_transition_guards_consumed_delete
+BEFORE DELETE ON source_binding_transition_guards FOR EACH ROW
+WHEN NOT (
+  (
+    EXISTS (
+      SELECT 1 FROM source_binding_incarnations predecessor
+      WHERE predecessor.id=OLD.retiring_incarnation_id
+        AND predecessor.source_binding_id=OLD.source_binding_id
+        AND predecessor.authority=OLD.authority
+        AND predecessor.ordinal=OLD.next_ordinal-1
+        AND predecessor.retired_at=OLD.observed_at
+        AND predecessor.last_seen_at=OLD.expected_last_seen_at
+        AND predecessor.metadata_json=OLD.expected_metadata_json
+    )
+    AND EXISTS (
+      SELECT 1 FROM source_binding_incarnations successor
+      WHERE successor.source_binding_id=OLD.source_binding_id
+        AND successor.authority=OLD.authority
+        AND successor.ordinal=OLD.next_ordinal
+        AND successor.subject_sha256=OLD.next_subject_sha256
+        AND successor.auth_sha256=OLD.next_auth_sha256
+        AND successor.previous_incarnation_id=OLD.retiring_incarnation_id
+        AND successor.transition_kind='explicit-rebind'
+        AND successor.transition_evidence_sha256=OLD.transition_evidence_sha256
+        AND successor.transition_evidence_json=OLD.transition_evidence_json
+        AND successor.first_seen_at=OLD.observed_at
+        AND successor.last_seen_at=OLD.observed_at
+        AND successor.retired_at IS NULL
+        AND successor.metadata_json=OLD.metadata_json
+    )
+    AND EXISTS (
+      SELECT 1 FROM source_bindings binding
+      WHERE binding.id=OLD.source_binding_id
+        AND binding.authority=OLD.authority
+        AND binding.subject_sha256=OLD.next_subject_sha256
+        AND binding.auth_sha256=OLD.next_auth_sha256
+        AND binding.last_seen_at=OLD.observed_at
+        AND binding.complete_realm_inventory_observed_at=OLD.observed_at
+        AND binding.complete_realm_inventory_sha256=OLD.complete_realm_inventory_sha256
+        AND binding.metadata_json=OLD.metadata_json
+    )
+  )
+  OR (
+    NOT EXISTS (
+      SELECT 1 FROM source_binding_incarnations successor
+      WHERE successor.source_binding_id=OLD.source_binding_id
+        AND successor.ordinal=OLD.next_ordinal
+    )
+    AND EXISTS (
+      SELECT 1 FROM source_binding_incarnations predecessor
+      JOIN source_bindings binding ON binding.id=predecessor.source_binding_id
+      WHERE predecessor.id=OLD.retiring_incarnation_id
+        AND predecessor.source_binding_id=OLD.source_binding_id
+        AND predecessor.authority=OLD.authority
+        AND predecessor.ordinal=OLD.next_ordinal-1
+        AND predecessor.retired_at IS NULL
+        AND binding.authority=OLD.authority
+        AND binding.subject_sha256=predecessor.subject_sha256
+        AND binding.auth_sha256=predecessor.auth_sha256
+        AND (
+          (predecessor.subject_sha256=OLD.next_subject_sha256
+            AND predecessor.auth_sha256=OLD.next_auth_sha256)
+          OR julianday(OLD.observed_at)<julianday(predecessor.last_seen_at)
+          OR predecessor.last_seen_at IS NOT OLD.expected_last_seen_at
+          OR predecessor.metadata_json IS NOT OLD.expected_metadata_json
+          OR binding.last_seen_at IS NOT OLD.expected_last_seen_at
+          OR binding.metadata_json IS NOT OLD.expected_metadata_json
+          OR binding.complete_realm_inventory_observed_at
+            IS NOT OLD.expected_complete_realm_inventory_observed_at
+          OR binding.complete_realm_inventory_sha256
+            IS NOT OLD.expected_complete_realm_inventory_sha256
+          OR EXISTS (
+            SELECT 1 FROM source_binding_incarnations owner
+            WHERE owner.authority=OLD.authority
+              AND owner.subject_sha256=OLD.next_subject_sha256
+              AND owner.source_binding_id<>OLD.source_binding_id
+          )
+        )
+    )
+  )
+)
+BEGIN SELECT RAISE(ABORT, 'source binding transition guard can only be deleted after exact consumption or proven invalidation'); END;