@consiliency/agent-board-schema 1.10.0 → 1.22.0

package/migrations/20260824000100_agent_board_claimgate_shadow.sql

@@ -0,0 +1,443 @@
+-- CLAIMGATE Phase 2 — SHADOW (#133): fleet-graph authority predicate + shadow stamping.
+-- BLOCKS NOTHING on authority. Introduces `_can_claim_resource(kind, key)` (IF-0-SHADOW-1,
+-- the frozen signature ENFORCE consumes unchanged), computes it in `acquire_claim`, and stamps
+-- the verdict into `claims.metadata.claimgate_shadow = {kind, authorized}` so we get a live
+-- authorized-vs-denied census BEFORE any enforcement.
+--
+-- This phase carries the OWNERLESS-tail guard (file/tool/custom, which has no fleet authority to
+-- gate it): a per-agent active-claim QUOTA + a max-lease-horizon TTL CAP, in `acquire_claim` (NOT
+-- in the predicate — the predicate consults ONLY the fleet graph; see NEGATIVE RULE below). Per
+-- the design-panel amendment (specs/phase-plans-v10.md:329) the logic lives in SHADOW, but per the
+-- census amendment (:333) it ships GATED OFF: the guard is behind `_claimgate_ownerless_guards_
+-- enabled()`, which DEFAULTS FALSE, so SHADOW literally blocks NOTHING until an operator enables
+-- it after the prod lease-length census confirms the cap is safe. (Maintainer decision 2026-07-31,
+-- resolving codex's must-fix: enforcing 30d/50 unconditionally could reject a legit long-lease
+-- consumer before the census.) The serialization + cap/quota code is in place for the flip.
+--
+-- =====================================================================================
+-- AUTHORITY MODEL (fleet graph ONLY — NEGATIVE RULE: no board-admin fallback, EVER)
+-- =====================================================================================
+--   service_role                       -> true (operator carve-out; short-circuit).
+--   machine  (key = <machine_fingerprint>, bare per IF-0-CLAIMKEY-1)
+--     authorized iff an ACTIVE fleet_machines row with that fingerprint exists in an ACTIVE
+--     trust domain AND the actor either OWNS it (fleet_machines.owner_agent_id) or holds an
+--     ACTIVE fleet_machine_agents binding on it. RATIFIED identity invariant: machine_fingerprint
+--     is GLOBALLY UNIQUE (idx_agent_board_fleet_machines_fingerprint_unique) — so `<fp>` is
+--     unambiguous; no owner-in-key hedge.
+--   repository (key = <repo_fingerprint>) / repo_file (key = <repo_fingerprint>:<path>; the
+--     FIRST ':' splits fp|path — same parse position CLAIMKEY froze)
+--     authorized iff the actor holds an ACTIVE fleet_machine_agents binding whose repo_scope_id
+--     resolves to an ACTIVE fleet_repo_scopes with repo_fingerprint = fp AND scope_role <>
+--     'observer', AND the FULL chain up from that scope is lifecycle-active at EVERY edge:
+--        repo_scope -> harness_registration -> machine -> trust_domain.
+--     CRITICAL PANEL AMENDMENT (specs/phase-plans-v10.md:323-328): revoke_fleet_subject('harness',…)
+--     does NOT cascade to child repo-scopes, so a harness-only revoke leaves the scope 'active'
+--     yet the harness dead — the chain walk MUST re-check fhr.lifecycle_state='active' or a
+--     harness-revoked actor is wrongly authorized. RATIFIED: repo_fingerprint is NOT globally
+--     unique, so authority over `<fp>` is the UNION of all non-observer scope holders across ALL
+--     trust domains (shared-lock model) — the predicate does NOT scope by domain in the key.
+--   task                               -> true (governed by acquire_claim's existing task gate).
+--   file / tool / custom               -> true (ownerless tail; governed by the TTL cap + quota
+--                                         in acquire_claim, NOT by fleet authority).
+--
+-- SHADOW SEMANTICS: the predicate returns the HONEST verdict (a null/unresolved principal or a
+-- non-fleet actor on a fleet-backed kind returns FALSE), but acquire_claim only STAMPS it — it
+-- does not block on it. Fail-closed-on-unknown-KIND is an ENFORCE concern; here the catalog is
+-- fully enumerated (7 kinds, all with an arm) and the defensive else returns true (blocks nothing).
