@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/migrations/20260810000100_agent_board_consent_locking.sql

@@ -0,0 +1,485 @@
+-- =============================================================================
+-- MBCONSENT-B(iii) — LOCKING: validate and mutate the SAME row (#109, #110, and the
+-- check-then-write race left by gating)
+-- =============================================================================
+-- Three defects, one structural change, deliberately reviewed together because they are the
+-- same shared-function contract:
+--
+--   #109  resolve_board_request validated one row while the sink reselected with active-row
+--         preference and mutated another. Rejecting a pending request downgraded the subject's
+--         ACTIVE membership. Reproduced: (joined, requested) -> reject -> (left, requested).
+--   #110  a refusal recorded as `eviction`, because the sink derives the kind from
+--         (provenance, state) and cannot tell a refusal from a removal. Patching the row
+--         afterwards required writing to an append-only table through definer privilege, which
+--         is a worse trade than the wrong label -- so the kind is threaded instead.
+--   race  gating checked consent BEFORE the row was locked, so a withdrawal committed in
+--         between could still be overwritten.
+--
+-- The sink gains two OPTIONAL parameters. Both are defaulted, so every existing 3..5-argument
+-- caller is unaffected. It is DROPPED and recreated rather than replaced: adding parameters
+-- creates a second overload, and a 5-argument call would then be ambiguous between them.
+--
+--   p_membership_id  act on the row the caller validated and locked, instead of reselecting
+--   p_event_kind     name the descriptive kind. PROVENANCE IS NEVER DELEGATED -- a wrong kind
+--                    mislabels an event, a wrong provenance would fabricate consent.
+--
+-- schema_version stays 8: additive.
+-- =============================================================================
+
+drop function if exists agent_board._upsert_board_membership_state(uuid, uuid, text, uuid, jsonb);
+
+create or replace function agent_board._upsert_board_membership_state(
+  p_board_id uuid,
+  p_agent_id uuid,
+  p_membership_state text,
+  p_created_by_agent_id uuid default null,
+  p_metadata jsonb default '{}'::jsonb,
+  -- The caller may name the EXACT row it validated and locked. Without this the sink reselects
+  -- with active-row preference and can mutate a DIFFERENT row than the caller checked -- #109.
+  p_membership_id uuid default null,
+  -- The caller may name the event kind. The sink derives one from (provenance, state), which
+  -- cannot distinguish a refusal from an eviction -- #110. Provenance is NEVER delegated.
+  p_event_kind text default null
+)
+ RETURNS agent_board.board_memberships
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+as $$
+declare
+  v_membership agent_board.board_memberships%rowtype;
+  v_metadata jsonb;
+  -- EC-MBROWID-3: currently-removed standing (R-LINK-7 set form), not a single row.
+  v_currently_removed boolean;
+  v_prior_state text;
+begin
+  if p_membership_state not in ('requested', 'invited', 'joined', 'subscribed', 'left', 'removed') then
+    raise exception 'invalid board membership state' using errcode = '22023';
+  end if;
+
+  -- Metadata must be a JSON OBJECT. Previously a scalar/array was stored verbatim on insert and
+  -- concatenated on update; the reserved-key strip below iterates keys, so a non-object would raise
+  -- an opaque internal error. Fail explicitly instead. Reachable from the CLI `--metadata`, which
+  -- parses arbitrary JSON — this is a deliberate, declared behavior change for ALL mutator callers.
+  if jsonb_typeof(coalesce(p_metadata, '{}'::jsonb)) <> 'object' then
+    raise exception 'board membership metadata must be a JSON object' using errcode = '22023';
+  end if;
+
+  -- Reserved namespace: `ops_*` keys are operational state (the retention sweep's skip marker
+  -- `ops_retained_at`, read for board_memberships at 20260513000001:122) and must never be writable
+  -- by a caller whose own row they govern. Strip them from caller input; operational writers set
+  -- the column directly.
+  select coalesce(jsonb_object_agg(e.key, e.value), '{}'::jsonb)
+    into v_metadata
+    from jsonb_each(coalesce(p_metadata, '{}'::jsonb)) as e(key, value)
+   where e.key not like 'ops\_%';
+
+  -- EC-MBROWID-3 / R-LINK-7: currently-removed standing is the SET predicate
+  -- (exists removed AND no active), not a single total-ordered row. A higher-id
+  -- removed row can coexist with an active row; inferring "removed" from the
+  -- total-order winner alone would then try to activate the removed row and
+  -- collide with idx_agent_board_board_memberships_active_unique (23505).
