@consiliency/agent-board-schema 1.2.0 → 1.4.0

package/migrations/20260718000300_agent_board_fleet_policy_default_deny.sql

@@ -0,0 +1,192 @@
+-- MBSENDAUTHZ SL-2 (Lane B): fleet-policy non-fleet default-deny (mode-gated).
+--
+-- Forward migration. Re-declares evaluate_signed_write_fleet_policy with its full
+-- body forward-copied verbatim from 20260711000100 (exact signature preserved),
+-- replacing ONLY the non-fleet fail-open (v_machine_id is null => allow) with a
+-- per-sender-fleet-scope mode-gated branch:
+--   * fail_open_preserved (default / absent flag row) => allow silently (unchanged);
+--   * observe                                          => allow AND record one
+--                                                         would_be_deny telemetry row;
+--   * deny                                             => deny (denial_class
+--                                                         'nonfleet_sender_denied')
+--                                                         unless the sender is in the
+--                                                         tight nonfleet_sender_allowlist.
+-- Fleet-resolvable senders keep the existing per-recipient evaluation path unchanged.
+-- Dormant: every scope defaults to fail_open_preserved until an operator flips it.
+
+create or replace function agent_board.evaluate_signed_write_fleet_policy(
+  p_operation text,
+  p_payload jsonb,
+  p_gateway_decision jsonb
+)
+returns table(
+  allowed boolean,
+  actionable boolean,
+  denial_class text,
+  denied_recipient_agent_id uuid,
+  evaluated_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_actor uuid := nullif(p_gateway_decision ->> 'agent_id', '')::uuid;
+  v_machine_id uuid;
+  v_board_id uuid;
+  v_recipient_ids uuid[] := '{}'::uuid[];
+  v_recipient_id uuid;
+  v_evidence_id uuid;
+  v_decision record;
+  v_status text := coalesce(nullif(p_gateway_decision ->> 'verification_status', ''), 'unsigned');
+  v_scope text;
+  v_mode text;
+  v_origin text;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'signed fleet policy evaluation requires service role' using errcode = '42501';
+  end if;
+  if v_actor is null then
+    raise exception 'actor_mismatch: signed write actor is required' using errcode = '42501';
+  end if;
+
+  select fma.machine_id
+    into v_machine_id
+    from agent_board.fleet_machine_agents fma
+    join agent_board.fleet_machines fm on fm.id = fma.machine_id
+   where fma.agent_id = v_actor
+     and fma.lifecycle_state = 'active'
+     and fm.lifecycle_state = 'active'
+   order by fma.updated_at desc
+   limit 1;
+
+  -- Non-fleet sender (v_machine_id is null): the historical fail-open, now
+  -- mode-gated per sender-fleet-scope. Absent flag row => fail_open_preserved
+  -- (unchanged behavior). This branch fires before any board is resolved, so
+  -- the scope is the catch-all 'nonfleet' bucket. Retained until an operator
+  -- flips a scope to deny (deferred to operations).
+  if v_machine_id is null then
+    v_scope := agent_board._resolve_send_fleet_scope(v_actor);
+    v_mode := agent_board._send_fleet_scope_mode(v_scope);
+    v_origin := coalesce(nullif(p_gateway_decision -> 'signed_write' ->> 'origin', ''), 'unknown');
+    if v_mode = 'deny' then
+      if exists (select 1 from agent_board.nonfleet_sender_allowlist a where a.agent_id = v_actor) then
+        return query select true, true, null::text, null::uuid, now();
+        return;
+      end if;
+      perform agent_board._record_send_authz_telemetry(
+        'would_be_deny', v_origin, v_actor, null, p_operation, v_scope,
+        'nonfleet_sender_denied', jsonb_build_object('mode', 'deny', 'redacted', true));
+      return query select false, false, 'nonfleet_sender_denied'::text, null::uuid, now();
+      return;
+    elsif v_mode = 'observe' then
+      perform agent_board._record_send_authz_telemetry(
+        'would_be_deny', v_origin, v_actor, null, p_operation, v_scope,
+        'nonfleet_sender_denied', jsonb_build_object('mode', 'observe', 'redacted', true));
+      return query select true, true, null::text, null::uuid, now();
+      return;
+    else
+      -- fail_open_preserved (default): allow silently, current behavior.
+      return query select true, true, null::text, null::uuid, now();
+      return;
+    end if;
+  end if;
+
+  insert into agent_board.signature_evidence(
+    agent_id, signing_key_id, key_id, key_version, algorithm, source_kind,
+    operation, payload_digest, canonicalization_version, signature_digest,
+    verification_status, failure_class, signed_at, verified_at, nonce,
+    idempotency_key, external_evidence_ref, metadata