+--
+-- #118 class (CLAUDE.md schema-mechanics): every NEWLY-DEFINED SECURITY DEFINER function below
+-- restates `revoke ... from public, anon`, `grant ... to authenticated/service_role`, and a
+-- `comment` in THIS migration. acquire_claim is a create-or-replace of an existing function, so
+-- it preserves its prior ACL/comment and restates only revoke+grant (it carries no historical
+-- comment to restate). Additive, forward-only. schema_version stays 8.
+--
+-- =====================================================================================
+-- OWNERLESS-TAIL CENSUS (one-shot; run against the TARGET DB before relying on the TTL cap)
+-- =====================================================================================
+-- The TTL cap must not silently break a live long-lease consumer. This DB (local replay) has no
+-- live claims; the maintainer runs this against the prod project to confirm the lease-length
+-- distribution sits under the cap. This census GATES ENABLING the flag: only after it confirms the
+-- distribution is safe does an operator set claimgate_enforcement_flags('ownerless_guards', true)
+-- (or ENFORCE flip it with ratified values). Until then the guard is OFF and blocks nothing.
+-- (Committed as the artifact for the SHADOW census exit criterion, mirroring CLAIMKEY's census.)
+--
+--   select resource_kind,
+--          count(*)                                            as active_claims,
+--          min(lease_expires_at - now())                       as min_remaining,
+--          max(lease_expires_at - now())                       as max_remaining,
+--          percentile_disc(0.5) within group (order by lease_expires_at - now()) as p50_remaining,
+--          percentile_disc(0.95) within group (order by lease_expires_at - now()) as p95_remaining,
+--          count(*) filter (
+--            where lease_expires_at > now() + agent_board._claimgate_ownerless_ttl_cap()
+--          )                                                   as over_cap
+--     from agent_board.claims
+--    where status = 'active' and released_at is null
+--      and resource_kind in ('file', 'tool', 'custom')
+--    group by resource_kind
+--    order by resource_kind;
+-- =====================================================================================
+
+-- 0. Single-source policy constants for the ownerless tail. Immutable so the migration logic
+--    AND the tests/isolation specs reference ONE value; ENFORCE tunes them here (and the max
+--    horizon amendment extends the cap to acquire+renew for all non-task kinds). The chosen
+--    defaults are GENEROUS placeholders pending the prod census above — flagged as a design
+--    question, not a settled policy number.
+create or replace function agent_board._claimgate_ownerless_ttl_cap()
+returns interval
+language sql
+immutable
+set search_path = ''
+as $$ select interval '30 days' $$;
+revoke all on function agent_board._claimgate_ownerless_ttl_cap() from public, anon;
+grant execute on function agent_board._claimgate_ownerless_ttl_cap() to authenticated, service_role;
+comment on function agent_board._claimgate_ownerless_ttl_cap() is
+  'CLAIMGATE/SHADOW (#133): max lease horizon for an ownerless (file/tool/custom) claim at acquire. '
+  'Single source for the migration logic and its tests. GENEROUS placeholder (30d) pending prod census; '
+  'ENFORCE ratifies the final value and extends the horizon to renew for all non-task kinds.';
+
+create or replace function agent_board._claimgate_ownerless_quota()
+returns integer
+language sql
+immutable
+set search_path = ''
+as $$ select 50 $$;
+revoke all on function agent_board._claimgate_ownerless_quota() from public, anon;
+grant execute on function agent_board._claimgate_ownerless_quota() to authenticated, service_role;
+comment on function agent_board._claimgate_ownerless_quota() is
+  'CLAIMGATE/SHADOW (#133): max concurrent ACTIVE ownerless (file/tool/custom) claims per agent. '
+  'Single source for the migration logic and its tests. GENEROUS placeholder (50) pending prod census.';
+
+-- 0b. Enforcement gate — OFF BY DEFAULT (SHADOW blocks nothing). ------------------------
+-- The roadmap (phase-plans-v10.md:333) requires the live lease-length census BEFORE the TTL cap
+-- is enabled, and the census is operator-owned (prod-only). So the ownerless TTL cap + quota are
+-- gated behind this flag, which DEFAULTS OFF (absent row => disabled), mirroring the send-authz
+-- config-flag pattern (20260718000100, which defaults fail-open). While OFF, acquire_claim does
+-- NOT enforce the cap or quota — SHADOW blocks NOTHING; only the shadow-stamp remains. The
+-- operator flips it ON post-census (or ENFORCE flips it with ratified values); the advisory-lock
+-- serialization and the cap/quota logic below are already in place for that moment.
