capability. Computer projections never expose a computer token, token digest, or

raw probe document.

Amended 2026-08-24 (issue #183): revoking a computer ends the inference

authority it holds, and cannot be raced.

An `inference_grants` row names the computer it was minted for. A grant is not

a provider credential, but it is authority to spend the owner's account at

`OpenAgentsWeb.InferenceProxyController`, and that controller authenticates the

grant token alone — it never asks which computer presented it, and the

plaintext was delivered to the computer at delegation start. So revoking the

computer used to close its channel and finish its assignments while every grant

it held stayed `active` until its own budget or `expires_at` closed it, up to

`inference_grant_ttl_seconds` later. `machine_id` was written by

`OpenAgents.Work.DelegationServer` and read by nothing; the absence was the

gap.

`OpenAgents.Inference.revoke_active_for_machine/1` now runs inside the same

transaction that writes the revoked computer row, on both paths that revoke one

— `OpenAgents.Machines.revoke_machine/2` and the pairing-expiry branch of

`OpenAgents.Machines.claim_pairing/2`. It moves `status` and the terminal stamp

and nothing else, so revocation is not a way to acquire, exchange, or shed the

fence THREAD-001 requires; `sarah_guard_inference_grant_update` refuses that

independently.

The window between the decision and its commit is closed in PostgreSQL rather

than at the call site. `inference_grants_refuse_revoked_computer` fires before every

insert that names a computer, reads that computer's row `FOR SHARE`, and

refuses unless it is active. `FOR SHARE` conflicts with the `FOR NO KEY UPDATE`

an ordinary `UPDATE machines SET status = 'revoked'` takes, so a mint and a

revocation cannot overlap on that row: either the mint commits first and the

sweep finds its grant, or the revocation commits first and the mint re-reads

`revoked` and raises. The foreign key's own `FOR KEY SHARE` does not conflict

with an ordinary update and would not have served.

`OpenAgents.Inference.mint/1` performs the same read first so an ordinary

caller gets `{:error, :machine_revoked}` rather than a `Postgrex.Error`, and a

mint failure degrades a delegation to a grant-less one rather than blocking it.

The guard is in the database because a source scan finds call sites and not

values: `machine_id` reaches `mint/1` from a variable, and a future writer that

never appears in a grep is fenced the day it lands. What the proof does not

show is contention across two connections — the sandbox holds a test in one

transaction — so the tests establish the refusal inside the revocation's open

window at both layers, and assert the lock itself from `pg_get_functiondef` in

the live database.

A computer's token expiry is a separate clock and is left alone: an active

computer whose `token_expires_at` has passed can no longer authenticate, and

its grants close on their own `expires_at`.

Evidence: `OpenAgentsWeb.Plugs.AssignmentControlAuth`,

`OpenAgents.ComputerAgentJobs`, `OpenAgentsWeb.ComputersController`,

and `test/openagents_web/controllers/computer_control_api_test.exs`.

`OpenAgents.Machines.revoke_machine/2`,

`OpenAgents.Inference.revoke_active_for_machine/1`,

`priv/repo/migrations/20260824032226_refuse_inference_grants_for_revoked_computers.exs`,

`test/openagents_web/controllers/computer_control_api_test.exs`, and

`test/openagents/inference/computer_revocation_test.exs`.

### IDENTITY-009 — Unified delegation preserves substrate authority

| IDENTITY-005 | `test/openagents_web/controllers/box_controller_test.exs` |

| IDENTITY-006 | `test/openagents/forge/assignment_test.exs` |

| IDENTITY-007 | `test/openagents/agents_test.exs` |

| IDENTITY-008 | `test/openagents_web/controllers/computer_control_api_test.exs` |

| IDENTITY-008 | `test/openagents_web/controllers/computer_control_api_test.exs`, `test/openagents/inference/computer_revocation_test.exs` |

| IDENTITY-009 | `test/openagents_web/controllers/delegations_controller_test.exs` |

| IDENTITY-010 | `test/openagents/forge/assignment_test.exs`, `test/openagents/forge/assignment_credential_reach_test.exs` |

| CAPACITY-002 | `test/openagents/box_fanout_test.exs` |

  import Ecto.Query

  alias OpenAgents.Inference.Grant

  alias OpenAgents.Machines.Machine

  alias OpenAgents.Repo

  @token_prefix "sig_"

  A thread's budget is a different question — the caller asked for it, and it

  lives as long as someone is working — so `OpenAgents.Threads` passes

  `OpenAgents.Threads.ceilings/0` rather than borrowing these numbers.