+  ) values (
+    v_actor,
+    nullif(p_gateway_decision ->> 'signing_key_id', '')::uuid,
+    nullif(p_gateway_decision ->> 'key_id', ''),
+    nullif(p_gateway_decision ->> 'key_version', '')::integer,
+    coalesce(nullif(p_gateway_decision ->> 'algorithm', ''), 'Ed25519'),
+    'external',
+    p_operation,
+    coalesce(nullif(p_gateway_decision ->> 'payload_digest', ''), 'sha256:unsigned'),
+    coalesce(nullif(p_gateway_decision ->> 'canonicalization_version', ''), 'agent-provenance-jcs.v1'),
+    nullif(p_gateway_decision ->> 'signature_digest', ''),
+    case when v_status in ('unsigned', 'observed', 'warn', 'verified', 'failed') then v_status else 'failed' end,
+    nullif(p_gateway_decision ->> 'failure_class', ''),
+    nullif(p_gateway_decision ->> 'signed_at', '')::timestamptz,
+    nullif(p_gateway_decision ->> 'verified_at', '')::timestamptz,
+    nullif(p_gateway_decision ->> 'nonce', ''),
+    nullif(p_gateway_decision ->> 'idempotency_key', ''),
+    'signed-write-preflight:' || coalesce(nullif(p_gateway_decision ->> 'idempotency_key', ''), nullif(p_gateway_decision ->> 'nonce', ''), gen_random_uuid()::text),
+    jsonb_build_object('gateway', 'signed-write-preflight', 'redacted', true, 'metadata-safe', true)
+  ) returning id into v_evidence_id;
+
+  if p_operation = 'send_direct_message' then
+    if nullif(p_payload ->> 'p_recipient_agent_id', '') is not null then
+      v_recipient_ids := array[(p_payload ->> 'p_recipient_agent_id')::uuid];
+    else
+      v_recipient_ids := agent_board._addressing_agent_ids_or_raise(v_actor, jsonb_build_array(p_payload -> 'p_recipient_descriptor'));
+    end if;
+  elsif p_operation = 'send_multicast_message' then
+    if p_payload ? 'p_recipient_agent_ids' then
+      select coalesce(array_agg(value::uuid), '{}'::uuid[]) into v_recipient_ids
+        from jsonb_array_elements_text(p_payload -> 'p_recipient_agent_ids');
+    else
+      v_recipient_ids := agent_board._addressing_agent_ids_or_raise(v_actor, p_payload -> 'p_recipient_descriptors');
+    end if;
+  elsif p_operation in ('post_board_message', 'create_tasking_delivery') then
+    if nullif(p_payload ->> 'p_board_id', '') is not null then
+      v_board_id := (p_payload ->> 'p_board_id')::uuid;
+    elsif nullif(p_payload ->> 'p_board_slug', '') is not null then
+      select id into v_board_id from agent_board.boards where slug = p_payload ->> 'p_board_slug' and status = 'active';
+    end if;
+    if p_operation = 'create_tasking_delivery' then
+      if p_payload ? 'p_recipient_agent_ids' then
+        select coalesce(array_agg(value::uuid), '{}'::uuid[]) into v_recipient_ids
+          from jsonb_array_elements_text(p_payload -> 'p_recipient_agent_ids');
+      elsif p_payload ? 'p_recipient_descriptors' and p_payload -> 'p_recipient_descriptors' <> 'null'::jsonb then
+        v_recipient_ids := agent_board._addressing_agent_ids_or_raise(v_actor, p_payload -> 'p_recipient_descriptors');
+      end if;
+    end if;
+    if v_board_id is not null then
+      select array(
+        select distinct recipient_id from (
+          select unnest(v_recipient_ids) as recipient_id
+          union
+          select bm.agent_id from agent_board.board_memberships bm
+           where bm.board_id = v_board_id and bm.membership_state in ('joined', 'subscribed')
+        ) recipients
+      ) into v_recipient_ids;
+    end if;
+  else
+    return query select true, true, null::text, null::uuid, now();
+    return;
+  end if;
+
+  if coalesce(cardinality(v_recipient_ids), 0) = 0 then
+    return query select false, false, 'recipient_policy_denied'::text, null::uuid, now();
+    return;
+  end if;
+
+  foreach v_recipient_id in array v_recipient_ids loop
+    select * into v_decision
+      from agent_board.evaluate_fleet_sender_policy(
+        v_actor,
+        v_recipient_id,
+        v_machine_id,
+        v_board_id,
+        p_operation,
+        v_evidence_id,
+        false
+      );
+    if not coalesce(v_decision.allowed, false) or not coalesce(v_decision.actionable, false) then
+      return query select false, false, coalesce(v_decision.denial_class, 'recipient_policy_denied'), v_recipient_id, now();
+      return;
+    end if;
+  end loop;
+
+  return query select true, true, null::text, null::uuid, now();
+end;
+$$;
+
+-- Re-assert grants (mirrors 20260711000100:217/220) so a fresh replay is
+-- order-independent.
+revoke all on function agent_board.evaluate_signed_write_fleet_policy(text, jsonb, jsonb) from public, anon, authenticated;
+grant execute on function agent_board.evaluate_signed_write_fleet_policy(text, jsonb, jsonb) to service_role;