+  -- Capture standing before the row lock so the predicate is independent of
+  -- which physical row the active-preferring SELECT below returns.
+  v_currently_removed :=
+    exists (
+      select 1 from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.agent_id = p_agent_id
+         and bm.membership_state = 'removed'
+    ) and not exists (
+      select 1 from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.agent_id = p_agent_id
+         and bm.membership_state in ('joined', 'subscribed')
+    );
+
+  -- Duplicate-aware ACTIVE-row selection (3a): prefer an active row when one
+  -- exists, then total-order by created_at desc, id desc. A pure total-order
+  -- can select a higher-id REMOVED row while an ACTIVE row still exists.
+  -- When v_currently_removed, no active row exists and the total-order pick is
+  -- non-active (re-entry clamp applies below).
+  -- When the caller names a row it has already validated AND LOCKED, act on THAT row. The
+  -- active-preferring pick below is right when the sink chooses for itself, but wrong when a
+  -- caller validated a specific one: rejecting a pending request would lock and mutate the
+  -- subject's ACTIVE membership instead, downgrading a real member (#109).
+  if p_membership_id is not null then
+    select *
+      into v_membership
+      from agent_board.board_memberships bm
+     where bm.id = p_membership_id
+       and bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+     for update;
+
+    if v_membership.id is null then
+      raise exception 'membership row % not found for this subject', p_membership_id
+        using errcode = 'P0002';
+    end if;
+  else
+    select *
+      into v_membership
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+     order by
+       case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+       bm.created_at desc,
+       bm.id desc
+     limit 1
+     for update;
+  end if;
+
+  -- The PRIOR state, captured before the update below overwrites v_membership. The emitter
+  -- cannot see it, and without it a joined<->subscribed self-toggle is indistinguishable from
+  -- a fresh join.
+  v_prior_state := v_membership.membership_state;
+
+  if v_membership.id is null then
+    -- INSERT branch intentionally omits `role` so a no-prior-row entry takes the table default
+    -- (20260717000100:13-15). Do not write role here — an explicit write is wrong.
+    insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, left_at, metadata)
+    values (
+      p_board_id,
+      p_agent_id,
+      p_membership_state,
+      p_created_by_agent_id,
+      case when p_membership_state in ('left', 'removed') then now() else null end,
+      v_metadata
+    )
+    returning * into v_membership;
+  else
+    update agent_board.board_memberships bm
+       set membership_state = p_membership_state,
+           created_by_agent_id = coalesce(p_created_by_agent_id, bm.created_by_agent_id),
+           -- PRESERVE the first departure time. Restamping it would let the departing agent (or a
+           -- re-kicking owner) push its own row past the retention cutoff (20260513000001:121).
+           left_at = case
+                       when p_membership_state in ('left', 'removed') then
+                         case
+                           -- SAME terminal state re-asserted: preserve the FIRST departure time so a
+                           -- repeat call cannot push the retention cutoff forward.
+                           when v_membership.membership_state = p_membership_state
+                             then coalesce(v_membership.left_at, now())
+                           -- GENUINE transition (notably left -> removed, an owner barring
+                           -- invite-link re-entry for an already-departed agent) stamps NOW. R-LINK-7
+                           -- deliberately does not block voluntary 'left' (20260724000100:321-322),
+                           -- so this is the real kick moment; inheriting the earlier departure would
+                           -- both lose the audit answer and make the marker row retention-eligible
+                           -- prematurely.
+                           else now()
+                         end
+                       else null
+                     end,
+           -- ROLERESET (#79): clamp role to the table default on non-active -> active re-entry.
+           -- Hardcoded 'member' (column default at 20260717000100:13-15); do not read
+           -- information_schema at runtime. Active -> active preserves bm.role (including owner).
+           -- Unconditional — no service_role exemption.
+           -- MBROWID: origin is non-active when the selected row is non-active OR when
+           -- currently-removed standing holds (R-LINK-7 set form). With active-preferring
+           -- selection those agree; the set form is load-bearing against equal-created_at
+           -- removed+left duplicates where a single-row read would flip with id order.