  A grant that names a computer is minted only while that computer is active,

  and only inside the transaction that established it (IDENTITY-008). A revoked

  computer answers `{:error, :machine_revoked}`.

  """

  @spec mint(mint_input()) :: {:ok, Grant.t(), String.t()} | {:error, Ecto.Changeset.t()}

  @spec mint(mint_input()) ::

          {:ok, Grant.t(), String.t()} | {:error, Ecto.Changeset.t() | :machine_revoked}

  def mint(%{} = input) do

    token = @token_prefix <> Base.url_encode64(:crypto.strong_rand_bytes(32), padding: false)

    ceilings = Map.get(input, :ceilings) || delegation_ceilings()

      expires_at: DateTime.add(now(), ceilings.ttl_seconds, :second)

    }

    case attrs |> Grant.mint_changeset() |> Repo.insert() do

    changeset = Grant.mint_changeset(attrs)

    case Map.get(input, :machine_id) do

      nil ->

        case Repo.insert(changeset) do

          {:ok, grant} -> {:ok, grant, token}

          {:error, changeset} -> {:error, changeset}

        end

      machine_id ->

        mint_for_computer(changeset, machine_id, token)

    end

  end

  # A computer-bound grant is minted inside the transaction that reads its

  # computer's row under `FOR SHARE`. `OpenAgents.Machines.revoke_machine/2`

  # takes a conflicting lock on that row before it sweeps the computer's active

  # grants, so a mint and a revocation cannot interleave: a mint that gets there

  # first is found by the sweep, and one that gets there second reads `revoked`

  # and is refused. The same read runs in `inference_grants_refuse_revoked_computer`

  # for every other writer, because a source scan finds call sites and not

  # values.

  defp mint_for_computer(changeset, machine_id, token) do

    Repo.transaction(fn ->

      case computer_status(machine_id) do

        "active" ->

          case Repo.insert(changeset) do

            {:ok, grant} -> grant

            {:error, invalid} -> Repo.rollback(invalid)

          end

        _absent_or_terminal ->

          Repo.rollback(:machine_revoked)

      end

    end)

    |> case do

      {:ok, grant} -> {:ok, grant, token}

      {:error, changeset} -> {:error, changeset}

      {:error, reason} -> {:error, reason}

    end

  end

  defp computer_status(machine_id) do

    case Ecto.UUID.cast(machine_id) do

      {:ok, id} ->

        Machine

        |> where([m], m.id == ^id)

        |> lock("FOR SHARE")

        |> select([m], m.status)

        |> Repo.one()

      :error ->

        nil

    end

  end

  def revoke_active_for_thread(_), do: {0, nil}

  @doc """

  Revoke every active grant minted for a computer.

  A grant's plaintext token is on the computer from the moment it is minted, so

  closing the computer's channel and finishing its assignments does not stop it

  spending — `OpenAgentsWeb.InferenceProxyController` authenticates the token

  and nothing else. This is the transition that does, and

  `OpenAgents.Machines.revoke_machine/2` runs it inside the transaction that

  writes the revoked computer row (IDENTITY-008).

  It moves `status` and the terminal stamp and nothing else. A grant's fences —

  `conversation_id`, `thread_id`, and `machine_id` — stay immutable under the

  `inference_grants` update trigger, so revoking a computer cannot become a way

  to acquire, exchange, or shed the fence THREAD-001 requires.

  """

  @spec revoke_active_for_machine(String.t()) :: {non_neg_integer(), nil}

  def revoke_active_for_machine(machine_id) when is_binary(machine_id) do

    stamp = now()

    Grant

    |> where([g], g.machine_id == ^machine_id and g.status == "active")

    |> Repo.update_all(set: [status: "revoked", revoked_at: stamp, updated_at: stamp])

  end

  def revoke_active_for_machine(_), do: {0, nil}

  @doc """

  Expire every one of an owner's active grants whose clock has run out.

  def store_probe(_machine, _report), do: {:error, :invalid_probe_report}

  @doc """

  Revoke a computer: close its channel, finish its assignments, and end the

  inference authority it is still holding.

  The last of those used to be missing. A revoked computer kept every

  `inference_grants` row minted for it, each carrying a plaintext token already

  delivered to that computer and each good at the inference proxy — which

  authenticates the token and never the computer — until its own budget or

  `expires_at` closed it. `OpenAgents.Inference.revoke_active_for_machine/1`

  now runs in the same transaction as the revoked row, and a grant minted while

  that transaction is open is refused rather than left behind (IDENTITY-008).