package/migrations/20260718000400_agent_board_grant_ceiling_wiring.sql

@@ -0,0 +1,58 @@
+-- MBSENDAUTHZ SL-3 (Lane C): dormant board-role grant chokepoint that consumes
+-- the MBAUTHZ ceiling helper.
+--
+-- Additive. There is no authenticated role-granting RPC today (update_board_membership
+-- mutates only membership_state). This adds the minimal dormant chokepoint
+-- grant_board_role — service_role-only (revoked from authenticated) — that consults
+-- the MBAUTHZ _grant_within_ceiling helper before writing board_memberships.role.
+-- It adds NO ceiling logic of its own: the grantee-bounded semantics
+-- (grantee <= min(grantor role, board ceiling); no ceiling row => owner) live in
+-- MBAUTHZ's _grant_within_ceiling and are consumed as-is.
+
+create or replace function agent_board.grant_board_role(
+  p_board_id uuid,
+  p_agent_id uuid,
+  p_grantee_role text,
+  p_grantor_agent_id uuid
+)
+returns table(board_id uuid, agent_id uuid, role text, updated_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_updated agent_board.board_memberships%rowtype;
+begin
+  if p_grantee_role not in ('owner', 'admin', 'member', 'observer') then
+    raise exception 'invalid grantee role' using errcode = '22023';
+  end if;
+  if not exists (
+    select 1 from agent_board.board_memberships bm
+     where bm.board_id = p_board_id and bm.agent_id = p_agent_id
+  ) then
+    raise exception 'grantee has no membership on this board' using errcode = 'P0002';
+  end if;
+
+  -- Ceiling consumption: grantee-bounded against min(grantor role, board ceiling).
+  if not agent_board._grant_within_ceiling(p_grantor_agent_id, p_board_id, p_grantee_role) then
+    raise exception 'grant exceeds grantor role or board authority ceiling' using errcode = '42501';
+  end if;
+
+  update agent_board.board_memberships bm
+     set role = p_grantee_role,
+         updated_at = now()
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   returning * into v_updated;
+
+  return query
+  select v_updated.board_id, v_updated.agent_id, v_updated.role, v_updated.updated_at;
+end;
+$$;
+
+comment on function agent_board.grant_board_role(uuid, uuid, text, uuid) is
+  'Dormant service_role-only board-role grant chokepoint. Raises unless _grant_within_ceiling(grantor, board, grantee_role) holds (grantee-bounded), then sets board_memberships.role. Consumes the MBAUTHZ ceiling helper; adds no ceiling logic.';
+
+-- Dormant: revoked from authenticated, granted to service_role only.
+revoke all on function agent_board.grant_board_role(uuid, uuid, text, uuid) from public, anon, authenticated;
+grant execute on function agent_board.grant_board_role(uuid, uuid, text, uuid) to service_role;