+           role = case
+                    when p_membership_state in ('joined', 'subscribed')
+                     and (
+                       v_membership.membership_state not in ('joined', 'subscribed')
+                       or v_currently_removed
+                     )
+                    then 'member'
+                    else bm.role
+                  end,
+           metadata = coalesce(bm.metadata, '{}'::jsonb) || v_metadata,
+           updated_at = now()
+     where bm.id = v_membership.id
+     returning * into v_membership;
+  end if;
+
+  -- Emission is delegated so the sink and the four raw writers cannot drift apart.
+  -- The frozen mapping distinguishes a self-TOGGLE between two active states from a fresh
+  -- self-JOIN. Only the sink knows the prior state, so it names the kind; the emitter derives
+  -- everything security-critical regardless.
+  -- A caller-supplied kind wins; otherwise the sink's own derivation stands. Only the
+  -- DESCRIPTIVE field is delegated -- provenance is always derived from the session.
+  perform agent_board._emit_membership_event(
+    p_board_id, p_agent_id, p_membership_state,
+    coalesce(p_event_kind, case
+      when v_prior_state in ('joined', 'subscribed')
+       and p_membership_state in ('joined', 'subscribed')
+       -- The states must actually DIFFER. join_board and update_board_membership both permit
+       -- joined->joined and subscribed->subscribed, and a write that changes nothing is not a
+       -- toggle of anything -- recording it as one permanently mislabels an append-only event.
+       and v_prior_state <> p_membership_state
+       and not agent_board._is_service_role()
+       and agent_board.current_agent_id() = p_agent_id
+      then 'consent_self_toggle'
+      else null
+    end));
+
+  return v_membership;
+end;
+$$;
+
+-- RESTORE THE PRIVILEGE POSTURE. DROP FUNCTION discards the function's ACL, and CREATE grants
+-- EXECUTE to PUBLIC by default -- so recreating the sink silently handed every authenticated
+-- caller a direct line to it, bypassing every gate in the phase before this one. The gating
+-- suite's catalog-derived class assertion caught it by NAME, which is precisely why that
+-- assertion is derived from the catalog rather than from a list of routes.
+--
+-- Any future drop-and-recreate of a SECURITY DEFINER function must restate its grants in the
+-- same migration. There is no inheritance.
+-- The COMMENT is discarded by DROP as well, and a suite asserts on it. Restated with the two
+-- new parameters described. Grants, comments, and any other object-level attribute must ALL be
+-- restated after a drop-and-recreate -- nothing survives it.
+comment on function agent_board._upsert_board_membership_state(uuid, uuid, text, uuid, jsonb, uuid, text) is
+  'UNAUTHORIZED PRIMITIVE — accepts any membership state; every caller MUST gate. ROLERESET '
+  '(#79): on the UPDATE path only, clamps role to the table default (''member'', '
+  '20260717000100:13-15) when transitioning from a non-active origin into joined|subscribed; '
+  'INSERT omits role and takes the table default. Active->active preserves role. LEAVEIDEM '
+  '(#81): preserves the FIRST left_at across repeated terminal transitions (the retention sweep '
+  'keys on left_at, 20260513000001:121) and strips the reserved `ops_*` metadata namespace from '
+  'caller input (the sweep skips rows carrying ops_retained_at). MBCONSENT-B(iii): p_membership_id '
+  'acts on the row the CALLER validated and locked instead of reselecting with active-row '
+  'preference (#109); p_event_kind names the descriptive kind only (#110) — provenance is always '
+  'derived from the session and is never delegated. Not a chokepoint — raw-INSERT seeders '
+  '(create_board owner, bootstrap, invite redeem, fedsession autojoin) bypass this function.';
+
+revoke all on function agent_board._upsert_board_membership_state(uuid, uuid, text, uuid, jsonb, uuid, text) from public;
+grant execute on function agent_board._upsert_board_membership_state(uuid, uuid, text, uuid, jsonb, uuid, text) to service_role;
+
+create or replace function agent_board.resolve_board_request(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_created_by_agent_id uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, left_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+as $$
+declare
+  v_effective_state text;
+  v_board agent_board.boards%rowtype;
+  v_membership_id uuid;
+  v_active_id uuid;
+  v_membership agent_board.board_memberships%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- GATENULL (#58): only service_role may proceed with an unresolved actor.
+  if v_actor is null and not agent_board._is_service_role() then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  if p_membership_state not in ('joined', 'subscribed', 'removed') then
+    raise exception 'resolve_board_request only accepts joined, subscribed, or removed' using errcode = '22023';
+  end if;
+  select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+  if v_board.id is null then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+  if v_actor is not null then
+    if v_board.role_gate_enforced then
+      -- Gate ON: NO creator exemption. Every actor (including a demoted creator)
+      -- must hold an active owner/admin membership.
