@consiliency/agent-board-schema 1.40.0 → 1.41.0

package/migrations/20260921000100_agent_board_task_event_origin_posture.sql

@@ -0,0 +1,881 @@
+-- #288 — task_events.origin_posture: make "how was this row written" a fact, not a blank.
+--
+-- THE DEFECT. v_task_tree.verification_status laterals the task's latest task_events row and
+-- then laterals signature_evidence onto it. Only a writer calling
+-- _record_signed_write_evidence('task_event', …) populates it, so every other writer leaves it
+-- NULL permanently. NULL is indistinguishable from "evidence was lost", "the writer forgot",
+-- and "unsigned on purpose" — three very different facts wearing one blank.
+--
+-- THE CLASS, from the catalog rather than from a list anyone wrote. Membership rule:
+--
+--     a function is a member iff its CALL CLOSURE reaches an INSERT INTO agent_board.task_events
+--
+-- with literals and comments stripped (agent_board_test.stripped_body defaults
+-- p_keep_literals=false), so naming the table in prose is not membership. Twelve members,
+-- of which two record evidence:
+--
+--   depth 0  append_task_event, create_task (direct insert)
+--   depth 1  acquire_claim, add_artifact, create_tasking_delivery (×2 overloads),
+--            delegate_task, raise_conflict, raise_escalation, resolve_conflict,
+--            resolve_escalation, signed_append_task_event [evidence]
+--   depth 2  signed_create_tasking_delivery [evidence]
+--
+-- The issue body said 8 and its own triage comment said 5–6. BOTH were wrong, in opposite
+-- directions, and neither named create_tasking_delivery or signed_create_tasking_delivery.
+-- The body used a prosrc grep, blind to multi-hop reach (#310's recorded trap); the comment
+-- used pg_get_functiondef ilike '%task_events%', which matches comments and literals and
+-- never walks the call graph. This is rule 1 catching two hand-written lists in one issue.
+--
+-- WHY A STAMP AND NOT THE TWO OBVIOUS ALTERNATIVES.
+--   * Propagating the parent's evidence id CANNOT be complete: the four unsigned-deliberate
+--     writers and create_task's direct insert have no parent evidence to propagate.
+--   * Minting a signature_evidence row per derived event would FABRICATE evidence.
+--     payload_digest and operation are NOT NULL, and for an unsigned derived event there is no
+--     signed payload to digest. That is #317's shape, where emitting a row's own state minted
+--     an attestation worse than the blank it replaced. Separately, verification_status
+--     'unsigned' sits in the column's CHECK but is defined NOWHERE in
+--     specs/agent-provenance-signing.md; that spec defines 'observed'/'warn' as GATEWAY
+--     enforcement-mode artifacts, so stamping either from an RPC that never passes the gateway
+--     would misuse the vocabulary.
+--
+-- HARD RULE. A derived event's verification_status must never read 'verified', and the
+-- writer's posture lands in a DISTINCT column — so no gate written against the evidence
+-- vocabulary can ever be satisfied by a stamped value. The two columns answer different
+-- questions and are not merged.
+--
+-- WHAT COMPLETENESS THIS BUYS — two layers, and calling the second one structural would be
+-- the overclaim this paragraph exists to prevent:
+--   * STRUCTURAL: origin_posture is NOT NULL with NO DEFAULT. A future writer that opens a new
+--     DIRECT INSERT path (the shape create_task already has) cannot insert a row at all.
+--   * NAMED, NOT STRUCTURAL: a future writer that goes through the funnel and omits the
+--     argument gets the funnel's declared default rather than an error. No SQL construct
+--     prevents that — a caller can always route through a defaulting wrapper. A catalog-derived
+--     pgTAP assertion enumerates the closure and NAMES any member not passing an explicit
+--     posture. Each layer covers what the other cannot.
+--
+-- NOTHING IS DROPPED. DROP FUNCTION discards the ACL and the COMMENT, and recreating a
+-- SECURITY DEFINER function grants EXECUTE to PUBLIC by default — which opened a real gate
+-- bypass in this repo's history. append_task_event and create_task are both SECURITY DEFINER,
+-- granted to authenticated, and carry OBSGATE gating in their bodies, so BOTH PUBLIC
+-- SIGNATURES STAY BYTE-IDENTICAL and every recreation here is a CREATE OR REPLACE that
+-- preserves ACL and COMMENT.