package/migrations/20260718000500_agent_board_fleet_agent_session_class.sql

@@ -0,0 +1,24 @@
+-- MBSESSION SL-1 (IF-0-MBSESSION-1): board-native fleet_agent_session identity class + TTL pin.
+--
+-- Additive, forward-only. Does NOT edit the historical 20260710000400 bytes: the
+-- inline CHECK Postgres named `nonfleet_sessions_identity_class_check` is replaced
+-- here (drop-if-exists + re-add) with the 5th literal `fleet_agent_session` (the old
+-- four classes still validate), and a new `nonfleet_sessions_fleet_ttl_pin` prevents a
+-- fleet_agent_session row from inheriting the 3600 default (caps it at 900 seconds).
+
+alter table agent_board.nonfleet_sessions
+  drop constraint if exists nonfleet_sessions_identity_class_check;
+
+alter table agent_board.nonfleet_sessions
+  add constraint nonfleet_sessions_identity_class_check
+  check (identity_class in ('ephemeral_child', 'hosted_workload', 'remote_sandbox', 'invited_external', 'fleet_agent_session'));
+
+alter table agent_board.nonfleet_sessions
+  drop constraint if exists nonfleet_sessions_fleet_ttl_pin;
+
+alter table agent_board.nonfleet_sessions
+  add constraint nonfleet_sessions_fleet_ttl_pin
+  check (identity_class <> 'fleet_agent_session' or max_ttl_seconds <= 900);
+
+comment on constraint nonfleet_sessions_fleet_ttl_pin on agent_board.nonfleet_sessions is
+  'Board-native fleet_agent_session sessions are pinned to a <= 900s TTL and cannot inherit the 3600 default.';

