@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/migrations/20260813000100_agent_board_invitepolicy_block.sql

@@ -0,0 +1,420 @@
+-- INVITEPOLICY (#90) — a target can block a specific inviter on a specific board.
+--
+-- Defect: agent_board.invite_board_member has an AUTHORIZATION gate (who may invite) but no
+-- TARGET-side policy. A passing inviter can write 'invited' for the same target unboundedly,
+-- and re-invite the instant after the target sets 'left' — each 'invited' row grants the
+-- target board-row SELECT + directory presence, so it is a repeated inbound-disclosure /
+-- harassment vector. No block concept existed anywhere in the schema.
+--
+-- Fix (maintainer-approved shape):
+--   * A target-authored block table, keyed per (board_id, target_agent_id, inviter_agent_id)
+--     — the target blocks ONE specific inviter on ONE board; other inviters are unaffected.
+--   * Blocks are PERMANENT until the target unblocks (no TTL / cooldown) and there is NO
+--     invite cap (the "uncapped invites" half is out of scope; agency, not rate-limiting, is
+--     the fix).
+--   * A frozen predicate _invite_permitted(board, target, inviter) — default PERMISSIVE
+--     (true) with no block row, so fresh boards and the service_role operator carve-out are
+--     unaffected.
+--   * block_board_inviter / unblock_board_inviter — self-only (the actor is bound through
+--     _resolved_actor_agent_id, so a target may block only its OWN inviters; no third-party
+--     blocking).
+--   * ONE guard line in invite_board_member, gating on the SESSION actor (the real inviter),
+--     never the caller-supplied p_created_by_agent_id (an assertion, not evidence).
+--
+-- Deliberately does NOT refuse re-invite based on a latest 'left' state: REJECTSEM (#89) made
+-- 'left' the universal recoverable landing (voluntary leave, declined invite, rejected
+-- request all converge there), so a latest-'left' refusal would trap a voluntary leaver who
+-- wants back in. The block is a SEPARATE explicit signal.
+--
+-- Additive, forward-only. Writes no agent_board.schema_version (stays 8).
+
+-- 1. table ------------------------------------------------------------------
+create table if not exists agent_board.board_invite_blocks (
+  id uuid primary key default gen_random_uuid(),
+  board_id uuid not null references agent_board.boards(id) on delete cascade,
+  target_agent_id uuid not null references agent_board.agents(id) on delete cascade,
+  inviter_agent_id uuid not null references agent_board.agents(id) on delete cascade,
+  created_at timestamptz not null default now(),
+  metadata jsonb not null default '{}'::jsonb,
+  constraint board_invite_blocks_unique unique (board_id, target_agent_id, inviter_agent_id),
+  constraint board_invite_blocks_not_self check (target_agent_id <> inviter_agent_id)
+);
+
+comment on table agent_board.board_invite_blocks is
+  'INVITEPOLICY (#90): target-authored inbound-invite blocks. A row (board, target, inviter) means the target has refused invitations from that specific inviter on that board — permanent until unblocked. Written exclusively by the SECURITY DEFINER block/unblock RPCs; read by _invite_permitted (bypasses RLS as owner) and, RLS-scoped, by the target itself.';
+
+create index if not exists idx_agent_board_board_invite_blocks_target
+  on agent_board.board_invite_blocks(target_agent_id);
+create index if not exists idx_agent_board_board_invite_blocks_lookup
+  on agent_board.board_invite_blocks(board_id, target_agent_id, inviter_agent_id);
+
+-- 2. RLS --------------------------------------------------------------------
+alter table agent_board.board_invite_blocks enable row level security;
+
+drop policy if exists board_invite_blocks_deny_anon on agent_board.board_invite_blocks;
+create policy board_invite_blocks_deny_anon on agent_board.board_invite_blocks
+  as permissive for select to anon using (false);
+
+-- A target may read only its OWN blocks. Writes go exclusively through the RPCs.