+
+-- 1. The column. Added nullable, backfilled, then constrained — the only order that works on
+--    a table with existing rows.
+alter table agent_board.task_events add column if not exists origin_posture text;
+
+-- 'unattested:preexisting' is deliberately NOT a guess. The writer of a pre-migration row is unknowable;
+-- back-dating a plausible posture onto it would be this same defect pointing the other way.
+update agent_board.task_events set origin_posture = 'unattested:preexisting' where origin_posture is null;
+
+alter table agent_board.task_events alter column origin_posture set not null;
+
+-- NO DEFAULT is load-bearing, not an omission: a column default would silently satisfy a new
+-- direct-INSERT writer and re-open exactly the hole this migration closes. Mutation M2 pins it.
+alter table agent_board.task_events alter column origin_posture drop default;
+
+alter table agent_board.task_events drop constraint if exists task_events_origin_posture_check;
+alter table agent_board.task_events add constraint task_events_origin_posture_check
+  check (origin_posture in (
+    'attested:evidence-row',         -- the writer records a signature_evidence row for THIS event
+    'unattested:signed-metadata-rpc',      -- the entry-point RPC accepts client-signed p_metadata
+    'unattested:unsigned-deliberate-rpc',  -- adjudicated unsigned in #261 step 2
+    'unattested:direct-rpc',           -- public append_task_event called directly; caller declared nothing
+    'unattested:preexisting'           -- backfilled; the writer of this row is unknowable
+  ));
+
+comment on column agent_board.task_events.origin_posture is
+  '#288: how this row was written. Every value declares its ATTESTATION STATE FIRST, so `origin_posture like ''unattested:%''` is a correct safety predicate and no value can be misread as a signature claim. DISTINCT from the verification_status that v_task_tree laterals off signature_evidence — a posture is a fact about the WRITER. Never fold the two together (mutation M8).';
+
+-- WHY THE VALUES LEAD WITH attested:/unattested: RATHER THAN MIRRORING RPC_PROVENANCE_POSTURE
+-- VERBATIM. The first draft used that catalog's own strings, so an UNSIGNED create_task write
+-- was stamped 'signed-metadata'. That is TRUE about the RPC (it accepts client-signed
+-- p_metadata) and dangerously misleading about the ROW (nobody signed this one). Two
+-- independent reviewers read it as a possible attestation claim, and a third measurement
+-- settled it: the column is ALREADY on a consumer surface — AgentBoardClient.taskTree reads
+-- v_task_tree with select("*") and the MCP task-tree tool returns that result directly — so
+-- "client surfacing is a follow-up" was false when it was written. A value a consumer can
+-- misread as a signature is #317's failure shape, where emitting a row's own state minted an
+-- attestation worse than the blank it replaced. The prefix makes the misreading IMPOSSIBLE
+-- rather than warning against it in a comment nobody queries.
+
+-- 2. The writers.
