@consiliency/agent-board-schema 1.3.0 → 1.4.0

package/migrations/20260718000200_agent_board_send_role_gate.sql

@@ -0,0 +1,804 @@
+-- MBSENDAUTHZ SL-1 (Lane A): send-path board-role gate + service_role bypass telemetry.
+--
+-- Forward migration. Re-declares the four core send RPCs (bodies forward-copied
+-- verbatim from 20260512000002 except the enumerated additions) to:
+--   (i)  add the board-role observer-denied gate to the board-target sends via
+--        agent_board._current_agent_can_send_to_board (post_board_message always;
+--        create_tasking_delivery only when a board target is present), and
+--   (ii) record a service_role_bypass telemetry row (with the frozen ef|host|unknown
+--        origin discriminator, resolved from p_metadata -> 'signed_write' ->> 'origin')
+--        on every _is_service_role() send.
+--
+-- The restricted-thread ACL consult already fires via MBAUTHZ's
+-- _current_agent_can_access_thread and is NOT re-implemented here. Dormancy is
+-- preserved: all four cores stay revoked from authenticated (re-asserted below);
+-- the role gate bites only once MBSESSION re-grants sends to authenticated.
+
+-- 1. _current_agent_can_send_to_board (IF-0-MBSENDAUTHZ-1) -------------------
+-- Mirrors _current_agent_has_board_access but excludes the observer role: the only
+-- net-new send-path authz predicate.
+create or replace function agent_board._current_agent_can_send_to_board(
+  p_board_id uuid
+)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select
+    agent_board._is_service_role()
+    or exists (
+      select 1
+        from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.agent_id = agent_board.current_agent_id()
+         and bm.membership_state in ('joined', 'subscribed')
+         and bm.role <> 'observer'
+    )
+$$;
+
+comment on function agent_board._current_agent_can_send_to_board(uuid) is
+  'True iff the current agent may send to the board: service_role, or an active board member whose role is not observer. The net-new send-path authz predicate (restricted-thread ACL is inherited from _current_agent_can_access_thread).';
+
+revoke all on function agent_board._current_agent_can_send_to_board(uuid) from public, anon, authenticated;
+grant execute on function agent_board._current_agent_can_send_to_board(uuid) to service_role;
+
+-- 2. Re-declared core send RPCs (verbatim bodies + gate/telemetry additions) --
+create or replace function agent_board.send_direct_message(
+  p_thread_id uuid,
+  p_author_agent_id uuid,
+  p_recipient_agent_id uuid,
+  p_subject text,
+  p_body text,
+  p_message_type text default 'comment',
+  p_priority text default 'medium',
+  p_idempotency_key text default null,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(message_id uuid, delivery_recipient_id uuid, inbox_item_id uuid, callback_outbox_count integer, created_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_message agent_board.messages%rowtype;
+  v_created_message record;
+  v_recipient agent_board.delivery_recipients%rowtype;
+  v_inbox agent_board.inbox_items%rowtype;
+  v_callback_count integer := 0;
+  v_metadata jsonb;
+  v_preview text;
+  v_fetch_descriptor jsonb;
+  v_idempotency_key text := nullif(trim(p_idempotency_key), '');
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_author_agent_id, 'p_author_agent_id');
+
+  if nullif(trim(p_subject), '') is null or nullif(trim(p_body), '') is null then
+    raise exception 'subject and body are required' using errcode = '22023';
+  end if;
+  if p_priority not in ('low', 'medium', 'high', 'urgent') then
+    raise exception 'invalid priority' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  if not exists (select 1 from agent_board.agents where id = p_recipient_agent_id) then
+    raise exception 'recipient agent not found' using errcode = 'P0002';
+  end if;
+
+  if agent_board._is_service_role() then
+    perform agent_board._record_send_authz_telemetry(
+      'service_role_bypass',
+      coalesce(nullif(p_metadata -> 'signed_write' ->> 'origin', ''), 'unknown'),
+      v_actor_agent_id,
+      null,
+      'send_direct_message',
+      agent_board._resolve_send_fleet_scope(v_actor_agent_id),
+      null,
+      jsonb_build_object('redacted', true)
+    );
+  end if;
+