+drop policy if exists board_invite_blocks_target_read on agent_board.board_invite_blocks;
+create policy board_invite_blocks_target_read on agent_board.board_invite_blocks
+  as permissive for select to authenticated
+  using (target_agent_id = agent_board.current_agent_id());
+
+revoke all on agent_board.board_invite_blocks from public, anon, authenticated;
+grant select on agent_board.board_invite_blocks to authenticated;
+grant select, insert, delete on agent_board.board_invite_blocks to service_role;
+
+-- 3. predicate --------------------------------------------------------------
+-- Frozen, default-permissive. True (invite permitted) unless a matching block row exists.
+-- A null inviter (the service_role operator carve-out, gated at the call site) is permitted.
+-- SECURITY DEFINER so it reads the RLS-protected table as owner; internal-only, so PUBLIC
+-- EXECUTE is revoked (keeps the MBHARDEN #118 class invariant green).
+create or replace function agent_board._invite_permitted(
+  p_board_id uuid,
+  p_target_agent_id uuid,
+  p_inviter_agent_id uuid
+)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select p_inviter_agent_id is null
+    or not exists (
+      select 1
+        from agent_board.board_invite_blocks b
+       where b.board_id = p_board_id
+         and b.target_agent_id = p_target_agent_id
+         and b.inviter_agent_id = p_inviter_agent_id
+    )
+$$;
+comment on function agent_board._invite_permitted(uuid, uuid, uuid) is
+  'INVITEPOLICY (#90) frozen predicate: true unless the target has blocked this inviter on this board. Default-permissive (no block row -> true; null inviter -> true). Internal-only helper for invite_board_member; PUBLIC EXECUTE revoked.';
+revoke all on function agent_board._invite_permitted(uuid, uuid, uuid) from public, anon, authenticated;
+
+-- 4. target-facing RPCs -----------------------------------------------------
+create or replace function agent_board.block_board_inviter(
+  p_board_id uuid,
+  p_inviter_agent_id uuid,
+  p_target_agent_id uuid default null,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(
+  id uuid,
+  board_id uuid,
+  target_agent_id uuid,
+  inviter_agent_id uuid,
+  created_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = 'agent_board', 'public'
+as $function$
+declare
+  v_target uuid := agent_board._resolved_actor_agent_id(p_target_agent_id, 'p_target_agent_id');
+  v_row agent_board.board_invite_blocks%rowtype;
+begin
+  if not exists (select 1 from agent_board.boards bd where bd.id = p_board_id and bd.status = 'active') then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+  if not exists (select 1 from agent_board.agents ag where ag.id = p_inviter_agent_id) then
+    raise exception 'inviter agent not found' using errcode = 'P0002';
+  end if;
+  if v_target = p_inviter_agent_id then
+    raise exception 'cannot block yourself' using errcode = '22023';
+  end if;
+
+  insert into agent_board.board_invite_blocks(board_id, target_agent_id, inviter_agent_id, metadata)
+  values (p_board_id, v_target, p_inviter_agent_id, coalesce(p_metadata, '{}'::jsonb))
+  on conflict on constraint board_invite_blocks_unique do nothing;
+
+  select * into v_row
+    from agent_board.board_invite_blocks b
+   where b.board_id = p_board_id
+     and b.target_agent_id = v_target
+     and b.inviter_agent_id = p_inviter_agent_id;
+
+  return query
+  select v_row.id, v_row.board_id, v_row.target_agent_id, v_row.inviter_agent_id, v_row.created_at;
+end;
+$function$;
+comment on function agent_board.block_board_inviter(uuid, uuid, uuid, jsonb) is
+  'INVITEPOLICY (#90): the target blocks inbound invitations from a specific inviter on a specific board. Self-only (actor bound via _resolved_actor_agent_id). Idempotent. Permanent until unblock_board_inviter.';
+revoke all on function agent_board.block_board_inviter(uuid, uuid, uuid, jsonb) from public, anon;
+grant execute on function agent_board.block_board_inviter(uuid, uuid, uuid, jsonb) to authenticated, service_role;
+
+create or replace function agent_board.unblock_board_inviter(
+  p_board_id uuid,
+  p_inviter_agent_id uuid,
+  p_target_agent_id uuid default null
+)
+returns boolean
+language plpgsql
+security definer
+set search_path = 'agent_board', 'public'
+as $function$
+declare
+  v_target uuid := agent_board._resolved_actor_agent_id(p_target_agent_id, 'p_target_agent_id');
+  v_deleted int;
+begin
+  delete from agent_board.board_invite_blocks b
+   where b.board_id = p_board_id
+     and b.target_agent_id = v_target
+     and b.inviter_agent_id = p_inviter_agent_id;
+  get diagnostics v_deleted = row_count;
+  return v_deleted > 0;
+end;
+$function$;