package/migrations/20260718000600_agent_board_mint_fleet_agent_session.sql

@@ -0,0 +1,172 @@
+-- MBSESSION SL-1 (IF-0-MBSESSION-2 + IF-0-MBSESSION-3): whole-principal PoP session mint.
+--
+-- Additive, forward-only. Adds:
+--   * agent_board._agent_principal_active(uuid) — stable recursive lineage walk that
+--     returns true iff every agent from p_agent_id up to its lineage root is active.
+--   * agent_board.mint_fleet_agent_session(...) — security definer, service_role-only;
+--     re-validates the WHOLE principal (challenge + signing key + lineage) before it
+--     consumes the challenge and inserts a fleet_agent_session nonfleet_sessions row.
+-- Both live in this migration because the mint consumes the new identity_class from
+-- 20260718000500 and calls _agent_principal_active.
+
+-- IF-3: whole-principal liveness. Walk parent_agent_id from the seed up to the
+-- lineage root (parent NULL or id = root_agent_id). True iff EVERY agent in the
+-- chain is status = 'active'; a non-existent agent reduces to false; an unparented
+-- agent reduces to its own status.
+create or replace function agent_board._agent_principal_active(p_agent_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  with recursive lineage(id, parent_agent_id, root_agent_id, status, depth) as (
+    select a.id, a.parent_agent_id, a.root_agent_id, a.status, 0
+      from agent_board.agents a
+     where a.id = p_agent_id
+    union all
+    select p.id, p.parent_agent_id, p.root_agent_id, p.status, l.depth + 1
+      from lineage l
+      join agent_board.agents p on p.id = l.parent_agent_id
+     where l.parent_agent_id is not null
+       and l.id is distinct from l.root_agent_id
+       and l.depth < 64
+  )
+  select coalesce(bool_and(status = 'active'), false)
+    from lineage;
+$$;
+
+comment on function agent_board._agent_principal_active(uuid) is
+  'True iff every agent in the lineage from the given agent up to its root is status = active. Refresh-checked revocation signal for fleet_agent_session minting.';
+
+revoke all on function agent_board._agent_principal_active(uuid) from public, anon, authenticated;
+grant execute on function agent_board._agent_principal_active(uuid) to service_role;
+
+-- IF-2: whole-principal PoP session mint. service_role-only. Any failing clause
+-- raises and mints no row.
+create or replace function agent_board.mint_fleet_agent_session(
+  p_challenge_id uuid,
+  p_nonce text,
+  p_signing_key_id uuid,
+  p_agent_id uuid,
+  p_max_ttl_seconds integer default 900
+)
+returns table(session_id text, expires_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_challenge agent_board.agent_signing_key_challenges%rowtype;
+  v_key agent_board.agent_signing_keys%rowtype;
+  v_auth_user_id uuid;
+  v_parent_agent_id uuid;
+  v_ttl integer := least(coalesce(p_max_ttl_seconds, 900), 900);
+  v_session_id text := 'fas_' || replace(gen_random_uuid()::text, '-', '');
+  v_expires_at timestamptz;
+begin
+  if v_ttl <= 0 then
+    raise exception 'max_ttl_seconds must be positive' using errcode = '22023';
+  end if;
+
+  -- (i) challenge: exists, bound to this agent + signing key, unconsumed, unexpired.
+  select * into v_challenge
+    from agent_board.agent_signing_key_challenges c
+   where c.id = p_challenge_id
+   for update;
+  if not found then
+    raise exception 'signing key challenge not found' using errcode = 'P0002';
+  end if;
+  if v_challenge.agent_id <> p_agent_id or v_challenge.signing_key_id <> p_signing_key_id then
+    raise exception 'actor_mismatch: challenge is not bound to this agent and signing key' using errcode = '42501';
+  end if;
+  if v_challenge.proof_state <> 'pending' or v_challenge.consumed_at is not null then
+    raise exception 'nonce_replay: signing key challenge already consumed' using errcode = '23505';
+  end if;
+  if v_challenge.expires_at <= now() then
+    raise exception 'timestamp_out_of_window: signing key challenge expired' using errcode = '22023';
+  end if;
+  -- #10 nonce binding (belt-and-suspenders on top of the challenge_id binding): the
+  -- caller must present the exact stored challenge_nonce for this challenge row.
+  if p_nonce is null or p_nonce <> v_challenge.challenge_nonce then
+    raise exception 'nonce_mismatch: presented nonce does not match the bound challenge' using errcode = '42501';
+  end if;
+
+  -- (ii) signing key: bound to this agent, active, unrevoked.
+  select * into v_key
+    from agent_board.agent_signing_keys ask
+   where ask.id = p_signing_key_id
+     and ask.agent_id = p_agent_id
+   for update;
+  if not found then
+    raise exception 'signing key not found for agent' using errcode = 'P0002';
+  end if;
+  if v_key.status <> 'active' or v_key.revoked_at is not null then
+    raise exception 'key_revoked: signing key is not active' using errcode = '42501';
+  end if;
+  -- #12 key expiry: today only the challenge RPC checks agent_signing_keys.expires_at;
+  -- the mint must reject an expired key as well.
+  if v_key.expires_at is not null and v_key.expires_at <= now() then
+    raise exception 'key_expired: signing key is past its expires_at' using errcode = '42501';
+  end if;
+
+  -- (iii) whole principal active (self + every ancestor up to lineage root).
+  if not agent_board._agent_principal_active(p_agent_id) then
+    raise exception 'principal_inactive: agent principal is not fully active' using errcode = '42501';
+  end if;
+
+  -- (iv) #4 governing delegation-grant liveness for root_minted children. A child
+  -- that holds a delegation_grants row may mint ONLY while that grant is unrevoked
+  -- and unexpired (grant_expires_at > now()). independent_auth principals hold no
+  -- grant row and skip this gate. This binds the hours-scale grant clock to the mint
+  -- so an expired/revoked grant cannot keep re-minting <=900s tokens indefinitely.
+  if exists (select 1 from agent_board.delegation_grants g where g.child_agent_id = p_agent_id) then
+    if not exists (
+      select 1
+        from agent_board.delegation_grants g
+       where g.child_agent_id = p_agent_id
+         and g.revoked_at is null
+         and g.grant_expires_at > now()
+    ) then
+      raise exception 'grant_expired: the governing delegation grant is revoked or expired' using errcode = '42501';
+    end if;
+  end if;
+
+  -- Scope to the agent's authenticated principal. A fleet_agent_session must bind to
+  -- an auth-bound agent (no auth_user_id column on nonfleet_sessions; this is a mint
+  -- invariant flowed to the EF token sub, not a stored value).
+  select a.auth_user_id, a.parent_agent_id
+    into v_auth_user_id, v_parent_agent_id
+    from agent_board.agents a
+   where a.id = p_agent_id;
+  if v_auth_user_id is null then
+    raise exception 'agent has no auth_user_id principal to scope the session' using errcode = '42501';
+  end if;
+
+  -- Consume the challenge (one-time).
+  update agent_board.agent_signing_key_challenges
+     set proof_state = 'consumed',
+         consumed_at = now(),
+         updated_at = now()
+   where id = p_challenge_id;
+
+  v_expires_at := now() + make_interval(secs => v_ttl);
+
+  insert into agent_board.nonfleet_sessions(
+    id, session_id, identity_class, agent_id, parent_agent_id,
+    max_ttl_seconds, issued_at, expires_at
+  )
+  values (
+    v_session_id, v_session_id, 'fleet_agent_session', p_agent_id, v_parent_agent_id,
+    v_ttl, now(), v_expires_at
+  );
+
+  return query select v_session_id, v_expires_at;
+end;
+$$;
+
+comment on function agent_board.mint_fleet_agent_session(uuid, text, uuid, uuid, integer) is
+  'Whole-principal PoP session mint: re-validates challenge (incl. bound nonce) + active/unrevoked/unexpired signing key + full-lineage liveness + governing delegation-grant liveness, consumes the challenge, and inserts a <=900s fleet_agent_session. service_role-only.';
+
+revoke all on function agent_board.mint_fleet_agent_session(uuid, text, uuid, uuid, integer) from public, anon, authenticated;
+grant execute on function agent_board.mint_fleet_agent_session(uuid, text, uuid, uuid, integer) to service_role;