+create table if not exists agent_board.claimgate_enforcement_flags (
+  scope_key text primary key,
+  enabled boolean not null default false,
+  updated_at timestamptz not null default now()
+);
+comment on table agent_board.claimgate_enforcement_flags is
+  'CLAIMGATE per-scope enforcement flags. Absent row => disabled (SHADOW default: blocks nothing). '
+  'scope_key ''ownerless_guards'' gates the ownerless (file/tool/custom) TTL cap + per-agent quota in '
+  'acquire_claim. Operator-managed (service_role); enabled only after the prod lease-length census.';
+alter table agent_board.claimgate_enforcement_flags enable row level security;
+grant select, insert, update, delete on agent_board.claimgate_enforcement_flags to service_role;
+drop policy if exists agent_board_service_all_claimgate_enforcement_flags on agent_board.claimgate_enforcement_flags;
+create policy agent_board_service_all_claimgate_enforcement_flags
+  on agent_board.claimgate_enforcement_flags
+  as permissive for all to service_role using (true) with check (true);
+
+create or replace function agent_board._claimgate_ownerless_guards_enabled()
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(
+    (select f.enabled
+       from agent_board.claimgate_enforcement_flags f
+      where f.scope_key = 'ownerless_guards'),
+    false)
+$$;
+revoke all on function agent_board._claimgate_ownerless_guards_enabled() from public, anon;
+grant execute on function agent_board._claimgate_ownerless_guards_enabled() to authenticated, service_role;
+comment on function agent_board._claimgate_ownerless_guards_enabled() is
+  'CLAIMGATE/SHADOW (#133): are the ownerless (file/tool/custom) TTL cap + quota ENABLED? '
+  'Reads claimgate_enforcement_flags(''ownerless_guards''); DEFAULTS FALSE (no row) so SHADOW blocks '
+  'nothing until an operator enables it post-census. SECURITY DEFINER; PUBLIC EXECUTE revoked.';
+
+-- 1. _can_claim_resource — the frozen SHADOW authority predicate (IF-0-SHADOW-1) -----------
+--    SECURITY DEFINER to break fleet-table RLS recursion (the fleet SELECT policies reference
+--    each other). Session-derived actor via current_agent_id(); the actor-parameterized private
+--    twin (for censusing EXISTING held claims) is an ENFORCE requirement, deferred.
+create or replace function agent_board._can_claim_resource(
+  p_resource_kind text,
+  p_resource_key text
+)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = 'agent_board', 'public'
+as $function$
+declare
+  v_actor uuid;
+  v_fp    text;
+  v_sep   int;
+begin
+  -- Operator carve-out: service_role short-circuits authorized (matches every other gate).
+  if agent_board._is_service_role() then
+    return true;
+  end if;
+
+  v_actor := agent_board.current_agent_id();
+  -- An unresolved principal is honestly UNAUTHORIZED on any fleet-backed kind. (Blocks nothing
+  -- in SHADOW — acquire_claim only stamps this verdict.) The ownerless tail + task are not
+  -- fleet-gated, so they remain authorized even with a null actor.
+  if p_resource_kind = 'task' then
+    return true;
+  elsif p_resource_kind in ('file', 'tool', 'custom') then
+    return true;
+  end if;
+
+  if v_actor is null then
+    return false;
+  end if;
+
+  if p_resource_kind = 'machine' then
+    v_fp := btrim(p_resource_key);
+    if v_fp is null or v_fp = '' then
+      return false;
+    end if;
+    -- machine_fingerprint is globally unique; the machine AND its trust domain must be active,
+    -- and the actor must own it OR hold an active binding on it.
