@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/migrations/20260828000100_agent_board_delegation_cap_ceiling.sql

@@ -0,0 +1,474 @@
+-- =============================================================================
+-- DELEGCAPCEILING (#142) — operator delegation caps are a DURABLE ceiling that a
+-- self-service (authenticated) root cannot loosen.
+-- =============================================================================
+-- DEFECT (#142, surfaced by the #138 panel): upsert_delegation_policy
+-- (20260820000100) UPDATES the root's latest-unrevoked policy row IN PLACE on the
+-- authenticated self-service path, flipping scope_attestation -> 'self_declared' and
+-- rewriting max_active_children/child_ttl_ceiling anywhere in the self-service clamp
+-- range (up to 25 children / 24h). An operator_vetted row set to a DELIBERATELY tighter
+-- cap (e.g. max_active_children=1) is therefore overwritten by a self-service widen to
+-- 25 — the operator's intent is NOT durable. #138's mint re-clamp only honors the GLOBAL
+-- self-service ceiling (25/24h), so an operator cap of 1 is lost the moment mint opens to
+-- the authenticated (EF-forwarded) path.
+--
+-- MAINTAINER DECISION (locked): the operator's cap is a HARD CEILING. A root may still
+-- self-service its own delegation policy, but the EFFECTIVE cap the mint enforces on the
+-- self-service path is always the TIGHTER of (operator-set cap, root's self-set cap, the
+-- global self-service ceiling 25/24h). A self-service write can never end up looser than
+-- what an operator set. The operator (p_self_service=false) path keeps its full latitude.
+--
+-- MECHANISM (option 2(b): explicit operator-ceiling columns the mint clamps to). Chosen
+-- over the two-row model (2(a)) because it preserves the existing single-"latest-unrevoked
+-- -row" selection that BOTH upsert_delegation_policy and mint_delegated_child already use —
+-- no reader has to learn to join a second row, and no ambiguity about which row is effective.
+--   * Two NULLABLE columns hold the operator ceiling: operator_max_active_children,
+--     operator_child_ttl_ceiling. NULL = "no operator ceiling" (the pre-#142 behavior).
+--   * They are written ONLY on the operator (service_role) branch of upsert_delegation_policy
+--     (= the operator's own caps). The self-service branch PRESERVES them (carries the
+--     existing values forward on UPDATE; NULL on a first INSERT), so a self-service overwrite
+--     can no longer destroy the operator ceiling. authenticated has NO direct table UPDATE
+--     grant (20260717000400: only SELECT), so the definer function is the sole writer path and
+--     the operator branch is the sole ceiling writer — "service_role-write-only" by construction.
+--   * mint_delegated_child's self-service branch clamps to the TIGHTEST of the three. The mint
+--     stays the LOAD-BEARING durable guard (#138 doctrine: treat the stored policy row as
+--     advisory, re-clamp at mint); the ceiling columns make the operator's cap survive the
+--     self-overwrite so the mint has something tighter than the global 25/24h to clamp to.
+--
+-- CATALOG ENUMERATION OF CAP CONSUMERS (CLAUDE.md rule #1) — "the mint clamp closes #142"
+-- rests on the mint being the ONLY authenticated cap consumer. Every reader of
+-- delegation_policies.max_active_children / .child_ttl_ceiling was enumerated:
+--   * mint_delegated_child   — has the p_self_service (EF-forwarded authenticated) path. CLAMPED here.
+--   * renew_delegated_grant  — reads child_ttl_ceiling but is service_role-only with NO
+--                              self-service parameter and NO EF caller (only mint-child EF exists).
+--                              Operator-only => operator latitude (invariant 5); no clamp needed.
+--   * upsert_delegation_policy — the writer; already clamps its OWN self-service writes.
+-- No authenticated-reachable path sets delegation_policies.revoked_at (only service_role holds
+-- UPDATE), so a root cannot revoke its operator policy to escape into the ceiling-less INSERT
+-- branch — the operator row stays the latest-unrevoked and the self-service path UPDATEs it.
+--
+-- require_child_signing_key (invariant 4) and max_depth are NOT modeled as ceiling columns:
+-- the self-service branch already PINS require=true and max_depth=1 unconditionally (#59), so an
+-- operator's require=true can never be relaxed by self-service — an operator-require column would
+-- be unreachable dead surface (CLAUDE.md rule #2). The self-pin IS the durability mechanism, and
+-- the suite pins it by mutating the pin.