  """

  @spec revoke_machine(User.t(), String.t()) :: {:ok, Machine.t()} | {:error, atom()}

  def revoke_machine(%User{id: user_id}, machine_id) do

    with {:ok, machine} <- get_machine(user_id, machine_id) do

      machine

      |> Ecto.Changeset.change(status: "revoked", revoked_at: DateTime.utc_now())

      |> Repo.update()

      # One transaction, and the computer row is locked before the sweep, so a

      # concurrent mint either lands before it and is swept, or blocks on the

      # lock, re-reads `revoked`, and is refused.

      Repo.transaction(fn ->

        locked = Repo.get_for_update!(Machine, machine.id)

        case locked

             |> Ecto.Changeset.change(status: "revoked", revoked_at: DateTime.utc_now())

             |> Repo.update() do

          {:ok, revoked} ->

            _ = OpenAgents.Inference.revoke_active_for_machine(revoked.id)

            revoked

          {:error, _changeset} ->

            Repo.rollback(:machine_not_found)

        end

      end)

      |> case do

        {:ok, revoked} ->

          _ = OpenAgents.Forge.Assignments.finish_for_machine(machine.id)

          {:ok, revoked}

        {:error, _changeset} ->

        {:error, _reason} ->

          {:error, :machine_not_found}

      end

    end

        where: machine.id == ^pairing.machine_id and machine.status == "active"

      )

      |> Repo.update_all(set: [status: "revoked", revoked_at: now, updated_at: now])

      # The other revocation path, and it owes the same thing: this runs inside

      # the claim transaction, after the update has taken the computer row's

      # lock, so an interleaved mint cannot slip a live grant past it.

      _ = OpenAgents.Inference.revoke_active_for_machine(pairing.machine_id)

    end

    :ok

    20260824010337,

    20260824010826,

    20260824011303,

    20260824024146

    20260824024146,

    20260824032226

  ],

  "required_tables": [

    "users",

defmodule OpenAgents.Repo.Migrations.RefuseInferenceGrantsForRevokedComputers do

  @moduledoc """

  A grant is authority to spend the owner's account at the inference proxy, and

  `inference_grants.machine_id` names the computer it was minted for. Revoking

  that computer left the grant `active`: its plaintext token was already on the

  computer, and it kept buying tokens until its own budget or `expires_at`

  closed it. `OpenAgents.Inference.revoke_active_for_machine/1` closes the

  outstanding ones. This closes the window underneath that.

  Between the moment a revocation decides a computer is gone and the moment it

  commits, a delegation can mint a new grant for the same computer. The sweep

  has already run; the new row is not in it. So the fence is here rather than

  only in Elixir: every insert that names a computer reads that computer's row

  under `FOR SHARE` and refuses unless it is active.

  `FOR SHARE` is what makes the ordering total. A revocation's

  `UPDATE machines SET status = 'revoked'` takes `FOR NO KEY UPDATE`, which

  conflicts with it, so the two transactions cannot overlap on that row. Either

  the mint commits first and the revocation's sweep finds its grant, or the

  revocation commits first and the mint blocks, re-reads `revoked`, and raises.

  The foreign key's own `FOR KEY SHARE` does not conflict with an ordinary

  update and would not have served.

  The guard is a trigger rather than a `CHECK` because it reads another table,

  and it covers every writer rather than the one call site a source scan finds.

  `OpenAgents.Inference.mint/1` performs the same read first, so an ordinary

  caller gets `{:error, :machine_revoked}` instead of a `Postgrex.Error`.

  """

  use Ecto.Migration

  def up do

    execute("""

    CREATE OR REPLACE FUNCTION inference_grants_refuse_revoked_computer()

    RETURNS trigger AS $$

    DECLARE

      computer_status text;

    BEGIN

      IF NEW.machine_id IS NULL THEN

        RETURN NEW;

      END IF;

      SELECT status INTO computer_status

      FROM machines

      WHERE id = NEW.machine_id

      FOR SHARE;

      IF computer_status IS DISTINCT FROM 'active' THEN

        RAISE EXCEPTION

          'inference_grants cannot name computer % (%)',

          NEW.machine_id, COALESCE(computer_status, 'absent');

      END IF;

      RETURN NEW;

    END;

    $$ LANGUAGE plpgsql;

    """)

    execute("""

    CREATE TRIGGER inference_grants_refuse_revoked_computer

    BEFORE INSERT ON inference_grants

    FOR EACH ROW EXECUTE FUNCTION inference_grants_refuse_revoked_computer();

    """)

  end

  def down do

    execute(

      "DROP TRIGGER IF EXISTS inference_grants_refuse_revoked_computer ON inference_grants;"

    )

    execute("DROP FUNCTION IF EXISTS inference_grants_refuse_revoked_computer();")

  end

end

defmodule OpenAgents.Inference.ComputerRevocationTest do

  @moduledoc """

  IDENTITY-008's authority clause: a revoked computer holds no inference

  authority.