+    return exists (
+      select 1
+        from agent_board.fleet_machines fm
+        join agent_board.fleet_trust_domains ftd
+          on ftd.id = fm.trust_domain_id
+       where fm.machine_fingerprint = v_fp
+         and fm.lifecycle_state = 'active'
+         and ftd.lifecycle_state = 'active'
+         and (
+           fm.owner_agent_id = v_actor
+           or exists (
+             select 1
+               from agent_board.fleet_machine_agents fma
+              where fma.machine_id = fm.id
+                and fma.agent_id = v_actor
+                and fma.lifecycle_state = 'active'
+           )
+         )
+    );
+
+  elsif p_resource_kind = 'repository' or p_resource_kind = 'repo_file' then
+    if p_resource_kind = 'repo_file' then
+      -- FIRST ':' splits fp | path (the exact position CLAIMKEY froze). No colon / empty fp =
+      -- not resolvable -> deny (honest verdict; blocks nothing in SHADOW).
+      v_sep := position(':' in coalesce(p_resource_key, ''));
+      if v_sep <= 1 then
+        return false;
+      end if;
+      v_fp := btrim(substring(p_resource_key from 1 for v_sep - 1));
+    else
+      v_fp := btrim(p_resource_key);
+    end if;
+    if v_fp is null or v_fp = '' then
+      return false;
+    end if;
+    -- FULL chain, EVERY edge lifecycle-active (PANEL AMENDMENT: harness revoke does not cascade
+    -- to child scopes, so fhr.lifecycle_state='active' is load-bearing here). Anchored on the
+    -- actor's active binding + its repo_scope; UNION across trust domains (shared-lock model).
+    return exists (
+      select 1
+        from agent_board.fleet_machine_agents fma
+        join agent_board.fleet_repo_scopes frs
+          on frs.id = fma.repo_scope_id
+        join agent_board.fleet_harness_registrations fhr
+          on fhr.id = frs.harness_registration_id
+        join agent_board.fleet_machines fm
+          on fm.id = fhr.machine_id
+        join agent_board.fleet_trust_domains ftd
+          on ftd.id = fm.trust_domain_id
+       where fma.agent_id = v_actor
+         and fma.lifecycle_state = 'active'
+         and frs.repo_fingerprint = v_fp
+         and frs.scope_role <> 'observer'
+         and frs.lifecycle_state = 'active'
+         and fhr.lifecycle_state = 'active'
+         and fm.lifecycle_state = 'active'
+         and ftd.lifecycle_state = 'active'
+    );
+
+  else
+    -- Defensive: an unenumerated future kind. SHADOW blocks nothing; the completeness test
+    -- enumerates the 7 catalog kinds and asserts each is handled above, so this is unreachable
+    -- for today's constraint and never masks a missing arm.
+    return true;
+  end if;
+end;
+$function$;
+revoke all on function agent_board._can_claim_resource(text, text) from public, anon;
+grant execute on function agent_board._can_claim_resource(text, text) to authenticated, service_role;
+comment on function agent_board._can_claim_resource(text, text) is
+  'CLAIMGATE/SHADOW (#133, IF-0-SHADOW-1): fleet-graph authority predicate ENFORCE consumes unchanged. '
+  'machine = actor owns/bound to the active machine in an active trust domain (fingerprint globally unique); '
+  'repository/repo_file = actor holds an active binding to an active non-observer repo_scope whose FULL chain '
+  '(scope->harness->machine->domain) is lifecycle-active (harness revoke does NOT cascade — checked explicitly); '
+  'task + file/tool/custom = true (gated elsewhere). Fleet graph ONLY — NO board-admin fallback. '
+  'service_role short-circuits true. SECURITY DEFINER to break fleet RLS recursion; PUBLIC EXECUTE revoked.';
+
+-- 2. acquire_claim — compute + STAMP the shadow verdict; guard the ownerless tail -----------
+--    Reproduced verbatim from 20260821000100 (CLAIMKEY) EXCEPT: (a) compute _can_claim_resource
+--    after canonicalization and before the sweep (predicate-before-side-effects, so ENFORCE can
+--    flip it fail-closed in place); (b) enforce the ownerless TTL cap + serialized quota; (c)
+--    merge metadata.claimgate_shadow into the inserted row. BLOCKS NOTHING on authority.