+  perform agent_board._lock_idempotency_key(
+    'send_direct_message:' || p_thread_id::text || ':' || v_actor_agent_id::text,
+    v_idempotency_key
+  );
+
+  if v_idempotency_key is not null then
+    select *
+      into v_message
+      from agent_board.messages
+     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+       and metadata ->> 'rpcName' = 'send_direct_message'
+       and metadata ->> 'idempotencyKey' = v_idempotency_key
+     order by created_at desc
+     limit 1;
+  end if;
+
+  if v_message.id is null then
+    v_metadata := coalesce(p_metadata, '{}'::jsonb)
+      || jsonb_build_object(
+        'rpcName', 'send_direct_message',
+        'subject', trim(p_subject),
+        'priority', p_priority
+      );
+    if v_idempotency_key is not null then
+      v_metadata := v_metadata || jsonb_build_object('idempotencyKey', v_idempotency_key);
+    end if;
+
+    select *
+      into v_created_message
+      from agent_board.post_message(
+        p_thread_id,
+        v_actor_agent_id,
+        p_body,
+        p_message_type,
+        null,
+        v_metadata
+      );
+
+    select *
+      into v_message
+      from agent_board.messages
+     where id = v_created_message.message_id;
+  end if;
+
+  v_preview := agent_board._trim_inbox_text(p_body, 280);
+  v_fetch_descriptor := agent_board._build_fetch_descriptor(
+    'thread',
+    p_thread_id,
+    'agent_board.v_thread_feed',
+    'direct delivery',
+    jsonb_build_object('messageId', v_message.id::text, 'recipientAgentId', p_recipient_agent_id::text)
+  );
+
+  v_recipient := agent_board._upsert_delivery_recipient(
+    'direct',
+    p_recipient_agent_id,
+    'message',
+    v_message.id,
+    null,
+    null,
+    null,
+    null,
+    jsonb_build_object('priority', p_priority)
+  );
+
+  v_inbox := agent_board._upsert_inbox_item(
+    v_recipient.id,
+    p_recipient_agent_id,
+    null,
+    v_recipient.delivery_mode,
+    'message',
+    v_message.id,
+    null,
+    null,
+    trim(p_subject),
+    v_preview,
+    p_priority,
+    true,
+    false,
+    v_fetch_descriptor,
+    jsonb_build_object('threadId', p_thread_id::text)
+  );
+
+  v_callback_count := agent_board._queue_inbox_callbacks(v_inbox.id, 'inbox.item.delivered');
+
+  return query
+  select v_message.id, v_recipient.id, v_inbox.id, v_callback_count, v_message.created_at;
+end;
+$$;
+
+create or replace function agent_board.send_multicast_message(
+  p_thread_id uuid,
+  p_author_agent_id uuid,
+  p_recipient_agent_ids uuid[],
+  p_subject text,
+  p_body text,
+  p_message_type text default 'comment',
+  p_priority text default 'medium',
+  p_idempotency_key text default null,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(message_id uuid, delivered_recipient_count integer, inbox_item_count integer, callback_outbox_count integer, created_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_message agent_board.messages%rowtype;
+  v_created_message record;
+  v_recipient_ids uuid[];
+  v_recipient_id uuid;
+  v_recipient agent_board.delivery_recipients%rowtype;
+  v_inbox agent_board.inbox_items%rowtype;
+  v_delivered_count integer := 0;
+  v_inbox_count integer := 0;
+  v_callback_count integer := 0;
+  v_metadata jsonb;
+  v_preview text;
+  v_fetch_descriptor jsonb;
+  v_idempotency_key text := nullif(trim(p_idempotency_key), '');
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_author_agent_id, 'p_author_agent_id');
+
+  if nullif(trim(p_subject), '') is null or nullif(trim(p_body), '') is null then
+    raise exception 'subject and body are required' using errcode = '22023';
+  end if;
+  if p_priority not in ('low', 'medium', 'high', 'urgent') then
+    raise exception 'invalid priority' using errcode = '22023';
+  end if;
+  if p_recipient_agent_ids is null or cardinality(p_recipient_agent_ids) = 0 then
+    raise exception 'recipient_agent_ids must not be empty' using errcode = '22023';
+  end if;
+  if array_position(p_recipient_agent_ids, null) is not null then
+    raise exception 'recipient_agent_ids must not contain nulls' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+
+  select array_agg(distinct recipient_id)
+    into v_recipient_ids
+    from unnest(p_recipient_agent_ids) as recipient_id;
+
+  if (
+    select count(*)