+--
+-- Both functions recreated with CREATE OR REPLACE (signatures UNCHANGED, so the ACL + COMMENT
+-- are preserved — no DROP, which would re-open EXECUTE-to-PUBLIC on a SECURITY DEFINER function).
+-- Grants/revokes/comments restated anyway (#118 discipline). The mint's OPERATOR branch is left
+-- byte-for-byte unchanged (invariant 5). Additive, forward-only; schema_version stays 8.
+-- =============================================================================
+
+-- ---------------------------------------------------------------------------
+-- 1. Operator-ceiling columns. Nullable; NULL = no operator ceiling (pre-#142).
+-- ---------------------------------------------------------------------------
+alter table agent_board.delegation_policies
+  add column if not exists operator_max_active_children int,
+  add column if not exists operator_child_ttl_ceiling interval;
+
+comment on column agent_board.delegation_policies.operator_max_active_children is
+  'Operator (service_role) hard CEILING on max_active_children for the self-service mint path '
+  '(#142). Written ONLY by the operator branch of upsert_delegation_policy (= the operator''s own '
+  'cap); the self-service branch PRESERVES it. NULL = no operator ceiling (bounded only by the '
+  'global 25 self-service ceiling). mint_delegated_child clamps the self-service effective cap to '
+  'least(self, this, 25). The operator (p_self_service=false) path ignores it (operator latitude).';
+
+comment on column agent_board.delegation_policies.operator_child_ttl_ceiling is
+  'Operator (service_role) hard CEILING on child_ttl_ceiling for the self-service mint path (#142). '
+  'Written ONLY by the operator branch of upsert_delegation_policy; the self-service branch '
+  'PRESERVES it. NULL = no operator ceiling (bounded only by the global 24h self-service ceiling). '
+  'mint_delegated_child clamps the self-service TTL to least(self, this, 24h). Operator path ignores it.';
+
+-- ---------------------------------------------------------------------------
+-- 2. Backfill: every existing operator_vetted row was service_role-written, so its
+--    current caps ARE the operator ceiling. self_declared rows carry no operator intent
+--    (leave their ceiling NULL). Guarded on the NOT-NULL child_ttl_ceiling target so a
+--    re-run is a no-op.
+-- ---------------------------------------------------------------------------
+update agent_board.delegation_policies
+   set operator_max_active_children = max_active_children,
+       operator_child_ttl_ceiling  = child_ttl_ceiling
+ where scope_attestation = 'operator_vetted'
+   and operator_child_ttl_ceiling is null;
+
+-- ---------------------------------------------------------------------------
+-- 3. upsert_delegation_policy — recreated VERBATIM from 20260820000100 except: the
+--    operator branch now ESTABLISHES the operator ceiling (= its own caps) and the
+--    self-service branch PRESERVES the existing ceiling (never overwrites it). Signature
+--    unchanged, so CREATE OR REPLACE keeps the ACL + comment (both restated below, #118).
+-- ---------------------------------------------------------------------------
+create or replace function agent_board.upsert_delegation_policy(
+  p_root_agent_id uuid,
+  p_mode text default 'root_minted',
+  p_allowed_scopes jsonb default null,
+  p_max_active_children int default null,
+  p_child_ttl_ceiling interval default null,
+  p_require_child_signing_key boolean default null
+)
+returns agent_board.delegation_policies
+language plpgsql
+security definer
+set search_path to 'agent_board', 'public'
+as $$
+declare
+  v_actor uuid;
+  v_is_service boolean := agent_board._is_service_role();
+  v_attestation text;
+  v_mode text;
+  v_max_children int;
+  v_ttl interval;
+  v_require_key boolean;
+  -- #142: the operator ceiling to WRITE (operator path establishes it; self-service
+  -- preserves the existing values so a self-overwrite cannot destroy the operator's cap).
+  v_operator_max int;
+  v_operator_ttl interval;
+  v_existing agent_board.delegation_policies%rowtype;
+  v_policy agent_board.delegation_policies%rowtype;
+begin
+  -- Actor bound to the SESSION: authenticated -> current_agent_id() and p_root must
+  -- match it; service_role -> the supplied p_root (create-on-behalf-of). The binding is
+  -- derived from the session, never trusted from the parameter (Lane A's coalesce lesson).