+create or replace function agent_board.acquire_claim(
+  p_agent_id uuid,
+  p_resource_kind text,
+  p_resource_key text,
+  p_lease_expires_at timestamp with time zone,
+  p_task_id uuid default null,
+  p_thread_id uuid default null,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(claim_id uuid, task_id uuid, thread_id uuid, agent_id uuid, resource_kind text, resource_key text, status text, lease_token uuid, lease_expires_at timestamp with time zone, released_at timestamp with time zone, created_at timestamp with time zone, updated_at timestamp with time zone)
+language plpgsql
+security definer
+set search_path to 'agent_board', 'public'
+as $function$
+declare
+  v_thread_id uuid;
+  v_claim_id uuid;
+  v_actor_agent_id uuid;
+  v_shadow_authorized boolean;
+  v_ownerless boolean;
+  v_active_ownerless int;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_agent_id, 'p_agent_id');
+
+  if nullif(trim(p_resource_key), '') is null then
+    raise exception 'resource key is required' using errcode = '22023';
+  end if;
+
+  -- CLAIMKEY (#133): normalize the resource key to its canonical, fleet-fingerprint-carrying
+  -- form BEFORE any lookup/insert, so the row stored (and the uniqueness index contended)
+  -- carry canonical identity. NORMALIZE-ONLY — this never rejects (rejection is ENFORCE).
+  p_resource_key := agent_board._canonical_claim_key(p_resource_kind, p_resource_key);
+
+  if p_task_id is not null then
+    select tasks.thread_id into v_thread_id from agent_board.tasks where id = p_task_id;
+    if v_thread_id is null then
+      raise exception 'task not found' using errcode = 'P0002';
+    end if;
+    if not agent_board._current_agent_can_access_task(p_task_id) then
+      raise exception 'task not accessible to current agent' using errcode = '42501';
+    end if;
+  else
+    v_thread_id := p_thread_id;
+  end if;
+
+  if v_thread_id is not null and not agent_board._current_agent_can_access_thread(v_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+
+  -- OBSGATE-4 (#127): a claim on a TASK resource is authorized on the LOCKED task = the task
+  -- named by RESOURCE_KEY (resource_kind='task'). The active-resource uniqueness is on
+  -- (resource_kind, resource_key), so that is the task a squat contends for — gating resource_key
+  -- (NOT p_task_id, which only associates the claim/event) prevents locking task B's key while
+  -- authorizing on an unrelated task A passed as p_task_id. A non-uuid 'task' key cannot collide
+  -- with a uuid-keyed legitimate claim.
+  --
+  -- The composition MIRRORS append_task_event's: ACCESS then MUTATE. mutate alone is
+  -- insufficient — _current_agent_can_mutate_task admits any non-observer board member via
+  -- _current_agent_can_post_to_thread (board send-role), which is NOT thread access; on a
+  -- RESTRICTED thread a board member lacking thread access would pass mutate but must still be
+  -- denied (they cannot access the task). Requiring access too closes that gap and matches the
+  -- authorization a task-BOUND acquire already gets through append_task_event.
+  if p_resource_kind = 'task'
+     and p_resource_key ~ '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$' then
+    if not agent_board._current_agent_can_access_task(p_resource_key::uuid) then
+      raise exception 'task not accessible to current agent' using errcode = '42501';
+    end if;
+    if not agent_board._current_agent_can_mutate_task(p_resource_key::uuid) then
+      raise exception 'claiming a task resource requires a non-observer board role, or task assignment/creation'
+        using errcode = '42501';
+    end if;
+  end if;
+
+  -- CLAIMGATE/SHADOW (#133): compute the fleet-graph authority verdict BEFORE the sweep (so
+  -- ENFORCE can flip this same point fail-closed with no observable side effect leaking to an
+  -- unauthorized caller). SHADOW BLOCKS NOTHING on this verdict — it is only stamped below.
+  v_shadow_authorized := agent_board._can_claim_resource(p_resource_kind, p_resource_key);
+
+  -- Ownerless tail (file/tool/custom): the ONE guard SHADOW carries — GATED OFF BY DEFAULT.
+  -- _claimgate_ownerless_guards_enabled() is false unless an operator flips it post-census, so in
+  -- SHADOW this block is skipped entirely and NOTHING is blocked (only the stamp above lands).
+  -- service_role is also exempt (operator carve-out, consistent with the predicate short-circuit).
+  v_ownerless := p_resource_kind in ('file', 'tool', 'custom');
+  if v_ownerless
+     and not agent_board._is_service_role()
+     and agent_board._claimgate_ownerless_guards_enabled() then
+    -- TTL CAP: an ownerless lease may not exceed the max horizon. Rejects an over-long acquire;
+    -- this is a lease-length bound, NOT an authority block.