package/migrations/20260718000700_agent_board_nonfleet_session_reaper.sql

@@ -0,0 +1,35 @@
+-- MBSESSION SL-1 (IF-0-MBSESSION-6): expired nonfleet_sessions reaper.
+--
+-- Additive, forward-only. security definer, service_role-only. Deletes non-revoked
+-- nonfleet_sessions rows whose expires_at is older than p_older_than (default 7 days)
+-- and returns the affected count. Uses the partial idx_nonfleet_sessions_expires_at
+-- (predicate: where revoked_at is null) — the WHERE clause matches that predicate so
+-- the index is usable. Scheduling (pg_cron / external cadence) is a deferred owner;
+-- the callable function is in-scope.
+create or replace function agent_board.reap_expired_nonfleet_sessions(
+  p_older_than interval default interval '7 days'
+)
+returns bigint
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_count bigint;
+begin
+  with deleted as (
+    delete from agent_board.nonfleet_sessions ns
+     where ns.revoked_at is null
+       and ns.expires_at < now() - coalesce(p_older_than, interval '7 days')
+    returning 1
+  )
+  select count(*) into v_count from deleted;
+  return v_count;
+end;
+$$;
+
+comment on function agent_board.reap_expired_nonfleet_sessions(interval) is
+  'Deletes non-revoked nonfleet_sessions rows expired older than p_older_than (default 7 days); returns the affected count. service_role-only.';
+
+revoke all on function agent_board.reap_expired_nonfleet_sessions(interval) from public, anon, authenticated;
+grant execute on function agent_board.reap_expired_nonfleet_sessions(interval) to service_role;