+  v_actor := agent_board._resolved_actor_agent_id(p_root_agent_id, 'p_root_agent_id');
+
+  if not exists (select 1 from agent_board.agents where id = v_actor) then
+    raise exception 'root agent not found' using errcode = 'P0002';
+  end if;
+
+  -- Serialize concurrent self-service writes for the SAME root. The find-then-branch
+  -- below takes `for update`, but a `for update` over ZERO rows locks nothing, so two
+  -- concurrent FIRST upserts could each insert an active policy row (same-actor, not a
+  -- cross-root escalation, but it makes latest-policy selection ambiguous). A per-root
+  -- transaction advisory lock is the mutex — dedicated namespace, no coupling to the
+  -- agents row other flows may lock.
+  perform pg_advisory_xact_lock(hashtext('agent_board.delegation_policy:' || v_actor::text));
+
+  if p_mode is not null and p_mode not in ('independent_auth', 'root_minted') then
+    raise exception 'invalid delegation policy mode' using errcode = '22023';
+  end if;
+  v_mode := coalesce(p_mode, 'root_minted');
+
+  if v_is_service then
+    -- OPERATOR path: trusted. Scopes are operator-vetted; caps as supplied (table
+    -- defaults apply for nulls).
+    v_attestation := 'operator_vetted';
+    v_max_children := p_max_active_children;
+    v_ttl := coalesce(p_child_ttl_ceiling, interval '8 hours');
+    v_require_key := coalesce(p_require_child_signing_key, true);
+  else
+    -- SELF-SERVICE path: dangerous fields are CLAMPED, not trusted, and the scopes are
+    -- accepted but STAMPED self_declared.
+    v_attestation := 'self_declared';
+    -- require_child_signing_key: PINNED true regardless of input.
+    v_require_key := true;
+    -- max_active_children: NON-NULL, bounded 1..25.
+    v_max_children := coalesce(p_max_active_children, 5);
+    if v_max_children < 1 or v_max_children > 25 then
+      raise exception 'max_active_children must be between 1 and 25 for self-service delegation policies' using errcode = '22023';
+    end if;
+    -- child_ttl_ceiling: positive, capped at 24h (default 8h).
+    v_ttl := coalesce(p_child_ttl_ceiling, interval '8 hours');
+    if v_ttl <= interval '0' then
+      raise exception 'child_ttl_ceiling must be positive' using errcode = '22023';
+    end if;
+    if v_ttl > interval '24 hours' then
+      raise exception 'child_ttl_ceiling may not exceed 24 hours for self-service delegation policies' using errcode = '22023';
+    end if;
+  end if;
+
+  -- Upsert the root's CURRENT active policy. There is no unique on root_agent_id and the
+  -- mint reads the latest unrevoked row, so find-then-branch under a row lock rather than
+  -- ON CONFLICT: a concurrent self-service write serializes here. max_depth is PINNED 1 on
+  -- both branches — the mint enforces it structurally, but pinning the stored field stops a
+  -- future depth-aware mint inheriting an inflated value.
+  select * into v_existing
+    from agent_board.delegation_policies dp
+   where dp.root_agent_id = v_actor
+     and dp.revoked_at is null
+   order by dp.created_at desc
+   limit 1
+   for update;
+
+  -- #142: resolve the operator ceiling to WRITE. Operator establishes it as its own caps;
+  -- self-service PRESERVES whatever the operator set (v_existing carries it; when `not found`
+  -- the rowtype fields are NULL => no operator ceiling on a first self-service INSERT).