+comment on function agent_board.unblock_board_inviter(uuid, uuid, uuid) is
+  'INVITEPOLICY (#90): the target lifts a previously set inbound-invite block. Self-only (actor bound via _resolved_actor_agent_id). Returns true iff a block row was removed.';
+revoke all on function agent_board.unblock_board_inviter(uuid, uuid, uuid) from public, anon;
+grant execute on function agent_board.unblock_board_inviter(uuid, uuid, uuid) to authenticated, service_role;
+
+-- 5. gate invite_board_member ----------------------------------------------
+-- CREATE OR REPLACE preserves the existing ACL + comment; grants are re-asserted below per
+-- house convention (replay-order independence). The ONLY change is the INVITEPOLICY guard,
+-- gating on v_actor (the session inviter). A null actor is the service_role operator
+-- carve-out and skips the check (permissive), matching the existing gate structure.
+create or replace function agent_board.invite_board_member(
+  p_board_id uuid,
+  p_agent_id uuid,
+  p_created_by_agent_id uuid,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(
+  membership_id uuid,
+  board_id uuid,
+  agent_id uuid,
+  membership_state text,
+  created_at timestamptz,
+  updated_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = 'agent_board', 'public'
+as $function$
+declare
+  v_board agent_board.boards%rowtype;
+  v_membership agent_board.board_memberships%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- GATENULL (#58): only service_role may proceed with an unresolved actor.
+  if v_actor is null and not agent_board._is_service_role() then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+  if v_board.id is null then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+  if v_actor is not null then
+    if v_board.role_gate_enforced then
+      -- Gate ON: NO creator exemption. Every actor (including a demoted creator)
+      -- must hold an active owner/admin membership.
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+           and bm.role in ('owner', 'admin')
+      ) then
+        raise exception 'board invite requires owner or admin role' using errcode = '42501';
+      end if;
+    elsif v_actor <> v_board.created_by_agent_id then
+      -- Gate OFF: creator bypasses; any other actor needs an active membership.
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+      ) then
+        raise exception 'board invite requires active membership' using errcode = '42501';
+      end if;
+    end if;
+  end if;
+  if not exists (select 1 from agent_board.agents where id = p_agent_id) then
+    raise exception 'agent not found' using errcode = 'P0002';
+  end if;
+  if not exists (select 1 from agent_board.agents where id = p_created_by_agent_id) then
+    raise exception 'creator agent not found' using errcode = 'P0002';
+  end if;
+
+  -- INVITEPOLICY (#90): a target may block a specific inviter on a specific board.
+  -- Gate on the SESSION actor (the real inviter), never p_created_by_agent_id (an
+  -- assertion). A null actor is the service_role operator carve-out (permissive).
+  if v_actor is not null
+     and not agent_board._invite_permitted(p_board_id, p_agent_id, v_actor) then
+    raise exception 'target has blocked invitations from this inviter on this board'
+      using errcode = '42501';
+  end if;
+
+  v_membership := agent_board._upsert_board_membership_state(
+    p_board_id,
+    p_agent_id,
+    'invited',
+    p_created_by_agent_id,
+    p_metadata
+  );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.created_at, v_membership.updated_at;
+end;
+$function$;
+
+revoke all on function agent_board.invite_board_member(uuid, uuid, uuid, jsonb) from public, anon;
+grant execute on function agent_board.invite_board_member(uuid, uuid, uuid, jsonb) to authenticated, service_role;
+
+-- 6. close the update_board_membership disclosure bypass --------------------
+-- invite_board_member is not the only path that can seat an inbound-disclosure membership for
+-- a target: update_board_membership (an owner/admin tool) writes an arbitrary p_membership_state
+-- for another agent. Its consent gate (20260809000100) only covers ACTIVE admission
+-- (joined/subscribed via _membership_consent_present); a non-target actor writing 'invited' or
+-- 'requested' is ungated, so a blocked owner/admin could re-seat the exact disclosure row the
+-- block is meant to refuse. CREATE OR REPLACE with the SAME body plus one INVITEPOLICY guard in
+-- the acting-on-another-agent branch (both 'invited' and 'requested' restore board SELECT for the
+-- target, so both are gated). service_role/self paths are unaffected (the guard sits inside the
+-- authenticated, other-agent branch where v_actor is non-null). Grants re-asserted per convention.