+      from agent_board.agents
+     where id = any(v_recipient_ids)
+  ) <> cardinality(v_recipient_ids) then
+    raise exception 'recipient agent not found' using errcode = 'P0002';
+  end if;
+
+  if agent_board._is_service_role() then
+    perform agent_board._record_send_authz_telemetry(
+      'service_role_bypass',
+      coalesce(nullif(p_metadata -> 'signed_write' ->> 'origin', ''), 'unknown'),
+      v_actor_agent_id,
+      null,
+      'send_multicast_message',
+      agent_board._resolve_send_fleet_scope(v_actor_agent_id),
+      null,
+      jsonb_build_object('redacted', true)
+    );
+  end if;
+
+  perform agent_board._lock_idempotency_key(
+    'send_multicast_message:' || p_thread_id::text || ':' || v_actor_agent_id::text,
+    v_idempotency_key
+  );
+
+  if v_idempotency_key is not null then
+    select *
+      into v_message
+      from agent_board.messages
+     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+       and metadata ->> 'rpcName' = 'send_multicast_message'
+       and metadata ->> 'idempotencyKey' = v_idempotency_key
+     order by created_at desc
+     limit 1;
+  end if;
+
+  if v_message.id is null then
+    v_metadata := coalesce(p_metadata, '{}'::jsonb)
+      || jsonb_build_object(
+        'rpcName', 'send_multicast_message',
+        'subject', trim(p_subject),
+        'priority', p_priority
+      );
+    if v_idempotency_key is not null then
+      v_metadata := v_metadata || jsonb_build_object('idempotencyKey', v_idempotency_key);
+    end if;
+
+    select *
+      into v_created_message
+      from agent_board.post_message(
+        p_thread_id,
+        v_actor_agent_id,
+        p_body,
+        p_message_type,
+        null,
+        v_metadata
+      );
+
+    select *
+      into v_message
+      from agent_board.messages
+     where id = v_created_message.message_id;
+  end if;
+
+  v_preview := agent_board._trim_inbox_text(p_body, 280);
+
+  foreach v_recipient_id in array v_recipient_ids loop
+    v_fetch_descriptor := agent_board._build_fetch_descriptor(
+      'thread',
+      p_thread_id,
+      'agent_board.v_thread_feed',
+      'multicast delivery',
+      jsonb_build_object('messageId', v_message.id::text, 'recipientAgentId', v_recipient_id::text)
+    );
+
+    v_recipient := agent_board._upsert_delivery_recipient(
+      'multicast',
+      v_recipient_id,
+      'message',
+      v_message.id,
+      null,
+      null,
+      null,
+      null,
+      jsonb_build_object('priority', p_priority)
+    );
+
+    v_inbox := agent_board._upsert_inbox_item(
+      v_recipient.id,
+      v_recipient_id,
+      null,
+      v_recipient.delivery_mode,
+      'message',
+      v_message.id,
+      null,
+      null,
+      trim(p_subject),
+      v_preview,
+      p_priority,
+      true,
+      false,
+      v_fetch_descriptor,
+      jsonb_build_object('threadId', p_thread_id::text)
+    );
+
+    v_delivered_count := v_delivered_count + 1;
+    v_inbox_count := v_inbox_count + 1;
+    v_callback_count := v_callback_count + agent_board._queue_inbox_callbacks(v_inbox.id, 'inbox.item.delivered');
+  end loop;
+
+  return query
+  select v_message.id, v_delivered_count, v_inbox_count, v_callback_count, v_message.created_at;
+end;
+$$;
+
+create or replace function agent_board.post_board_message(
+  p_thread_id uuid,
+  p_author_agent_id uuid,
+  p_board_id uuid,
+  p_subject text,
+  p_body text,
+  p_message_type text default 'comment',
+  p_priority text default 'medium',
+  p_idempotency_key text default null,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(message_id uuid, board_id uuid, delivered_recipient_count integer, callback_outbox_count integer, created_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_message agent_board.messages%rowtype;
+  v_created_message record;
+  v_membership record;
+  v_recipient agent_board.delivery_recipients%rowtype;
+  v_inbox agent_board.inbox_items%rowtype;
+  v_delivered_count integer := 0;
+  v_callback_count integer := 0;
+  v_metadata jsonb;
+  v_preview text;
+  v_fetch_descriptor jsonb;
+  v_idempotency_key text := nullif(trim(p_idempotency_key), '');
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_author_agent_id, 'p_author_agent_id');
+