+  if v_is_service then
+    v_operator_max := v_max_children;
+    v_operator_ttl := v_ttl;
+  else
+    v_operator_max := v_existing.operator_max_active_children;
+    v_operator_ttl := v_existing.operator_child_ttl_ceiling;
+  end if;
+
+  if found then
+    update agent_board.delegation_policies dp
+       set mode = v_mode,
+           max_depth = 1,
+           max_active_children = v_max_children,
+           allowed_scopes = coalesce(p_allowed_scopes, '[]'::jsonb),
+           child_ttl_ceiling = v_ttl,
+           require_child_signing_key = v_require_key,
+           scope_attestation = v_attestation,
+           operator_max_active_children = v_operator_max,
+           operator_child_ttl_ceiling = v_operator_ttl
+     where dp.id = v_existing.id
+    returning * into v_policy;
+  else
+    insert into agent_board.delegation_policies(
+      root_agent_id, mode, max_depth, max_active_children, allowed_scopes,
+      child_ttl_ceiling, require_child_signing_key, scope_attestation,
+      operator_max_active_children, operator_child_ttl_ceiling
+    )
+    values (
+      v_actor, v_mode, 1, v_max_children, coalesce(p_allowed_scopes, '[]'::jsonb),
+      v_ttl, v_require_key, v_attestation,
+      v_operator_max, v_operator_ttl
+    )
+    returning * into v_policy;
+  end if;
+
+  return v_policy;
+end;
+$$;
+
+comment on function agent_board.upsert_delegation_policy(uuid, text, jsonb, int, interval, boolean) is
+  'Self-service writer for a root''s delegation policy (ROOMDELEG-2 / #59; #142 durable operator '
+  'ceiling). authenticated: actor bound root == current_agent_id(); scopes accepted but stamped '
+  'scope_attestation=''self_declared'' (ADVISORY); require_child_signing_key pinned true, '
+  'max_active_children clamped 1..25, child_ttl_ceiling clamped <=24h, max_depth pinned 1, and the '
+  'operator_* ceiling columns are PRESERVED (never overwritten). service_role: create-on-behalf-of, '
+  'operator_vetted, caps as supplied, and ESTABLISHES operator_max_active_children/'
+  'operator_child_ttl_ceiling as the durable hard ceiling the self-service mint clamps to (#142). '
+  'Upserts the root''s latest unrevoked policy row.';
+
+revoke all on function agent_board.upsert_delegation_policy(uuid, text, jsonb, int, interval, boolean) from public, anon, authenticated;
+grant execute on function agent_board.upsert_delegation_policy(uuid, text, jsonb, int, interval, boolean) to authenticated, service_role;
+
+-- ---------------------------------------------------------------------------
+-- 4. mint_delegated_child — recreated VERBATIM from 20260822000100 except the
+--    SELF-SERVICE branch now also honors the operator ceiling (#142): the effective
+--    max_active_children and TTL ceiling are the TIGHTEST of (self, operator ceiling,
+--    global 25/24h). The OPERATOR branch is byte-for-byte unchanged (invariant 5).
+--    Signature unchanged => CREATE OR REPLACE preserves ACL + comment (restated, #118).
+-- ---------------------------------------------------------------------------
+create or replace function agent_board.mint_delegated_child(
+  p_root_agent_id uuid,
+  p_child_slug text,
+  p_requested_scopes jsonb,
+  p_child_public_key text default null,
+  p_ttl interval default null,
+  p_self_service boolean default false
+)
+returns table(
+  child_agent_id uuid,
+  grant_expires_at timestamptz,
+  signing_key_id uuid
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_policy agent_board.delegation_policies%rowtype;
+  v_root agent_board.agents%rowtype;
+  v_slug text;
+  v_requested jsonb := coalesce(p_requested_scopes, '[]'::jsonb);
+  v_allowed jsonb;
+  v_active_children int;
+  v_child_auth_user_id uuid;
+  v_child_id uuid;
+  v_key_id uuid := null;
+  v_grant_expires_at timestamptz;
+  v_effective_max int;
+  v_ceiling interval;
+  -- Per-root provisioning rate cap for the authenticated (self-service) path.
+  v_rate_limit constant int := 25;
+  v_rate_window constant interval := interval '1 hour';
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'mint_delegated_child is service_role-only' using errcode = '42501';
+  end if;
+
+  -- Non-positive TTL floor: an immediately-expired grant escapes the
+  -- max_active_children count while still provisioning an auth user/agent/key.
+  if p_ttl is not null and p_ttl <= interval '0' then
+    raise exception 'non_positive_ttl: requested grant TTL must be positive' using errcode = '22023';
+  end if;
+
+  v_slug := agent_board._normalize_provision_slug(p_child_slug);
+
+  -- Root must exist.
+  select * into v_root from agent_board.agents where id = p_root_agent_id;
+  if not found then
+    raise exception 'root agent not found' using errcode = 'P0002';
+  end if;
+
+  -- Root policy must exist, be unrevoked, and be root_minted. #11: take a row lock
+  -- on the policy up front so a concurrent mint against the same root serializes
+  -- here — the max_active_children count->insert below cannot then be raced past
+  -- the ceiling (TOCTOU close).