  `inference_grants.machine_id` was written by

  `OpenAgents.Work.DelegationServer` and read by nothing, and the absence was

  the bug. Revoking a computer closed its channel and finished its assignments

  and left its grants `active` — each one a plaintext token already delivered to

  that computer, and `OpenAgentsWeb.InferenceProxyController` authenticates the

  token and never the computer.

  Two properties, because they fail differently.

  **Outstanding grants stop working.** The sweep runs in the same transaction

  that writes the revoked computer row, so a grant minted before the decision is

  terminal the moment the decision commits.

  **A grant minted inside the window does not survive it.** Ecto's sandbox runs

  each test inside one uncommitted transaction, so a mint attempted after

  `revoke_machine/2` returns here is a mint attempted after the revocation

  decided and before it committed — the window itself, not a model of it. It is

  refused twice: by `OpenAgents.Inference.mint/1`, and, with that call bypassed,

  by `inference_grants_refuse_revoked_computer` in PostgreSQL.

  What that pair does not show is a mint on a *different* connection blocking

  until the revocation commits. That rests on the `FOR SHARE` the trigger takes

  on the computer row, which conflicts with the `FOR NO KEY UPDATE` an ordinary

  `UPDATE machines` takes. The last test asserts that lock is in the deployed

  trigger, read back from `pg_get_functiondef` rather than from the migration

  file.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Ecto.Query

  alias OpenAgents.Inference

  alias OpenAgents.Inference.Grant

  alias OpenAgents.Machines

  alias OpenAgents.Repo

  defp computer(owner, key) do

    {:ok, %{code: code}} =

      Machines.start_pairing(%{

        "name" => "revocation-#{key}",

        "tier" => "curated",

        "platform" => "linux-x64",

        "agent_version" => "0.1.0",

        "roots" => ["/home/x/code"]

      })

    {:ok, machine} = Machines.approve_pairing(owner, code)

    machine

  end

  defp scope(key) do

    owner = github_user("revoke-#{key}")

    {:ok, conversation} = OpenAgents.Conversations.ensure_conversation(owner)

    %{

      owner: owner,

      owner_visitor_id: conversation.visitor_id,

      conversation_id: conversation.id,

      machine: computer(owner, key)

    }

  end

  defp mint!(scope, machine) do

    {:ok, grant, token} =

      Inference.mint(%{

        owner_visitor_id: scope.owner_visitor_id,

        conversation_id: scope.conversation_id,

        machine_id: machine.id

      })

    {grant, token}

  end

  describe "an outstanding grant does not outlive its computer" do

    test "every grant the revoked computer holds becomes terminal" do

      scope = scope("outstanding")

      {first, first_token} = mint!(scope, scope.machine)

      {second, second_token} = mint!(scope, scope.machine)

      assert {:ok, %Grant{}} = Inference.resolve(first_token)

      assert {:ok, %Grant{}} = Inference.resolve(second_token)

      assert {:ok, revoked} = Machines.revoke_machine(scope.owner, scope.machine.id)

      assert revoked.status == "revoked"

      assert {:error, :grant_revoked} = Inference.resolve(first_token)

      assert {:error, :grant_revoked} = Inference.resolve(second_token)

      for id <- [first.id, second.id] do

        stored = Repo.get(Grant, id)

        assert stored.status == "revoked"

        assert stored.revoked_at

      end

    end

    test "the proxy refuses the revoked computer's token", %{conn: conn} do

      scope = scope("proxy")

      {_grant, token} = mint!(scope, scope.machine)

      assert {:ok, _revoked} = Machines.revoke_machine(scope.owner, scope.machine.id)

      conn =

        conn

        |> put_req_header("authorization", "Bearer #{token}")

        |> put_req_header("content-type", "application/json")

        |> post(

          ~p"/api/inference/proxy",

          Jason.encode!(%{"messages" => [%{"role" => "user", "content" => "still here?"}]})

        )

      assert conn.status == 403

      assert Jason.decode!(conn.resp_body) == %{"error" => %{"code" => "grant_revoked"}}

    end

    test "revocation ends authority without touching the fence THREAD-001 requires" do

      scope = scope("fence")