+CREATE OR REPLACE FUNCTION agent_board._append_task_event(p_origin_posture text, p_task_id uuid, p_actor_agent_id uuid, p_event_type text, p_payload jsonb DEFAULT '{}'::jsonb, p_status text DEFAULT NULL::text, p_assigned_agent_id uuid DEFAULT NULL::uuid, p_completed_at timestamp with time zone DEFAULT NULL::timestamp with time zone)
+ RETURNS TABLE(task_id uuid, thread_id uuid, event_id uuid, event_sequence bigint, task_status text, assigned_agent_id uuid, updated_at timestamp with time zone, completed_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_thread_id uuid;
+  v_locked_thread_id uuid;
+  v_sequence bigint;
+  v_event_id uuid;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_actor_agent_id, 'p_actor_agent_id');
+
+  select tasks.thread_id into v_thread_id from agent_board.tasks where id = p_task_id;
+  if v_thread_id is null then
+    raise exception 'task not found' using errcode = 'P0002';
+  end if;
+
+  perform 1 from agent_board.threads th where th.id = v_thread_id for key share;
+
+  select tasks.thread_id into v_locked_thread_id from agent_board.tasks where id = p_task_id for update;
+  if v_locked_thread_id is null then
+    raise exception 'task not found' using errcode = 'P0002';
+  end if;
+  if v_locked_thread_id is distinct from v_thread_id then
+    raise exception 'task thread changed while acquiring locks' using errcode = '40001';
+  end if;
+
+  if not agent_board._current_agent_can_access_task(p_task_id) then
+    raise exception 'task not accessible to current agent' using errcode = '42501';
+  end if;
+  if not agent_board._current_agent_can_mutate_task(p_task_id) then
+    raise exception 'task mutation requires a non-observer board role, or task assignment/creation'
+      using errcode = '42501';
+  end if;
+
+  select coalesce(max(te.event_sequence), 0) + 1 into v_sequence from agent_board.task_events te where te.task_id = p_task_id;
+  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload, origin_posture)
+  values (p_task_id, v_thread_id, v_actor_agent_id, v_sequence, p_event_type, coalesce(p_payload, '{}'::jsonb), p_origin_posture)
+  returning id into v_event_id;
+
+  update agent_board.tasks
+     set status = coalesce(p_status, tasks.status),
+         assigned_agent_id = coalesce(p_assigned_agent_id, tasks.assigned_agent_id),
+         completed_at = coalesce(p_completed_at, tasks.completed_at),
+         updated_at = now()
+   where id = p_task_id;
+
+  return query
+  select t.id, t.thread_id, v_event_id, v_sequence, t.status, t.assigned_agent_id, t.updated_at, t.completed_at
+    from agent_board.tasks t
+   where t.id = p_task_id;
+end;
+$function$;
+
+
+CREATE OR REPLACE FUNCTION agent_board.create_task(p_thread_id uuid, p_created_by_agent_id uuid, p_title text, p_details text DEFAULT NULL::text, p_assigned_agent_id uuid DEFAULT NULL::uuid, p_parent_task_id uuid DEFAULT NULL::uuid, p_priority text DEFAULT 'medium'::text, p_orchestration_mode text DEFAULT 'distributed'::text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(task_id uuid, parent_task_id uuid, root_task_id uuid, created_event_id uuid, created_event_sequence bigint, status text, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_task_id uuid;
+  v_root_task_id uuid;
+  v_event_id uuid;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_created_by_agent_id, 'p_created_by_agent_id');
+
+  if nullif(trim(p_title), '') is null then
+    raise exception 'task title is required' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.threads where id = p_thread_id) then
+    raise exception 'thread not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  -- OBSGATE-2 (#123): a board-linked thread requires a non-observer board role to author.
+  if not agent_board._current_agent_can_post_to_thread(p_thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+  if p_assigned_agent_id is not null and not exists (select 1 from agent_board.agents where id = p_assigned_agent_id) then
+    raise exception 'assigned agent not found' using errcode = 'P0002';
+  end if;
+
+  if p_parent_task_id is not null then
+    select coalesce(tasks.root_task_id, tasks.id)
+      into v_root_task_id
+      from agent_board.tasks
+     where id = p_parent_task_id and tasks.thread_id = p_thread_id;
+    if v_root_task_id is null then
+      raise exception 'parent task not found in thread' using errcode = '22023';
+    end if;
+    if not agent_board._current_agent_can_access_task(p_parent_task_id) then
+      raise exception 'parent task not accessible to current agent' using errcode = '42501';
+    end if;
+  end if;
+
+  v_task_id := gen_random_uuid();
+  if p_parent_task_id is null then
+    v_root_task_id := v_task_id;
+  end if;
+
+  insert into agent_board.tasks(id, thread_id, created_by_agent_id, assigned_agent_id, parent_task_id, root_task_id, title, details, priority, orchestration_mode, metadata)
+  values (v_task_id, p_thread_id, v_actor_agent_id, p_assigned_agent_id, p_parent_task_id, v_root_task_id, trim(p_title), p_details, coalesce(p_priority, 'medium'), coalesce(p_orchestration_mode, 'distributed'), coalesce(p_metadata, '{}'::jsonb));
+
+  -- #288: create_task is the ONE writer that inserts into task_events directly rather than
+  -- through the funnel, which is why a fix instrumenting only append_task_event's callers
+  -- would miss it. Its own declared posture is signed-metadata (it declares p_metadata and the
+  -- client signs it). No parameter is threaded here deliberately -- see the plan's section 5:
+  -- where a signed wrapper is involved (signed_create_tasking_delivery keys its evidence to
+  -- THIS event, two levels up), a real signature_evidence row exists and v_task_tree already
+  -- surfaces it, which is the stronger signal. A threaded parameter would change no answer.