+create or replace function agent_board.update_board_membership(
+  p_board_id uuid,
+  p_agent_id uuid,
+  p_membership_state text,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(
+  membership_id uuid,
+  board_id uuid,
+  agent_id uuid,
+  membership_state text,
+  left_at timestamp with time zone,
+  updated_at timestamp with time zone
+)
+language plpgsql
+security definer
+set search_path to 'agent_board', 'public'
+as $function$
+declare
+  v_membership agent_board.board_memberships%rowtype;
+  v_board agent_board.boards%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+  v_is_service boolean := agent_board._is_service_role();
+  v_existing_state text;
+  v_target_role text;
+  v_actor_role text;
+begin
+  if v_actor is null and not v_is_service then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  if not v_is_service and v_actor <> p_agent_id then
+    select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+    if v_board.id is null then
+      raise exception 'board not found' using errcode = 'P0002';
+    end if;
+    select bm.role
+      into v_actor_role
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = v_actor
+       and bm.membership_state in ('joined', 'subscribed')
+     limit 1;
+    if v_actor_role is null or v_actor_role not in ('owner', 'admin') then
+      raise exception 'board membership change requires owner or admin role'
+        using errcode = '42501';
+    end if;
+  end if;
+
+  select bm.membership_state, bm.role
+    into v_existing_state, v_target_role
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   order by
+     case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+     bm.created_at desc,
+     bm.id desc
+   limit 1;
+  if v_existing_state is null then
+    raise exception 'board membership not found' using errcode = 'P0002';
+  end if;
+
+  if not v_is_service then
+    if v_actor = p_agent_id then
+      if not (
+        (p_membership_state = 'left'
+         and v_existing_state in ('joined', 'subscribed', 'invited', 'requested'))
+        or (p_membership_state in ('joined', 'subscribed')
+            and v_existing_state in ('joined', 'subscribed'))
+        or (p_membership_state = v_existing_state
+            and p_membership_state in ('left', 'removed'))
+      ) then
+        raise exception 'self membership change not permitted; use the join/approval path'
+          using errcode = '42501';
+      end if;
+    else
+      if agent_board._role_rank(v_actor_role)
+         <= agent_board._role_rank(
+              case
+                when p_membership_state in ('joined', 'subscribed')
+                 and coalesce(v_existing_state, '') not in ('joined', 'subscribed')
+                then 'member'
+                else coalesce(v_target_role, '')
+              end) then
+        raise exception 'board membership change requires a higher board role than the target'
+          using errcode = '42501';
+      end if;
+
+      if p_membership_state in ('joined', 'subscribed')
+         and coalesce(v_existing_state, '') not in ('joined', 'subscribed')
+         and not agent_board._membership_consent_present(p_board_id, p_agent_id) then
+        raise exception 'admitting % requires an act by that agent', p_agent_id
+          using errcode = '42501';
+      end if;
+
+      -- INVITEPOLICY (#90): seating an inbound-disclosure membership ('invited'/'requested')
+      -- for a target that has blocked THIS actor is refused, mirroring invite_board_member.
+      -- Without this, an owner/admin re-seats the exact row the block refuses. Active-admission
+      -- states are already consent-gated above; service_role/self never reach this branch.