+  if nullif(trim(p_subject), '') is null or nullif(trim(p_body), '') is null then
+    raise exception 'subject and body are required' using errcode = '22023';
+  end if;
+  if p_priority not in ('low', 'medium', 'high', 'urgent') then
+    raise exception 'invalid priority' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not exists (select 1 from agent_board.boards where id = p_board_id) then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  if not agent_board._current_agent_has_board_access(p_board_id) then
+    raise exception 'board not accessible to current agent' using errcode = '42501';
+  end if;
+  if not agent_board._current_agent_can_send_to_board(p_board_id) then
+    raise exception 'board send requires a non-observer board role' using errcode = '42501';
+  end if;
+
+  if agent_board._is_service_role() then
+    perform agent_board._record_send_authz_telemetry(
+      'service_role_bypass',
+      coalesce(nullif(p_metadata -> 'signed_write' ->> 'origin', ''), 'unknown'),
+      v_actor_agent_id,
+      p_board_id,
+      'post_board_message',
+      agent_board._resolve_send_fleet_scope(v_actor_agent_id),
+      null,
+      jsonb_build_object('redacted', true)
+    );
+  end if;
+
+  perform agent_board._lock_idempotency_key(
+    'post_board_message:' || p_thread_id::text || ':' || v_actor_agent_id::text || ':' || p_board_id::text,
+    v_idempotency_key
+  );
+
+  if v_idempotency_key is not null then
+    select *
+      into v_message
+      from agent_board.messages
+     where thread_id = p_thread_id
+       and author_agent_id = v_actor_agent_id
+       and metadata ->> 'rpcName' = 'post_board_message'
+       and metadata ->> 'idempotencyKey' = v_idempotency_key
+     order by created_at desc
+     limit 1;
+  end if;
+
+  if v_message.id is null then
+    v_metadata := coalesce(p_metadata, '{}'::jsonb)
+      || jsonb_build_object(
+        'rpcName', 'post_board_message',
+        'subject', trim(p_subject),
+        'priority', p_priority,
+        'boardId', p_board_id::text
+      );
+    if v_idempotency_key is not null then
+      v_metadata := v_metadata || jsonb_build_object('idempotencyKey', v_idempotency_key);
+    end if;
+
+    select *
+      into v_created_message
+      from agent_board.post_message(
+        p_thread_id,
+        v_actor_agent_id,
+        p_body,
+        p_message_type,
+        null,
+        v_metadata
+      );
+
+    select *
+      into v_message
+      from agent_board.messages
+     where id = v_created_message.message_id;
+  end if;
+
+  v_preview := agent_board._trim_inbox_text(p_body, 280);
+  v_fetch_descriptor := agent_board._build_fetch_descriptor(
+    'board',
+    p_board_id,
+    'agent_board.v_board_feed',
+    'board delivery',
+    jsonb_build_object('messageId', v_message.id::text)
+  );
+
+  for v_membership in
+    select bm.id, bm.agent_id
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.membership_state in ('joined', 'subscribed')
+     order by bm.created_at
+  loop
+    v_recipient := agent_board._upsert_delivery_recipient(
+      'board',
+      v_membership.agent_id,
+      'message',
+      v_message.id,
+      null,
+      null,
+      p_board_id,
+      v_membership.id,
+      jsonb_build_object('priority', p_priority)
+    );
+
+    v_inbox := agent_board._upsert_inbox_item(
+      v_recipient.id,
+      v_membership.agent_id,
+      p_board_id,
+      v_recipient.delivery_mode,
+      'message',
+      v_message.id,
+      null,
+      null,
+      trim(p_subject),
+      v_preview,
+      p_priority,
+      true,
+      true,
+      v_fetch_descriptor,
+      jsonb_build_object('threadId', p_thread_id::text, 'boardId', p_board_id::text)
+    );
+
+    v_delivered_count := v_delivered_count + 1;
+    v_callback_count := v_callback_count + agent_board._queue_inbox_callbacks(v_inbox.id, 'inbox.item.delivered');
+  end loop;
+
+  v_callback_count := v_callback_count + agent_board._queue_board_post_callbacks(
+    p_board_id,
+    v_message.id,
+    trim(p_subject),
+    v_preview,
+    p_priority,
+    v_fetch_descriptor
+  );
+
+  return query
+  select v_message.id, p_board_id, v_delivered_count, v_callback_count, v_message.created_at;
+end;
+$$;
+
+create or replace function agent_board.create_tasking_delivery(