+  select * into v_policy
+    from agent_board.delegation_policies dp
+   where dp.root_agent_id = p_root_agent_id
+     and dp.revoked_at is null
+   order by dp.created_at desc
+   limit 1
+   for update;
+  if not found then
+    raise exception 'no active delegation policy for root agent' using errcode = '42501';
+  end if;
+  if v_policy.mode <> 'root_minted' then
+    raise exception 'delegation policy mode is not root_minted (independent_auth children self-provision)' using errcode = '42501';
+  end if;
+
+  -- Root principal must be active (self + lineage).
+  if not agent_board._agent_principal_active(p_root_agent_id) then
+    raise exception 'principal_inactive: root agent principal is not fully active' using errcode = '42501';
+  end if;
+
+  -- max_depth = 1 / no transitive minting: p_root_agent_id must be a TRUE lineage
+  -- root (unparented) and must not itself be a delegated child.
+  if v_root.parent_agent_id is not null then
+    raise exception 'max_depth: only a true lineage root may mint (no transitive delegation)' using errcode = '42501';
+  end if;
+  if exists (select 1 from agent_board.delegation_grants g where g.child_agent_id = p_root_agent_id) then
+    raise exception 'max_depth: a delegated child may not mint further children' using errcode = '42501';
+  end if;
+
+  -- Scope subset: requested ⊆ allowed (JSON array containment). A NULL allowed_scopes
+  -- means the root carries no delegable scope, so only an empty request is a subset.
+  v_allowed := coalesce(v_policy.allowed_scopes, '[]'::jsonb);
+  if not (v_allowed @> v_requested) then
+    raise exception 'scope_exceeded: requested scopes are not a subset of the root allowed_scopes' using errcode = '42501';
+  end if;
+
+  -- max_active_children: the root's live (non-revoked, unexpired) grant count must
+  -- remain within the ceiling after this mint.
+  if p_self_service then
+    -- F1 (#138) + #142: never trust the stored caps on the authenticated (EF-forwarded)
+    -- path. A root can self-widen its own policy row, and its operator_vetted ceiling must
+    -- survive that overwrite, so the effective cap is the TIGHTEST of the root's self cap,
+    -- the operator ceiling (operator_max_active_children; NULL => no operator ceiling), and
+    -- the GLOBAL 25-child self-service ceiling. NULLs coalesce to 25 so they add no slack.
+    v_effective_max := least(
+      coalesce(v_policy.max_active_children, 25),
+      coalesce(v_policy.operator_max_active_children, 25),
+      25);
+    select count(*) into v_active_children
+      from agent_board.delegation_grants g
+     where g.root_agent_id = p_root_agent_id
+       and g.revoked_at is null
+       and g.grant_expires_at > now();
+    if v_active_children >= v_effective_max then
+      raise exception 'max_active_children: root has reached its active delegated-child ceiling' using errcode = '42501';
+    end if;
+  elsif v_policy.max_active_children is not null then
+    -- Operator path: trusted caps as supplied (NULL = unbounded, operator's choice).
+    select count(*) into v_active_children
+      from agent_board.delegation_grants g
+     where g.root_agent_id = p_root_agent_id
+       and g.revoked_at is null
+       and g.grant_expires_at > now();
+    if v_active_children >= v_policy.max_active_children then
+      raise exception 'max_active_children: root has reached its active delegated-child ceiling' using errcode = '42501';
+    end if;
+  end if;
+
+  -- Per-root provisioning RATE cap (authenticated path only): bounds cumulative
+  -- mint->expire->mint fan-out. Enforced after the gates so only would-be-successful
+  -- mints consume budget, before any provisioning.
+  if p_self_service then
+    if not agent_board._check_and_bump_child_mint_rate(p_root_agent_id, v_rate_limit, v_rate_window) then
+      raise exception 'mint_rate_exceeded: root has reached its provisioning rate cap for the current window' using errcode = '42501';
+    end if;
+  end if;
+
+  -- Provision the child: parent = root = p_root_agent_id, same owner_user_id, own
+  -- auth binding (distinct auth_user_id for the active-unique index).
