@consiliency/agent-board-schema 1.2.0

package/migrations/20260628000003_agent_board_signed_write_gateway.sql

@@ -0,0 +1,288 @@
+create or replace function agent_board.reserve_signed_write_replay(
+  p_agent_id uuid,
+  p_signing_key_id uuid,
+  p_operation text,
+  p_payload_digest text,
+  p_nonce text default null,
+  p_idempotency_key text default null,
+  p_envelope_timestamp timestamptz default now(),
+  p_expires_at timestamptz default now() + interval '10 minutes'
+)
+returns table(replay_status text)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+begin
+  if (p_nonce is null and p_idempotency_key is null) or (p_nonce is not null and p_idempotency_key is not null) then
+    raise exception 'signed_write replay requires exactly one nonce or idempotency key' using errcode = '22023';
+  end if;
+
+  insert into agent_board.signature_replay_state(
+    agent_id,
+    signing_key_id,
+    operation,
+    payload_digest,
+    nonce,
+    idempotency_key,
+    envelope_timestamp,
+    expires_at,
+    replay_status
+  )
+  values (
+    p_agent_id,
+    p_signing_key_id,
+    p_operation,
+    p_payload_digest,
+    p_nonce,
+    p_idempotency_key,
+    p_envelope_timestamp,
+    p_expires_at,
+    'consumed'
+  );
+
+  return query select 'reserved'::text;
+exception
+  when unique_violation then
+    if p_idempotency_key is not null and exists (
+      select 1
+        from agent_board.signature_replay_state srs
+       where srs.agent_id = p_agent_id
+         and srs.operation = p_operation
+         and srs.idempotency_key = p_idempotency_key
+         and srs.payload_digest <> p_payload_digest
+    ) then
+      raise exception 'idempotency_conflict: signed write idempotency key reused with different payload digest' using errcode = '23505';
+    end if;
+    raise exception 'nonce_replay: signed write replay token already consumed' using errcode = '23505';
+end;
+$$;
+
+create or replace function agent_board._signed_write_actor_id(
+  p_payload jsonb,
+  p_gateway_decision jsonb,
+  p_actor_field text
+)
+returns uuid
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_actor uuid;
+begin
+  v_actor := nullif(p_gateway_decision ->> 'agent_id', '')::uuid;
+  if v_actor is null then
+    v_actor := nullif(p_payload ->> p_actor_field, '')::uuid;
+  end if;
+  if v_actor is null then
+    raise exception 'actor_mismatch: signed write actor is required' using errcode = '42501';
+  end if;
+  return v_actor;
+end;
+$$;
+
+create or replace function agent_board._record_signed_write_evidence(
+  p_source_kind text,
+  p_source_id uuid,
+  p_operation text,
+  p_payload jsonb,
+  p_gateway_decision jsonb
+)
+returns uuid
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_evidence_id uuid;
+  v_agent_id uuid := coalesce(nullif(p_gateway_decision ->> 'agent_id', '')::uuid, nullif(p_payload ->> 'p_author_agent_id', '')::uuid, nullif(p_payload ->> 'p_actor_agent_id', '')::uuid);
+  v_status text := coalesce(nullif(p_gateway_decision ->> 'verification_status', ''), 'unsigned');
+begin
+  if v_status not in ('unsigned', 'observed', 'warn', 'verified', 'failed') then
+    v_status := 'failed';
+  end if;
+
+  insert into agent_board.signature_evidence(
+    agent_id,
+    signing_key_id,
+    key_id,
+    key_version,
+    algorithm,
+    source_kind,
+    source_message_id,
+    source_task_event_id,
+    operation,
+    payload_digest,
+    canonicalization_version,
+    signature_digest,
+    verification_status,
+    failure_class,
+    signed_at,
+    verified_at,
+    nonce,
+    idempotency_key,
+    external_evidence_ref,
+    metadata
+  )