package/migrations/20260718000800_agent_board_regrant_scoped_send.sql

@@ -0,0 +1,24 @@
+-- MBSESSION SL-1 (IF-0-MBSESSION-4 + IF-0-MBSESSION-8): scoped-send re-grant + schema_version bump.
+--
+-- Additive, forward-only. Reverses the 8 core send-RPC `revoke execute ... from
+-- authenticated` staged at 20260711000100:224-231 by re-granting execute to
+-- `authenticated` on the exact same 8 overload signatures (mirrored byte-for-byte).
+-- Actor derivation is UNCHANGED (_resolved_actor_agent_id, current_agent_id()); the
+-- MBSENDAUTHZ role-gate/telemetry bodies are preserved by Postgres across
+-- create-or-replace, so this is a fresh grant only. The signed_* gateway RPCs revoked
+-- at :217-222 stay service_role-only and are NOT touched here.
+--
+-- MBSESSION is the enforcement-switches-on point (the re-grant makes the authenticated
+-- live path real), so schema_version bumps to 8.
+
+grant execute on function agent_board.send_direct_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) to authenticated;
+grant execute on function agent_board.send_direct_message(uuid, uuid, jsonb, text, text, text, text, text, text, jsonb) to authenticated;
+grant execute on function agent_board.send_multicast_message(uuid, uuid, uuid[], text, text, text, text, text, jsonb) to authenticated;
+grant execute on function agent_board.send_multicast_message(uuid, uuid, jsonb, text, text, text, text, text, text, jsonb) to authenticated;
+grant execute on function agent_board.post_board_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) to authenticated;
+grant execute on function agent_board.post_board_message(uuid, uuid, text, text, text, text, text, text, text, jsonb) to authenticated;
+grant execute on function agent_board.create_tasking_delivery(uuid, uuid, text, text, uuid[], uuid, text, text, text, jsonb) to authenticated;
+grant execute on function agent_board.create_tasking_delivery(uuid, uuid, text, text, jsonb, text, text, text, text, text, jsonb) to authenticated;
+
+insert into agent_board.schema_version(version) values (8)
+on conflict ((true)) do update set version = greatest(agent_board.schema_version.version, excluded.version);

package/migrations/20260718000900_agent_board_agents_status_revoked.sql

@@ -0,0 +1,24 @@
+-- MBDELEG SL-1 (IF-0-MBDELEG-1): extend agent_board.agents.status with 'revoked'.
+--
+-- Additive, forward-only. Does NOT edit the historical 20260502000000 bytes: the
+-- inline CHECK Postgres auto-named `agents_status_check` is replaced here
+-- (drop-if-exists + re-add) with a 4th literal `revoked` (the existing three
+-- classes still validate). Mirrors the `nonfleet_sessions_identity_class_check`
+-- CHECK-extension precedent at 20260718000500.
+--
+-- Rationale: a cascade-killed principal (revoke_agent_subtree / revoke_human_subtree,
+-- 20260718001100) must be forensically distinguishable from an operator-`'suspended'`
+-- one and safely un-revokable, so a dedicated `'revoked'` literal is chosen over
+-- reusing `'suspended'`. Every existing consumer treats any non-`active` value as
+-- non-live (current_agent_id() filters status='active'; _agent_principal_active
+-- requires status='active' for the whole lineage), so a 4th literal is safe.
+
+alter table agent_board.agents
+  drop constraint if exists agents_status_check;
+
+alter table agent_board.agents
+  add constraint agents_status_check
+  check (status in ('active', 'inactive', 'suspended', 'revoked'));
+
+comment on constraint agents_status_check on agent_board.agents is
+  'Agent lifecycle status. ''revoked'' (MBDELEG) marks a cascade-killed principal, forensically distinct from operator-''suspended''; both are non-active and fail every liveness check.';