+      if p_membership_state in ('invited', 'requested')
+         and not agent_board._invite_permitted(p_board_id, p_agent_id, v_actor) then
+        raise exception 'target has blocked invitations from this inviter on this board'
+          using errcode = '42501';
+      end if;
+    end if;
+  end if;
+
+  if not v_is_service
+     and p_membership_state = v_existing_state
+     and p_membership_state in ('left', 'removed') then
+    return query
+    select bm.id, bm.board_id, bm.agent_id, bm.membership_state, bm.left_at, bm.updated_at
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+     order by
+       case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+       bm.created_at desc,
+       bm.id desc
+     limit 1;
+    return;
+  end if;
+
+  select * into v_membership
+    from agent_board._upsert_board_membership_state(
+      p_board_id,
+      p_agent_id,
+      p_membership_state,
+      null,
+      p_metadata
+    );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.left_at, v_membership.updated_at;
+end;
+$function$;
+
+revoke all on function agent_board.update_board_membership(uuid, uuid, text, jsonb) from public, anon;
+grant execute on function agent_board.update_board_membership(uuid, uuid, text, jsonb) to authenticated, service_role;

package/migrations/20260814000100_agent_board_obsgate_thread_post_policy.sql

@@ -0,0 +1,239 @@
+-- OBSGATE (#78) — threads carry their own posting rule; an observer can no longer author
+-- into a board thread.
+--
+-- Defect: post_message is the SOLE authenticated writer to agent_board.messages (INSERT is
+-- granted only to postgres/service_role; the only authenticated RLS policy is SELECT), and it
+-- gates only on _current_agent_can_access_thread — NO role check. An observer who has thread
+-- access (via a board-fanned message) can therefore call post_message directly (SDK/CLI/MCP all
+-- expose it) and author into the board thread, bypassing the non-observer send-role gate that
+-- post_board_message enforces. MBHYGIENE (20260804000100) explicitly punted this because
+-- agent_board.threads had no board linkage.
+--
+-- Fix (maintainer-approved: "threads carry their own posting rules, independent of the board"):
+--   * threads.post_policy — the thread's own posting rule. Ships with 'inherit' only.
+--   * threads.board_id — a SINGLE-VALUED stamped board link (the model that dissolves the
+--     MBHYGIENE blocker). Stamped first-board-wins at the universal board-fan chokepoint
+--     (_upsert_delivery_recipient), so EVERY board-fanning path — post_board_message,
+--     create_tasking_delivery — links the thread, not just post_board_message.
+--   * _current_agent_can_post_to_thread — the shared predicate: 'inherit' + a stamped board
+--     requires _current_agent_can_send_to_board (observer denied); 'inherit' + no board falls
+--     through to the thread access check (DM / multicast / restricted threads: no role gate, no
+--     regression). service_role short-circuits.
+--   * The gate is enforced IN post_message (the chokepoint no send path can skip).
+--     post_board_message keeps its own board send-role gate (defense-in-depth).
+--
+-- Additive, forward-only. schema_version stays 8 (consistent with thread_acl / send_role_gate,
+-- which added columns/tables without a read-model bump). SDK/CLI/MCP need no change — the gate
+-- is server-side and simply surfaces a 42501.
+
+-- 1. columns ----------------------------------------------------------------
+alter table agent_board.threads
+  add column if not exists board_id uuid references agent_board.boards(id);
+alter table agent_board.threads
+  add column if not exists post_policy text not null default 'inherit';
+
+-- Only 'inherit' ships now; 'restricted' (thread-role-driven posting) is a future policy that
+-- will widen this constraint when implemented. Constraining the domain now prevents a caller
+-- setting an unenforced policy value.