+  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload, origin_posture)
+  values (v_task_id, p_thread_id, v_actor_agent_id, 1, 'created', jsonb_build_object('title', trim(p_title)), 'unattested:signed-metadata-rpc')
+  returning id into v_event_id;
+
+  return query
+  select t.id, t.parent_task_id, t.root_task_id, v_event_id, 1::bigint, t.status, t.created_at, t.updated_at
+    from agent_board.tasks t
+   where t.id = v_task_id;
+end;
+$function$;
+
+
+CREATE OR REPLACE FUNCTION agent_board.acquire_claim(p_agent_id uuid, p_resource_kind text, p_resource_key text, p_lease_expires_at timestamp with time zone, p_task_id uuid DEFAULT NULL::uuid, p_thread_id uuid DEFAULT NULL::uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(claim_id uuid, task_id uuid, thread_id uuid, agent_id uuid, resource_kind text, resource_key text, status text, lease_token uuid, lease_expires_at timestamp with time zone, released_at timestamp with time zone, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_thread_id uuid;
+  v_claim_id uuid;
+  v_actor_agent_id uuid;
+  v_shadow_authorized boolean;
+  v_ownerless boolean;
+  v_active_ownerless int;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_agent_id, 'p_agent_id');
+
+  if nullif(trim(p_resource_key), '') is null then
+    raise exception 'resource key is required' using errcode = '22023';
+  end if;
+
+  -- CLAIMKEY (#133): normalize the resource key to its canonical, fleet-fingerprint-carrying
+  -- form BEFORE any lookup/insert, so the row stored (and the uniqueness index contended)
+  -- carry canonical identity. NORMALIZE-ONLY — this never rejects (rejection is ENFORCE).
+  p_resource_key := agent_board._canonical_claim_key(p_resource_kind, p_resource_key);
+
+  if p_task_id is not null then
+    select tasks.thread_id into v_thread_id from agent_board.tasks where id = p_task_id;
+    if v_thread_id is null then
+      raise exception 'task not found' using errcode = 'P0002';
+    end if;
+    if not agent_board._current_agent_can_access_task(p_task_id) then
+      raise exception 'task not accessible to current agent' using errcode = '42501';
+    end if;
+  else
+    v_thread_id := p_thread_id;
+  end if;
+
+  if v_thread_id is not null and not agent_board._current_agent_can_access_thread(v_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+
+  -- message-board#291: the SUBJECT gate. The checks above answer "may this SESSION touch the
+  -- task/thread" and are short-circuited true for service_role; this one answers "does the
+  -- agent the claim is ABOUT already have access". Without it a service_role caller could name
+  -- any agent, and the resulting claims row -- itself an access disjunct, and a PERMANENT one
+  -- -- would MINT thread access (and, through the thread disjunct of
+  -- _current_agent_can_access_task, task access) rather than record a lock on something the
+  -- subject could already see.
+  --
+  -- UNCONDITIONAL IN *WHO*. DO NOT "optimize" this into `if _is_service_role() and not ...` or
+  -- `if v_actor_agent_id is distinct from agent_board.current_agent_id()`. For an authenticated
+  -- caller v_actor_agent_id IS current_agent_id() and the session check above already
+  -- established this same expression, so the redundancy is PROVABLE rather than suspected; it
+  -- is the price of an invariant this function states for itself instead of borrowing from
+  -- _resolved_actor_agent_id continuing to raise on a subject mismatch.
+  --
+  -- CONDITIONAL ON *THREAD PRESENCE*, which is not a loophole. A claim bound to neither a task
+  -- nor a thread stores thread_id = null, is a disjunct of nothing and mints no access.
+  -- _agent_can_access_thread answers false for a null thread, so gating unconditionally would
+  -- refuse every machine / repository / repo_file / ownerless claim in the fleet. This covers
+  -- exactly the claims that are keys.