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+           and bm.role in ('owner', 'admin')
+      ) then
+        raise exception 'board request resolution requires owner or admin role' using errcode = '42501';
+      end if;
+    elsif v_actor <> v_board.created_by_agent_id then
+      -- Gate OFF: creator bypasses; any other actor needs an active membership.
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+      ) then
+        raise exception 'board request resolution requires active membership' using errcode = '42501';
+      end if;
+    end if;
+  end if;
+
+  -- LOCK the row this call will act on, and capture its IDENTITY, in the same statement that
+  -- reads its state. Three defects share this line:
+  --
+  --   * the row read here was not the row the sink then mutated. The sink reselects with
+  --     ACTIVE-ROW PREFERENCE, so with a legal (joined, requested) duplicate this validated the
+  --     pending row and the sink downgraded the ACTIVE one (#109).
+  --   * consent was read WITHOUT the row locked, so a withdrawal committed between the read and
+  --     the write could be overwritten -- the race gating left open.
+  --
+  -- `for update` here makes both impossible: a concurrent withdrawal serialises behind this
+  -- lock, and passing v_membership_id to the sink stops it choosing a different row.
+  -- LOCK THE WHOLE (board, agent) SET FIRST, so a concurrent self-withdrawal on ANY physical
+  -- row of this subject serialises behind this resolution -- #109's race is per-(board,agent),
+  -- not per-row. A prior revision locked only the total-order winner, so a withdrawal on a
+  -- DIFFERENT row (the active one, when a legal active+pending duplicate exists) never
+  -- contended, and the withdrawal was overwritten. Four-seat review + a two-session probe
+  -- (Fable) established that.
+  perform 1
+     from agent_board.board_memberships bm
+    where bm.board_id = p_board_id
+      and bm.agent_id = p_agent_id
+    order by bm.id
+      for update;
+
+  -- Select the PENDING row -- the one being resolved -- explicitly, not the total-order winner.
+  -- With a legal (active, pending) duplicate the active row can sort first, and locking THAT
+  -- made the resolver report "pending not found" (#109) and, on approve, promote the wrong row
+  -- into a unique-violation (the A3 regression).
+  select bm.id
+    into v_membership_id
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+     and bm.membership_state in ('requested', 'invited')
+   order by bm.created_at desc, bm.id desc
+   limit 1;
+
+  -- ...and separately, whether an ACTIVE row already exists for this subject.
+  select bm.id
+    into v_active_id
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+     and bm.membership_state in ('joined', 'subscribed')
+   order by bm.created_at desc, bm.id desc
+   limit 1;
+
+  if v_membership_id is null then
+    raise exception 'pending board membership not found' using errcode = 'P0002';
+  end if;
+
+  -- OPTION 1 FALLBACK (#109 A3): approving a subject who is ALREADY active is a no-op success,
+  -- not a promotion of the pending row into collision with the active one. The real fix is that
+  -- this duplicate should not arise (request_join_board no longer demotes/duplicates an active
+  -- member), but if it exists via an operator/raw path, admitting them again is meaningless --
+  -- return the active row untouched. Rejection still falls through to act on the pending row.
+  if p_membership_state in ('joined', 'subscribed') and v_active_id is not null then
+    return query
+    select bm.id, bm.board_id, bm.agent_id, bm.membership_state, bm.left_at, bm.updated_at
+      from agent_board.board_memberships bm
+     where bm.id = v_active_id;
+    return;
+  end if;
+
+  -- REJECTSEM (#89). A rejection is NOT an eviction. resolve_board_request only ever acts on a
+  -- PENDING row (requested|invited) -- update_board_membership is the schema's only eviction
+  -- path -- so writing `removed` here mislabels a refusal as a removal, and `removed` bars
+  -- self-re-entry. Reproduced before fixing: request an OPEN board, owner rejects, and the
+  -- subject can no longer join a board open to anyone ("board is not joinable by this agent").
+  -- One refusal became a permanent, self-unrecoverable bar.
+  --
+  -- Applied to BOTH pending origins, not just `requested`. Cancelling an INVITATION had the
+  -- identical trap, and fixing only the named instance is how several defects in this work
+  -- survived a round.
+  --
+  -- `left` is recoverable: the subject may act again. The refusal is still durable in the
+  -- ledger -- this changes the membership STATE, not the record that it happened.