+alter table agent_board.threads
+  drop constraint if exists threads_post_policy_check;
+alter table agent_board.threads
+  add constraint threads_post_policy_check check (post_policy in ('inherit'));
+
+create index if not exists idx_agent_board_threads_board_id
+  on agent_board.threads(board_id);
+
+comment on column agent_board.threads.board_id is
+  'OBSGATE (#78): the single owning board this thread posts under, stamped first-board-wins on first board delivery (_upsert_delivery_recipient). NULL for board-less threads (DM/multicast). Drives the post_message posting gate.';
+comment on column agent_board.threads.post_policy is
+  'OBSGATE (#78): the thread''s own posting rule. ''inherit'' (only value shipped): a board-linked thread requires a non-observer board role to post; a board-less thread is access-only.';
+
+-- 2. backfill ---------------------------------------------------------------
+-- Stamp EVERY existing thread that has any board delivery, resolving the thread from every
+-- source kind (message / task / delegation) so tasking-fanned threads are covered. Multi-board
+-- threads are stamped to their EARLIEST-delivery board — the same first-board-wins rule the
+-- forward stamp uses — rather than left NULL: leaving them NULL would drop them to the
+-- access-only branch and preserve the original observer escalation (a board member reaching the
+-- thread could author). A denial for a member of a non-chosen board is a false-deny, not an
+-- escalation, and matches the forward single-valued model.
+update agent_board.threads t
+   set board_id = sub.board_id
+  from (
+    select distinct on (thr) thr as thread_id, bid as board_id
+    from (
+      select m.thread_id as thr, dr.board_id as bid, dr.created_at as ca
+        from agent_board.delivery_recipients dr
+        join agent_board.messages m on m.id = dr.source_message_id
+       where dr.board_id is not null
+      union all
+      select tk.thread_id as thr, dr.board_id as bid, dr.created_at as ca
+        from agent_board.delivery_recipients dr
+        join agent_board.tasks tk on tk.id = dr.source_task_id
+       where dr.board_id is not null
+      union all
+      select tk.thread_id as thr, dr.board_id as bid, dr.created_at as ca
+        from agent_board.delivery_recipients dr
+        join agent_board.delegations d on d.id = dr.source_delegation_id
+        join agent_board.tasks tk on tk.id = d.child_task_id
+       where dr.board_id is not null
+    ) all_src
+    order by thr, ca, bid   -- earliest delivery wins; board_id tiebreaks for determinism
+  ) sub
+ where t.id = sub.thread_id
+   and t.board_id is null;
+
+-- 3. posting predicate ------------------------------------------------------
+create or replace function agent_board._current_agent_can_post_to_thread(p_thread_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select agent_board._is_service_role()
+    or coalesce(
+      (
+        select case
+          when t.post_policy = 'inherit' and t.board_id is not null
+            then agent_board._current_agent_can_send_to_board(t.board_id)
+          else agent_board._current_agent_can_access_thread(p_thread_id)
+        end
+        from agent_board.threads t
+        where t.id = p_thread_id
+      ),
+      false
+    )
+$$;
+comment on function agent_board._current_agent_can_post_to_thread(uuid) is
+  'OBSGATE (#78): may the current agent post to this thread? inherit + stamped board -> non-observer board send role; inherit + no board -> thread access (DM/multicast unaffected); service_role -> true. Internal-only; PUBLIC EXECUTE revoked.';
+revoke all on function agent_board._current_agent_can_post_to_thread(uuid) from public, anon, authenticated;
+
+-- 4. universal board-link stamp at the delivery-recipient sink ---------------
+-- CREATE OR REPLACE preserves the body; adds only the first-board-wins stamp so that EVERY
+-- board-fanning caller (post_board_message, create_tasking_delivery) links the thread.