+  p_thread_id uuid,
+  p_created_by_agent_id uuid,
+  p_title text,
+  p_details text default null,
+  p_recipient_agent_ids uuid[] default null,
+  p_board_id uuid default null,
+  p_priority text default 'medium',
+  p_orchestration_mode text default 'distributed',
+  p_idempotency_key text default null,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(task_id uuid, created_event_id uuid, delivered_recipient_count integer, inbox_item_count integer, callback_outbox_count integer, created_at timestamptz, updated_at timestamptz)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_task agent_board.tasks%rowtype;
+  v_created_event_id uuid;
+  v_created_task record;
+  v_recipient_ids uuid[];
+  v_recipient_id uuid;
+  v_membership record;
+  v_recipient agent_board.delivery_recipients%rowtype;
+  v_inbox agent_board.inbox_items%rowtype;
+  v_delivered_count integer := 0;
+  v_inbox_count integer := 0;
+  v_callback_count integer := 0;
+  v_metadata jsonb;
+  v_preview text;
+  v_fetch_descriptor jsonb;
+  v_idempotency_key text := nullif(trim(p_idempotency_key), '');
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_created_by_agent_id, 'p_created_by_agent_id');
+
+  if nullif(trim(p_title), '') is null then
+    raise exception 'task title is required' using errcode = '22023';
+  end if;
+  if p_priority not in ('low', 'medium', 'high', 'urgent') then
+    raise exception 'invalid priority' using errcode = '22023';
+  end if;
+  if p_orchestration_mode not in ('distributed', 'hierarchical', 'hybrid') then
+    raise exception 'invalid orchestration mode' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  if (p_recipient_agent_ids is null or cardinality(p_recipient_agent_ids) = 0) and p_board_id is null then
+    raise exception 'tasking delivery requires explicit recipients or a board target' using errcode = '22023';
+  end if;
+  if p_recipient_agent_ids is not null and array_position(p_recipient_agent_ids, null) is not null then
+    raise exception 'recipient_agent_ids must not contain nulls' using errcode = '22023';
+  end if;
+  if p_board_id is not null then
+    if not exists (select 1 from agent_board.boards where id = p_board_id) then
+      raise exception 'board not found' using errcode = 'P0002';
+    end if;
+    if not agent_board._current_agent_has_board_access(p_board_id) then
+      raise exception 'board not accessible to current agent' using errcode = '42501';
+    end if;
+    if not agent_board._current_agent_can_send_to_board(p_board_id) then
+      raise exception 'board send requires a non-observer board role' using errcode = '42501';
+    end if;
+  end if;
+
+  select array_agg(distinct recipient_id)
+    into v_recipient_ids
+    from unnest(coalesce(p_recipient_agent_ids, '{}'::uuid[])) as recipient_id;
+
+  if v_recipient_ids is not null and (
+    select count(*)
+      from agent_board.agents
+     where id = any(v_recipient_ids)
+  ) <> cardinality(v_recipient_ids) then
+    raise exception 'recipient agent not found' using errcode = 'P0002';
+  end if;
+
+  if agent_board._is_service_role() then
+    perform agent_board._record_send_authz_telemetry(
+      'service_role_bypass',
+      coalesce(nullif(p_metadata -> 'signed_write' ->> 'origin', ''), 'unknown'),
+      v_actor_agent_id,
+      p_board_id,
+      'create_tasking_delivery',
+      agent_board._resolve_send_fleet_scope(v_actor_agent_id),
+      null,
+      jsonb_build_object('redacted', true)
+    );
+  end if;
+
+  perform agent_board._lock_idempotency_key(
+    'create_tasking_delivery:' || p_thread_id::text || ':' || v_actor_agent_id::text,
+    v_idempotency_key
+  );
+
+  if v_idempotency_key is not null then
+    select *
+      into v_task
+      from agent_board.tasks
+     where thread_id = p_thread_id
+       and created_by_agent_id = v_actor_agent_id
+       and metadata ->> 'rpcName' = 'create_tasking_delivery'
+       and metadata ->> 'idempotencyKey' = v_idempotency_key
+     order by created_at desc
+     limit 1;
+  end if;
+
+  if v_task.id is null then
+    v_metadata := coalesce(p_metadata, '{}'::jsonb)
+      || jsonb_build_object(
+        'rpcName', 'create_tasking_delivery',
+        'priority', p_priority
+      );
+    if p_board_id is not null then