+  v_effective_state := case when p_membership_state = 'removed' then 'left'
+                            else p_membership_state end;
+
+  -- #82: PROMOTION INTO AN ACTIVE STATE REQUIRES THE SUBJECT'S OWN ACT. This is the sole
+  -- consent-predicate read site. An owner resolving a pending row to joined|subscribed is a
+  -- BOARD act; it admits the subject only if the subject has already consented -- by requesting
+  -- (target-authored) or by an operator placement. A board-authored `invited` or a manufactured
+  -- `requested` is NEUTRAL on the ledger and does not admit anyone.
+  --
+  -- Authenticated only. service_role keeps the operator carve-out.
+  if v_actor is not null
+     and v_effective_state in ('joined', 'subscribed')
+     and not agent_board._membership_consent_present(p_board_id, p_agent_id) then
+    raise exception 'admitting % requires an act by that agent', p_agent_id
+      using errcode = '42501';
+  end if;
+
+  v_membership := agent_board._upsert_board_membership_state(
+    p_board_id,
+    p_agent_id,
+    v_effective_state,
+    p_created_by_agent_id,
+    p_metadata,
+    -- act on the row LOCKED above, not one the sink reselects with active-row preference (#109)
+    v_membership_id,
+    -- a refusal is a REFUSAL. The sink derives board-authored `left` as `eviction`, which
+    -- conflates it with a removal (#110). Only the DESCRIPTIVE kind is named -- never provenance.
+    case when p_membership_state = 'removed' then 'reject_withdrawn' else null end
+  );
+
+  -- The kind IS threaded now, through the sink's p_event_kind. An earlier revision instead
+  -- UPDATEd the freshly-emitted ledger row, which worked only by bypassing grants through
+  -- SECURITY DEFINER -- board_membership_events is append-only BY GRANT and service_role holds
+  -- no UPDATE. That was reverted; this is the shape it should always have had.
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.left_at, v_membership.updated_at;
+end;
+$$;
+
+create or replace function agent_board.request_join_board(p_board_id uuid, p_agent_id uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+as $$
+declare
+  v_board agent_board.boards%rowtype;
+  v_membership agent_board.board_memberships%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- GATENULL (#58): only service_role may proceed with an unresolved actor.
+  if v_actor is null and not agent_board._is_service_role() then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  select * into v_board
+    from agent_board.boards
+   where id = p_board_id
+     and status = 'active'
+     and visibility in ('open', 'invite_only');
+
+  if v_board.id is null then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+  if v_actor is not null and v_actor <> p_agent_id then
+    raise exception 'board request actor mismatch' using errcode = '42501';
+  end if;
+  if not exists (select 1 from agent_board.agents where id = p_agent_id) then
+    raise exception 'agent not found' using errcode = 'P0002';
+  end if;
+
+  -- OPTION 3 ROOT CAUSE (#109 / Fable B5): an already-ACTIVE member requesting is a NO-OP.
+  -- The sink's active-preference UPDATE would otherwise DEMOTE their joined row to `requested`
+  -- (B5), or -- via other paths -- leave an (active, pending) duplicate that the resolver then
+  -- has to untangle. They are already in; requesting changes nothing. This is what stops the
+  -- dangerous duplicate arising from the request path in the first place.
+  if exists (
+    select 1 from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+       and bm.membership_state in ('joined', 'subscribed')
+  ) then
+    return query
+    select bm.id, bm.board_id, bm.agent_id, bm.membership_state, bm.created_at, bm.updated_at
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+       and bm.membership_state in ('joined', 'subscribed')
+     order by bm.created_at desc, bm.id desc
+     limit 1;
+    return;
+  end if;
+
+  v_membership := agent_board._upsert_board_membership_state(
+    p_board_id,
+    p_agent_id,
+    'requested',
+    p_agent_id,
+    p_metadata
+  );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.created_at, v_membership.updated_at;
+end;
+$$;

package/migrations/20260811000100_agent_board_retention_metadata_revoke.sql

@@ -0,0 +1,23 @@
+-- MBHARDEN / #97 — revoke the stray PUBLIC EXECUTE on mark_retention_metadata.
