test: isolate identity assertions and clean up creation audit rows

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/agent-default-configure-grants.test.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { eq } from "drizzle-orm";
-import { agents, companies, companyMemberships, createDb, principalPermissionGrants } from "@paperclipai/db";
+import { activityLog, agents, companies, companyMemberships, createDb, principalPermissionGrants } from "@paperclipai/db";
 import { LOW_TRUST_REVIEW_PRESET, type PermissionKey } from "@paperclipai/shared";
 import { getEmbeddedPostgresTestSupport, startEmbeddedPostgresTestDatabase } from "./helpers/embedded-postgres.js";
 import { agentService } from "../services/agents.js";
@@ -137,6 +137,7 @@ describeDatabase("new agent configuration defaults", () => {
     await db.delete(principalPermissionGrants).where(eq(principalPermissionGrants.companyId, companyId));
     await db.delete(companyMemberships).where(eq(companyMemberships.companyId, companyId));
     await db.delete(agents).where(eq(agents.companyId, companyId));
+    await db.delete(activityLog).where(eq(activityLog.companyId, companyId));
     await db.delete(companies).where(eq(companies.id, companyId));
   });
 
@@ -178,6 +179,7 @@ describeDatabase("new agent configuration defaults", () => {
 
     await db.delete(principalPermissionGrants).where(eq(principalPermissionGrants.companyId, companyId));
     await db.delete(agents).where(eq(agents.companyId, companyId));
+    await db.delete(activityLog).where(eq(activityLog.companyId, companyId));
     await db.delete(companies).where(eq(companies.id, companyId));
   });
 
@@ -207,6 +209,7 @@ describeDatabase("new agent configuration defaults", () => {
 
     await db.delete(principalPermissionGrants).where(eq(principalPermissionGrants.companyId, companyId));
     await db.delete(agents).where(eq(agents.companyId, companyId));
+    await db.delete(activityLog).where(eq(activityLog.companyId, companyId));
     await db.delete(companies).where(eq(companies.id, companyId));
   });
 
@@ -235,6 +238,7 @@ describeDatabase("new agent configuration defaults", () => {
     await db.delete(principalPermissionGrants).where(eq(principalPermissionGrants.companyId, companyId));
     await db.delete(companyMemberships).where(eq(companyMemberships.companyId, companyId));
     await db.delete(agents).where(eq(agents.companyId, companyId));
+    await db.delete(activityLog).where(eq(activityLog.companyId, companyId));
     await db.delete(companies).where(eq(companies.id, companyId));
   });
 });

server/src/__tests__/agent-identity.test.ts

@@ -50,7 +50,7 @@ describe("agent cryptographic identity", () => {
   it("migration and public reads leave existing agents unprovisioned", async () => {
     const agent = await oldAgent();
     expect(await agentIdentityService(db).getPublicIdentity(companyId, agent.id)).toBeNull();
-    expect(await db.select().from(agentIdentityKeys)).toHaveLength(0);
+    expect(await db.select().from(agentIdentityKeys).where(eq(agentIdentityKeys.agentId, agent.id))).toHaveLength(0);
     for (const type of ["http", "openclaw_gateway", "hermes_gateway"]) expect(supportsManagedAgentIdentity(type)).toBe(false);
     for (const provider of ["claude_managed", "aws_agentcore"]) expect(supportsManagedAgentIdentity("paperclip_runner", { provider })).toBe(false);
     expect(supportsManagedAgentIdentity("paperclip_runner", { provider: "codex" }, "claude_managed_agents_api")).toBe(false);