+    if p_lease_expires_at > now() + agent_board._claimgate_ownerless_ttl_cap() then
+      raise exception 'ownerless claim lease horizon exceeds cap (%)', agent_board._claimgate_ownerless_ttl_cap()
+        using errcode = '22023';
+    end if;
+
+    -- QUOTA (transactionally serialized): an actor-scoped advisory XACT lock serializes this
+    -- actor's concurrent acquisitions (on DIFFERENT keys, which the row-level uniqueness index
+    -- does NOT), so a count-before-insert cannot race two claims past the cap. The lock releases
+    -- at commit; it does not block other actors (the key mixes in the actor id).
+    perform pg_advisory_xact_lock(hashtext('agent_board.claimgate_ownerless_quota'), hashtext(v_actor_agent_id::text));
+    select count(*) into v_active_ownerless
+      from agent_board.claims c
+     where c.agent_id = v_actor_agent_id
+       and c.resource_kind in ('file', 'tool', 'custom')
+       and c.status = 'active'
+       and c.released_at is null
+       and c.lease_expires_at > now();
+    if v_active_ownerless >= agent_board._claimgate_ownerless_quota() then
+      raise exception 'ownerless active-claim quota reached (% per agent)', agent_board._claimgate_ownerless_quota()
+        using errcode = '54000';
+    end if;
+  end if;
+
+  -- CLAIMKEY (#133) MUST-FIX 3: the sweep AND the conflict check are ALIAS-AWARE. p_resource_key
+  -- is already canonical (above); comparing against the CANONICAL form of each existing row's key
+  -- matches both a canonical row AND an un-healed LEGACY row for the same physical resource. Without
+  -- this, acquire('machine','machine:fpDH') would normalize to 'fpDH', see no exact-'fpDH' conflict
+  -- against a still-active legacy 'machine:fpDH' row, and INSERT a second live hold — breaking mutual
+  -- exclusion during the legacy window. Closing it here in code does NOT depend on the operator-owned
+  -- live census.
+  update agent_board.claims c
+     set status = 'expired',
+         updated_at = now()
+   where c.resource_kind = p_resource_kind
+     and agent_board._canonical_claim_key(c.resource_kind, c.resource_key) = p_resource_key
+     and c.status = 'active'
+     and c.released_at is null
+     and c.lease_expires_at <= now();
+
+  if exists (
+    select 1 from agent_board.claims
+     where claims.resource_kind = p_resource_kind
+       and agent_board._canonical_claim_key(claims.resource_kind, claims.resource_key) = p_resource_key
+       and claims.status = 'active'
+       and claims.released_at is null
+       and claims.lease_expires_at > now()
+  ) then
+    raise exception 'conflicting active claim' using errcode = '23505';
+  end if;
+
+  insert into agent_board.claims(task_id, thread_id, agent_id, resource_kind, resource_key, lease_expires_at, metadata)
+  values (
+    p_task_id, v_thread_id, v_actor_agent_id, p_resource_kind, p_resource_key, p_lease_expires_at,
+    -- SHADOW stamp: record the authority verdict alongside any caller metadata. Merged last so it
+    -- is authoritative over a caller-supplied claimgate_shadow key.
+    coalesce(p_metadata, '{}'::jsonb)
+      || jsonb_build_object(
+           'claimgate_shadow',
+           jsonb_build_object('kind', p_resource_kind, 'authorized', v_shadow_authorized)
+         )
+  )
+  returning id into v_claim_id;
+
+  if p_task_id is not null then
+    perform agent_board.append_task_event(p_task_id, v_actor_agent_id, 'claimed', jsonb_build_object('claim_id', v_claim_id, 'resource_kind', p_resource_kind, 'resource_key', p_resource_key));
+  end if;
+
+  return query
+  select c.id, c.task_id, c.thread_id, c.agent_id, c.resource_kind, c.resource_key, c.status, c.lease_token, c.lease_expires_at, c.released_at, c.created_at, c.updated_at
+    from agent_board.claims c
+   where c.id = v_claim_id;
+end;
+$function$;
+revoke all on function agent_board.acquire_claim(uuid, text, text, timestamp with time zone, uuid, uuid, jsonb) from public, anon;
+grant execute on function agent_board.acquire_claim(uuid, text, text, timestamp with time zone, uuid, uuid, jsonb) to authenticated, service_role;