      {grant, _token} = mint!(scope, scope.machine)

      assert {:ok, _revoked} = Machines.revoke_machine(scope.owner, scope.machine.id)

      stored = Repo.get(Grant, grant.id)

      assert stored.status == "revoked"

      assert stored.conversation_id == scope.conversation_id

      assert is_nil(stored.thread_id)

      assert stored.machine_id == scope.machine.id

    end

    test "revocation reaches only the revoked computer's grants" do

      scope = scope("neighbour")

      other = computer(scope.owner, "neighbour-other")

      {_revoked_grant, revoked_token} = mint!(scope, scope.machine)

      {_kept_grant, kept_token} = mint!(scope, other)

      {:ok, _machineless, machineless_token} =

        Inference.mint(%{

          owner_visitor_id: scope.owner_visitor_id,

          conversation_id: scope.conversation_id

        })

      assert {:ok, _} = Machines.revoke_machine(scope.owner, scope.machine.id)

      assert {:error, :grant_revoked} = Inference.resolve(revoked_token)

      assert {:ok, %Grant{status: "active"}} = Inference.resolve(kept_token)

      assert {:ok, %Grant{status: "active"}} = Inference.resolve(machineless_token)

    end

    test "an expired pairing revokes its computer's grants on the same path" do

      owner = github_user("revoke-pairing")

      {:ok, conversation} = OpenAgents.Conversations.ensure_conversation(owner)

      {:ok, %{pairing: pairing, code: code, poll_secret: poll_secret}} =

        Machines.start_pairing(%{

          "name" => "revocation-pairing",

          "tier" => "curated",

          "platform" => "linux-x64",

          "agent_version" => "0.1.0",

          "roots" => ["/home/x/code"]

        })

      {:ok, machine} = Machines.approve_pairing(owner, code)

      {:ok, _grant, token} =

        Inference.mint(%{

          owner_visitor_id: conversation.visitor_id,

          conversation_id: conversation.id,

          machine_id: machine.id

        })

      # Expire the pairing so the claim takes the expiry branch, which revokes

      # the computer it already created.

      Repo.update_all(

        from(p in OpenAgents.Machines.Pairing, where: p.id == ^pairing.id),

        set: [expires_at: DateTime.add(DateTime.utc_now(), -60, :second)]

      )

      assert {:error, :pairing_expired} = Machines.claim_pairing(pairing.id, poll_secret)

      assert Repo.get(OpenAgents.Machines.Machine, machine.id).status == "revoked"

      assert {:error, :grant_revoked} = Inference.resolve(token)

    end

  end

  describe "a grant minted inside the revocation window does not survive it" do

    test "mint/1 refuses and writes nothing" do

      scope = scope("window")

      # The sandbox holds this test in one uncommitted transaction, so the

      # revocation below has decided and has not committed. This is the window.

      assert {:ok, _revoked} = Machines.revoke_machine(scope.owner, scope.machine.id)

      before = Repo.aggregate(Grant, :count)

      assert {:error, :machine_revoked} =

               Inference.mint(%{

                 owner_visitor_id: scope.owner_visitor_id,

                 conversation_id: scope.conversation_id,

                 machine_id: scope.machine.id

               })

      assert Repo.aggregate(Grant, :count) == before

    end

    test "PostgreSQL refuses the same insert with mint/1 bypassed" do

      scope = scope("window-db")

      assert {:ok, _revoked} = Machines.revoke_machine(scope.owner, scope.machine.id)

      attrs = %{

        owner_visitor_id: scope.owner_visitor_id,

        conversation_id: scope.conversation_id,

        machine_id: scope.machine.id,

        model_id: "test-model",

        token_digest: :crypto.hash(:sha256, "sig_bypass"),

        max_total_tokens: 100,

        max_calls: 1,

        max_cost_microusd: 100,

        expires_at: DateTime.add(DateTime.utc_now(), 900, :second)

      }

      error =

        assert_raise Postgrex.Error, fn ->

          attrs |> Grant.mint_changeset() |> Repo.insert()

        end

      assert error.postgres.message =~ "cannot name computer"

      assert error.postgres.message =~ "revoked"

    end

    test "the deployed guard reads the computer row under a conflicting lock" do

      %Postgrex.Result{rows: [[definition]]} =

        Ecto.Adapters.SQL.query!(

          Repo,

          "SELECT pg_get_functiondef('inference_grants_refuse_revoked_computer'::regproc)",

          []

        )

      assert definition =~ "FROM machines"

      # FOR SHARE conflicts with the FOR NO KEY UPDATE an ordinary

      # `UPDATE machines SET status = 'revoked'` takes; the foreign key's own

      # FOR KEY SHARE does not, and would leave the two free to interleave.

      assert definition =~ "FOR SHARE"

    end

  end

end