+  values (
+    v_agent_id,
+    nullif(p_gateway_decision ->> 'signing_key_id', '')::uuid,
+    nullif(p_gateway_decision ->> 'key_id', ''),
+    nullif(p_gateway_decision ->> 'key_version', '')::integer,
+    coalesce(nullif(p_gateway_decision ->> 'algorithm', ''), 'Ed25519'),
+    p_source_kind,
+    case when p_source_kind = 'message' then p_source_id else null end,
+    case when p_source_kind = 'task_event' then p_source_id else null end,
+    p_operation,
+    coalesce(nullif(p_gateway_decision ->> 'payload_digest', ''), 'sha256:unsigned'),
+    coalesce(nullif(p_gateway_decision ->> 'canonicalization_version', ''), 'agent-provenance-jcs.v1'),
+    nullif(p_gateway_decision ->> 'signature_digest', ''),
+    v_status,
+    nullif(p_gateway_decision ->> 'failure_class', ''),
+    nullif(p_gateway_decision ->> 'signed_at', '')::timestamptz,
+    nullif(p_gateway_decision ->> 'verified_at', '')::timestamptz,
+    nullif(p_gateway_decision ->> 'nonce', ''),
+    nullif(p_gateway_decision ->> 'idempotency_key', ''),
+    nullif(p_gateway_decision ->> 'external_evidence_ref', ''),
+    jsonb_build_object(
+      'gateway', 'signed-write',
+      'enforcementMode', coalesce(p_gateway_decision ->> 'enforcement_mode', 'observe'),
+      'redacted', true,
+      'metadata-safe', true
+    )
+  )
+  returning id into v_evidence_id;
+
+  update agent_board.signature_replay_state
+     set signature_evidence_id = v_evidence_id
+   where agent_id = v_agent_id
+     and operation = p_operation
+     and (
+       (nonce is not null and nonce = nullif(p_gateway_decision ->> 'nonce', ''))
+       or (idempotency_key is not null and idempotency_key = nullif(p_gateway_decision ->> 'idempotency_key', ''))
+     );
+
+  return v_evidence_id;
+end;
+$$;
+
+create or replace function agent_board.signed_send_direct_message(
+  p_payload jsonb,
+  p_gateway_decision jsonb
+)
+returns table(message_id uuid, delivery_recipient_id uuid, inbox_item_id uuid, callback_outbox_count integer, signature_evidence_id uuid, verification_status text, created_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_row record;
+  v_evidence_id uuid;
+  v_actor uuid;
+begin
+  v_actor := agent_board._signed_write_actor_id(p_payload, p_gateway_decision, 'p_author_agent_id');
+  select *
+    into v_row
+    from agent_board.send_direct_message(
+      (p_payload ->> 'p_thread_id')::uuid,
+      v_actor,
+      (p_payload ->> 'p_recipient_agent_id')::uuid,
+      p_payload ->> 'p_subject',
+      p_payload ->> 'p_body',
+      coalesce(p_payload ->> 'p_message_type', 'comment'),
+      coalesce(p_payload ->> 'p_priority', 'medium'),
+      nullif(p_payload ->> 'p_idempotency_key', ''),
+      coalesce(p_payload -> 'p_metadata', '{}'::jsonb) || jsonb_build_object('signed_write', jsonb_build_object('verification_status', coalesce(p_gateway_decision ->> 'verification_status', 'unsigned'), 'redacted', true))
+    );
+
+  v_evidence_id := agent_board._record_signed_write_evidence('message', v_row.message_id, 'send_direct_message', p_payload, p_gateway_decision);
+
+  return query
+  select v_row.message_id, v_row.delivery_recipient_id, v_row.inbox_item_id, v_row.callback_outbox_count, v_evidence_id, coalesce(p_gateway_decision ->> 'verification_status', 'unsigned'), v_row.created_at;
+end;
+$$;
+
+create or replace function agent_board.signed_append_task_event(
+  p_payload jsonb,
+  p_gateway_decision jsonb
+)
+returns table(task_id uuid, thread_id uuid, event_id uuid, event_sequence bigint, signature_evidence_id uuid, verification_status text, updated_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_row record;