+--
+-- agent_board.mark_retention_metadata is SECURITY DEFINER (runs as the schema owner,
+-- postgres) and performs UNSCOPED bulk writes -- it stamps ops_retention_* metadata and
+-- bumps updated_at across eight core tables (messages, task_events, presence,
+-- callback_outbox_events, callback_delivery_attempts, inbox_items, delivery_recipients,
+-- board_memberships) with no board scoping and no session-derived authorization. It is an
+-- operator/ops-only sweep, invoked by the retention runner as service_role.
+--
+-- Its defining migration (20260513000001_agent_board_retention.sql:160) granted EXECUTE to
+-- service_role but never revoked the default PUBLIC EXECUTE that CREATE FUNCTION confers.
+-- Consequently any `authenticated` agent could drive a global metadata/updated_at write
+-- across every board. No client/SDK path calls this function -- revoking PUBLIC breaks
+-- nothing live.
+--
+-- Fix: revoke from public (and name anon/authenticated explicitly per house convention,
+-- 20260801000100:309-317), re-assert the service_role grant so a fresh replay is
+-- order-independent. This is a pure privilege change; the function body is unchanged.
+
+revoke all on function agent_board.mark_retention_metadata(text, timestamptz, uuid, text)
+  from public, anon, authenticated;
+grant execute on function agent_board.mark_retention_metadata(text, timestamptz, uuid, text)
+  to service_role;

package/migrations/20260812000100_agent_board_pubexec_class_revoke.sql

@@ -0,0 +1,54 @@
+-- MBHARDEN / #118 — revoke the stray PUBLIC EXECUTE on the remaining SECURITY DEFINER
+-- functions, closing the same class as #97 (mark_retention_metadata, fixed in
+-- 20260811000100).
+--
+-- A catalog sweep found six agent_board SECURITY DEFINER functions where PUBLIC (the `=X`
+-- ACL entry that CREATE FUNCTION confers by default) still held EXECUTE. #97 fixed the
+-- clear unscoped-write hole; this migration closes the other five. Each caller is itself a
+-- SECURITY DEFINER function (verified from pg_proc bodies), so it executes as the schema
+-- owner and never re-checks PUBLIC — revoking PUBLIC breaks no internal path, and none of
+-- the five is referenced by any client/SDK.
+--
+-- Triage (discriminator: called directly by an `authenticated` session with attacker
+-- controlled args, does it mutate state or leak cross-board data WITHOUT re-deriving on the
+-- session?):
+--
+--   * _record_signed_write_evidence — LIVE HOLE. INSERTs a signature_evidence row taking
+--     the actor and verification_status (incl. 'verified') from the caller-supplied
+--     p_gateway_decision jsonb, never the session. Direct authenticated call forges
+--     attestation rows for any agent; those surface as authoritative in v_thread_feed /
+--     v_agent_dashboard / v_task_tree / v_signature_evidence_status /
+--     v_fleet_delivery_posture. Callers: the five signed_* RPCs (all SECURITY DEFINER).
+--   * _resolve_addressing_recipient_rows — LIVE LEAK. Actor-spoofable directory/handle/
+--     group resolver; takes p_actor_agent_id as a raw trusted param and does NOT rebind via
+--     _resolved_actor_agent_id (unlike resolve_recipients, which does), and ignores RLS.
+--     Caller: resolve_recipients (SECURITY DEFINER).
+--   * _addressing_agent_ids_or_raise — benign (its actor param is rebound fail-closed inside
+--     resolve_recipients); revoked for hygiene + the class invariant.
+--   * _signed_write_actor_id — benign (pure; returns only the caller's own args); revoked
+--     for hygiene + the class invariant.
+--   * _enforce_agent_lineage_owner — benign trigger fn (Postgres refuses direct
+--     invocation); revoked so the class invariant holds with no exceptions.
+--
+-- No grants are re-asserted: every caller runs as the owner, so these helpers need no
+-- grantee. The owner (postgres) retains EXECUTE through ownership.
+
+revoke all on function
+  agent_board._record_signed_write_evidence(text, uuid, text, jsonb, jsonb)
+  from public, anon, authenticated;
+
+revoke all on function
+  agent_board._resolve_addressing_recipient_rows(uuid, jsonb)
+  from public, anon, authenticated;
+
+revoke all on function
+  agent_board._addressing_agent_ids_or_raise(uuid, jsonb)
+  from public, anon, authenticated;
+
+revoke all on function
+  agent_board._signed_write_actor_id(jsonb, jsonb, text)
+  from public, anon, authenticated;
+
+revoke all on function
+  agent_board._enforce_agent_lineage_owner()
+  from public, anon, authenticated;