+create or replace function agent_board._upsert_delivery_recipient(
+  p_delivery_mode text,
+  p_recipient_agent_id uuid,
+  p_source_kind text,
+  p_source_message_id uuid default null,
+  p_source_task_id uuid default null,
+  p_source_delegation_id uuid default null,
+  p_board_id uuid default null,
+  p_board_membership_id uuid default null,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns agent_board.delivery_recipients
+language plpgsql
+security definer
+set search_path to 'agent_board', 'public'
+as $function$
+declare
+  v_row agent_board.delivery_recipients%rowtype;
+begin
+  insert into agent_board.delivery_recipients(
+    delivery_mode,
+    recipient_agent_id,
+    source_kind,
+    source_message_id,
+    source_task_id,
+    source_delegation_id,
+    board_id,
+    board_membership_id,
+    metadata
+  )
+  values (
+    p_delivery_mode,
+    p_recipient_agent_id,
+    p_source_kind,
+    p_source_message_id,
+    p_source_task_id,
+    p_source_delegation_id,
+    p_board_id,
+    p_board_membership_id,
+    coalesce(p_metadata, '{}'::jsonb)
+  )
+  on conflict (recipient_agent_id, canonical_source_key) do update
+    set metadata = coalesce(agent_board.delivery_recipients.metadata, '{}'::jsonb) || coalesce(excluded.metadata, '{}'::jsonb)
+  returning * into v_row;
+
+  -- OBSGATE (#78): stamp the thread's owning board on first board delivery so
+  -- post_message's posting gate can resolve it. Resolve the thread from WHICHEVER source the
+  -- delivery carries — message (post_board_message), task (create_tasking_delivery), or
+  -- delegation — so EVERY board-fanning path links the thread, not just the message-sourced one.
+  -- First-board-wins (never overwrites); board-less deliveries (p_board_id null) never stamp.
+  if p_board_id is not null then
+    update agent_board.threads t
+       set board_id = p_board_id
+     where t.board_id is null
+       and t.id = coalesce(
+         (select m.thread_id from agent_board.messages m where m.id = p_source_message_id),
+         (select tk.thread_id from agent_board.tasks tk where tk.id = p_source_task_id),
+         (select tk.thread_id
+            from agent_board.delegations d
+            join agent_board.tasks tk on tk.id = d.child_task_id
+           where d.id = p_source_delegation_id)
+       );
+  end if;
+
+  return v_row;
+end;
+$function$;
+revoke all on function agent_board._upsert_delivery_recipient(text, uuid, text, uuid, uuid, uuid, uuid, uuid, jsonb) from public, anon, authenticated;
+grant execute on function agent_board._upsert_delivery_recipient(text, uuid, text, uuid, uuid, uuid, uuid, uuid, jsonb) to service_role;
+
+-- 5. enforce the gate in post_message (the chokepoint) ----------------------
+-- CREATE OR REPLACE with the SAME body plus one OBSGATE gate after the access check.
+create or replace function agent_board.post_message(
+  p_thread_id uuid,
+  p_author_agent_id uuid,
+  p_body text,
+  p_message_type text default 'comment',
+  p_task_id uuid default null,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(
+  message_id uuid,
+  thread_id uuid,
+  task_id uuid,
+  message_sequence bigint,
+  created_at timestamp with time zone
+)
+language plpgsql
+security definer
+set search_path to 'agent_board', 'public'
+as $function$
+declare
+  v_sequence bigint;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_author_agent_id, 'p_author_agent_id');
+
+  if nullif(trim(p_body), '') is null then
+    raise exception 'message body is required' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  -- OBSGATE (#78): a board-linked thread under 'inherit' requires a non-observer board role.
+  -- post_message is the sole authenticated writer to messages, so this gate cannot be bypassed
+  -- by any send path. Board-less threads and service_role fall through (access check above).
+  if not agent_board._current_agent_can_post_to_thread(p_thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+  if p_task_id is not null and not exists (select 1 from agent_board.tasks where id = p_task_id and tasks.thread_id = p_thread_id) then
+    raise exception 'task not found in thread' using errcode = '22023';
+  end if;
+
+  v_sequence := agent_board._next_thread_message_sequence(p_thread_id);
+
+  return query
+  insert into agent_board.messages(thread_id, author_agent_id, task_id, message_sequence, message_type, body, metadata)
+  values (p_thread_id, v_actor_agent_id, p_task_id, v_sequence, coalesce(p_message_type, 'comment'), p_body, coalesce(p_metadata, '{}'::jsonb))
+  returning id, messages.thread_id, messages.task_id, messages.message_sequence, messages.created_at;
+end;
+$function$;
+revoke all on function agent_board.post_message(uuid, uuid, text, text, uuid, jsonb) from public, anon;
+grant execute on function agent_board.post_message(uuid, uuid, text, text, uuid, jsonb) to authenticated, service_role;