+  v_evidence_id uuid;
+  v_actor uuid;
+begin
+  v_actor := agent_board._signed_write_actor_id(p_payload, p_gateway_decision, 'p_actor_agent_id');
+  select *
+    into v_row
+    from agent_board.append_task_event(
+      (p_payload ->> 'p_task_id')::uuid,
+      v_actor,
+      p_payload ->> 'p_event_type',
+      coalesce(p_payload -> 'p_payload', '{}'::jsonb) || jsonb_build_object('signed_write', jsonb_build_object('verification_status', coalesce(p_gateway_decision ->> 'verification_status', 'unsigned'), 'redacted', true)),
+      nullif(p_payload ->> 'p_status', ''),
+      nullif(p_payload ->> 'p_assigned_agent_id', '')::uuid,
+      nullif(p_payload ->> 'p_completed_at', '')::timestamptz
+    );
+
+  v_evidence_id := agent_board._record_signed_write_evidence('task_event', v_row.event_id, 'append_task_event', p_payload, p_gateway_decision);
+
+  return query
+  select v_row.task_id, v_row.thread_id, v_row.event_id, v_row.event_sequence, v_evidence_id, coalesce(p_gateway_decision ->> 'verification_status', 'unsigned'), v_row.updated_at;
+end;
+$$;
+
+create or replace function agent_board.signed_post_board_message(
+  p_payload jsonb,
+  p_gateway_decision jsonb
+)
+returns table(message_id uuid, board_id uuid, delivered_recipient_count integer, callback_outbox_count integer, signature_evidence_id uuid, verification_status text, created_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_row record;
+  v_evidence_id uuid;
+  v_actor uuid;
+begin
+  v_actor := agent_board._signed_write_actor_id(p_payload, p_gateway_decision, 'p_author_agent_id');
+  select *
+    into v_row
+    from agent_board.post_board_message(
+      (p_payload ->> 'p_thread_id')::uuid,
+      v_actor,
+      (p_payload ->> 'p_board_id')::uuid,
+      p_payload ->> 'p_subject',
+      p_payload ->> 'p_body',
+      coalesce(p_payload ->> 'p_message_type', 'comment'),
+      coalesce(p_payload ->> 'p_priority', 'medium'),
+      nullif(p_payload ->> 'p_idempotency_key', ''),
+      coalesce(p_payload -> 'p_metadata', '{}'::jsonb) || jsonb_build_object('signed_write', jsonb_build_object('verification_status', coalesce(p_gateway_decision ->> 'verification_status', 'unsigned'), 'redacted', true))
+    );
+
+  v_evidence_id := agent_board._record_signed_write_evidence('message', v_row.message_id, 'post_board_message', p_payload, p_gateway_decision);
+
+  return query
+  select v_row.message_id, v_row.board_id, v_row.delivered_recipient_count, v_row.callback_outbox_count, v_evidence_id, coalesce(p_gateway_decision ->> 'verification_status', 'unsigned'), v_row.created_at;
+end;
+$$;
+
+revoke all on function agent_board.reserve_signed_write_replay(uuid, uuid, text, text, text, text, timestamptz, timestamptz) from public, anon;
+revoke all on function agent_board.signed_send_direct_message(jsonb, jsonb) from public, anon;
+revoke all on function agent_board.signed_append_task_event(jsonb, jsonb) from public, anon;
+revoke all on function agent_board.signed_post_board_message(jsonb, jsonb) from public, anon;
+
+grant execute on function agent_board.reserve_signed_write_replay(uuid, uuid, text, text, text, text, timestamptz, timestamptz) to service_role;
+grant execute on function agent_board.signed_send_direct_message(jsonb, jsonb) to service_role;
+grant execute on function agent_board.signed_append_task_event(jsonb, jsonb) to service_role;
+grant execute on function agent_board.signed_post_board_message(jsonb, jsonb) to service_role;
+
+insert into agent_board.schema_version (version)
+values (5)
+on conflict ((true)) do update set version = excluded.version;