+  v_child_auth_user_id := agent_board._ensure_agent_auth_user(v_slug);
+
+  insert into agent_board.agents(
+    agent_type, kind, handle, display_name, status,
+    auth_user_id, owner_user_id, parent_agent_id, root_agent_id, metadata
+  )
+  values (
+    'agent', 'agent'::agent_board.agent_kind, v_slug,
+    agent_board._default_provision_display_name(v_slug), 'active',
+    v_child_auth_user_id, v_root.owner_user_id, p_root_agent_id, p_root_agent_id,
+    jsonb_build_object('delegatedByRootAgentId', p_root_agent_id, 'grantedScopes', v_requested)
+  )
+  returning id into v_child_id;
+
+  -- Scoped REVOCABLE signing key when the policy requires it. #5: the child's
+  -- public key MUST be supplied by the caller (generated client-side; the private
+  -- key never touches the DB). We NEVER seed a placeholder/zero key and NEVER
+  -- generate a key in-DB. status='active' + proof_state='proven' so the child can
+  -- immediately re-sign with the private key it already holds. The fingerprint is
+  -- derived over the RAW 32 bytes via _raw_key_fingerprint (single-sourced with enroll;
+  -- rejects a non-canonical alias) so the same key hashes identically across writers.
+  if v_policy.require_child_signing_key then
+    if p_child_public_key is null then
+      raise exception 'a child public key is required when the delegation policy requires a signing key' using errcode = '22023';
+    end if;
+    -- Raw Ed25519 public keys are 32 bytes => 43 base64url chars (no padding).
+    if p_child_public_key !~ '^[A-Za-z0-9_-]{43}$' then
+      raise exception 'malformed child public key: expected a 43-char base64url raw Ed25519 key' using errcode = '22023';
+    end if;
+    -- Reject the all-''A'' key: 43 base64url ''A''s decode to 32 zero bytes (a
+    -- small-order point), which is exactly the retired placeholder.
+    if p_child_public_key = repeat('A', 43) then
+      raise exception 'child public key is the all-zero small-order placeholder and is rejected' using errcode = '22023';
+    end if;
+
+    insert into agent_board.agent_signing_keys(
+      id, agent_id, key_id, key_version, public_key, public_key_format, fingerprint,
+      status, proof_state, metadata
+    )
+    values (
+      gen_random_uuid(), v_child_id, 'delegated-ephemeral', 1, p_child_public_key,
+      'raw_ed25519_base64url',
+      agent_board._raw_key_fingerprint(p_child_public_key),
+      'active', 'proven',
+      jsonb_build_object('ephemeral', true, 'scopes', v_requested)
+    )
+    returning id into v_key_id;
+  end if;
+
+  -- Grant row: ceiling-bounded hours-scale working clock. On the authenticated path the
+  -- TTL ceiling is re-clamped to the TIGHTEST of the stored self ceiling, the operator
+  -- ceiling (operator_child_ttl_ceiling; NULL => none), and the global 24h (#138 F1 + #142) —
+  -- the stored ceiling is not trusted. The operator path honors the stored ceiling verbatim.
+  if p_self_service then
+    v_ceiling := least(
+      coalesce(v_policy.child_ttl_ceiling, interval '24 hours'),
+      coalesce(v_policy.operator_child_ttl_ceiling, interval '24 hours'),
+      interval '24 hours');
+  else
+    v_ceiling := v_policy.child_ttl_ceiling;
+  end if;
+  v_grant_expires_at := now() + least(coalesce(p_ttl, v_ceiling), v_ceiling);
+
+  insert into agent_board.delegation_grants(
+    child_agent_id, root_agent_id, parent_agent_id, delegation_policy_id,
+    granted_scopes, grant_expires_at
+  )
+  values (
+    v_child_id, p_root_agent_id, p_root_agent_id, v_policy.id,
+    v_requested, v_grant_expires_at
+  );
+
+  return query select v_child_id, v_grant_expires_at, v_key_id;
+end;
+$$;
+
+comment on function agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean) is
+  'Mints a bounded root_minted delegated child (scope ⊆ root allowed_scopes, max_depth=1, '
+  'policy-row-locked max_active_children, positive ceiling-bounded grant TTL) enrolling the '
+  'CALLER-SUPPLIED Ed25519 public key with a RAW-byte fingerprint (_raw_key_fingerprint; '
+  'private key stays client-side). service_role-only. p_self_service marks the EF-forwarded '
+  'authenticated path: it re-clamps max_active_children and the TTL ceiling to the TIGHTEST of '
+  '(root self cap, operator ceiling operator_*/#142, global 25/24h) — stored caps are NOT trusted '
+  'and an operator ceiling survives a self-widen — and applies a per-root provisioning rate cap. '
+  'The operator (p_self_service=false) path keeps its latitude. Direct authenticated EXECUTE stays revoked.';
+
+revoke all on function agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean) from public, anon, authenticated;
+grant execute on function agent_board.mint_delegated_child(uuid, text, jsonb, text, interval, boolean) to service_role;