+      v_metadata := v_metadata || jsonb_build_object('boardId', p_board_id::text);
+    end if;
+    if v_idempotency_key is not null then
+      v_metadata := v_metadata || jsonb_build_object('idempotencyKey', v_idempotency_key);
+    end if;
+
+    select *
+      into v_created_task
+      from agent_board.create_task(
+        p_thread_id,
+        v_actor_agent_id,
+        trim(p_title),
+        p_details,
+        null,
+        null,
+        p_priority,
+        p_orchestration_mode,
+        v_metadata
+      );
+
+    v_created_event_id := v_created_task.created_event_id;
+
+    select *
+      into v_task
+      from agent_board.tasks
+     where id = v_created_task.task_id;
+  else
+    select te.id
+      into v_created_event_id
+      from agent_board.task_events te
+     where te.task_id = v_task.id
+       and te.event_sequence = 1;
+  end if;
+
+  v_preview := agent_board._trim_inbox_text(coalesce(p_details, p_title), 280);
+  v_fetch_descriptor := agent_board._build_fetch_descriptor(
+    'task',
+    v_task.id,
+    'agent_board.v_task_tree',
+    'tasking delivery',
+    jsonb_build_object('threadId', p_thread_id::text)
+  );
+
+  if v_recipient_ids is not null then
+    foreach v_recipient_id in array v_recipient_ids loop
+      v_recipient := agent_board._upsert_delivery_recipient(
+        'tasking',
+        v_recipient_id,
+        'task',
+        null,
+        v_task.id,
+        null,
+        null,
+        null,
+        jsonb_build_object('priority', p_priority)
+      );
+
+      v_inbox := agent_board._upsert_inbox_item(
+        v_recipient.id,
+        v_recipient_id,
+        null,
+        v_recipient.delivery_mode,
+        'task',
+        null,
+        v_task.id,
+        null,
+        trim(p_title),
+        v_preview,
+        p_priority,
+        true,
+        false,
+        v_fetch_descriptor,
+        jsonb_build_object('threadId', p_thread_id::text)
+      );
+
+      v_delivered_count := v_delivered_count + 1;
+      v_inbox_count := v_inbox_count + 1;
+      v_callback_count := v_callback_count + agent_board._queue_inbox_callbacks(v_inbox.id, 'inbox.item.delivered');
+    end loop;
+  end if;
+
+  if p_board_id is not null then
+    for v_membership in
+      select bm.id, bm.agent_id
+        from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.membership_state in ('joined', 'subscribed')
+       order by bm.created_at
+    loop
+      v_recipient := agent_board._upsert_delivery_recipient(
+        'tasking',
+        v_membership.agent_id,
+        'task',
+        null,
+        v_task.id,
+        null,
+        p_board_id,
+        v_membership.id,
+        jsonb_build_object('priority', p_priority)
+      );
+
+      v_inbox := agent_board._upsert_inbox_item(
+        v_recipient.id,
+        v_membership.agent_id,
+        v_recipient.board_id,
+        v_recipient.delivery_mode,
+        'task',
+        null,
+        v_task.id,
+        null,
+        trim(p_title),
+        v_preview,
+        p_priority,
+        true,
+        v_recipient.board_id is not null,
+        v_fetch_descriptor,
+        jsonb_build_object('threadId', p_thread_id::text, 'boardId', p_board_id::text)
+      );
+
+      v_delivered_count := v_delivered_count + 1;
+      v_inbox_count := v_inbox_count + 1;
+      v_callback_count := v_callback_count + agent_board._queue_inbox_callbacks(v_inbox.id, 'inbox.item.delivered');
+    end loop;
+  end if;
+
+  return query
+  select v_task.id, v_created_event_id, v_delivered_count, v_inbox_count, v_callback_count, v_task.created_at, v_task.updated_at;
+end;
+$$;
+
+-- 3. Re-assert dormancy grants: all four core send RPCs stay revoked from
+--    authenticated (mirrors 20260711000100:224-231). create or replace preserves
+--    grants, but re-assert so a fresh replay is order-independent.
+revoke execute on function agent_board.send_direct_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.send_multicast_message(uuid, uuid, uuid[], text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.post_board_message(uuid, uuid, uuid, text, text, text, text, text, jsonb) from authenticated;
+revoke execute on function agent_board.create_tasking_delivery(uuid, uuid, text, text, uuid[], uuid, text, text, text, jsonb) from authenticated;