+  --
+  -- PLACED AFTER THE TASK LOOKUP so a nonexistent task still answers P0002, not 42501 -- that
+  -- ordering IS test-pinned. Placed BEFORE the sweep only to match the predicate-before-side-
+  -- effects convention CLAIMGATE/ENFORCE states below; it is NOT what makes a denial free of
+  -- side effects. `raise exception` unwinds the whole call, so a refused caller changes no state
+  -- wherever this sits -- measured, by moving the gate below the sweep and observing the test
+  -- file stay entirely green.
+  if v_thread_id is not null
+     and not agent_board._agent_can_access_thread(v_thread_id, v_actor_agent_id) then
+    raise exception 'claim subject has no access to thread' using errcode = '42501';
+  end if;
+
+  -- OBSGATE-4 (#127): a claim on a TASK resource is authorized on the LOCKED task = the task
+  -- named by RESOURCE_KEY (resource_kind='task'). The active-resource uniqueness is on
+  -- (resource_kind, resource_key), so that is the task a squat contends for — gating resource_key
+  -- (NOT p_task_id, which only associates the claim/event) prevents locking task B's key while
+  -- authorizing on an unrelated task A passed as p_task_id. A non-uuid 'task' key cannot collide
+  -- with a uuid-keyed legitimate claim.
+  --
+  -- The composition MIRRORS append_task_event's: ACCESS then MUTATE. mutate alone is
+  -- insufficient — _current_agent_can_mutate_task admits any non-observer board member via
+  -- _current_agent_can_post_to_thread (board send-role), which is NOT thread access; on a
+  -- RESTRICTED thread a board member lacking thread access would pass mutate but must still be
+  -- denied (they cannot access the task). Requiring access too closes that gap and matches the
+  -- authorization a task-BOUND acquire already gets through append_task_event.
+  if p_resource_kind = 'task'
+     and p_resource_key ~ '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$' then
+    if not agent_board._current_agent_can_access_task(p_resource_key::uuid) then
+      raise exception 'task not accessible to current agent' using errcode = '42501';
+    end if;
+    if not agent_board._current_agent_can_mutate_task(p_resource_key::uuid) then
+      raise exception 'claiming a task resource requires a non-observer board role, or task assignment/creation'
+        using errcode = '42501';
+    end if;
+  end if;
+
+  -- CLAIMGATE/SHADOW (#133): compute the fleet-graph authority verdict BEFORE the sweep (so
+  -- ENFORCE can flip this same point fail-closed with no observable side effect leaking to an
+  -- unauthorized caller). The verdict is stamped below regardless of enforcement.
+  v_shadow_authorized := agent_board._can_claim_resource(p_resource_kind, p_resource_key);
+
+  -- CLAIMGATE/ENFORCE (#133): per-kind GATED DENIAL, BEFORE the sweep (predicate-before-side-
+  -- effects). When this fleet-backed kind's flag is ON and the actor is UNAUTHORIZED, DENY —
+  -- no state has changed yet (sweep/insert are below). When OFF, fall through to the shadow-
+  -- stamp only (SHADOW behavior; blocks nothing). Non-fleet kinds never kind-enforce (resolver
+  -- returns FALSE). service_role is authorized by the predicate (wrapper short-circuit), so the
+  -- operator carve-out holds. Fail-closed-on-unknown is automatic: an unresolvable fleet resource
+  -- makes v_shadow_authorized FALSE, so an enforced acquire of it denies.
+  if p_resource_kind in ('machine', 'repository', 'repo_file')
+     and agent_board._claimgate_kind_enforced(p_resource_kind)
+     and not v_shadow_authorized then
+    raise exception 'not authorized to claim this % resource (fleet authority required)', p_resource_kind
+      using errcode = '42501';
+  end if;
+
+  -- CLAIMGATE/ENFORCE (#133): max-lease horizon. For an ENFORCED fleet-backed kind, CLAMP the
+  -- lease to now()+horizon (default 30d, operator-configurable) — a bound on lease term, NOT an
+  -- authority block. Clamp (not reject) so an over-long lease reconciles here / at its next renew.
+  -- service_role exempt (operator carve-out). Only reached by an AUTHORIZED acquire (unauthorized
+  -- was denied above), or when the flag is OFF (then the guard below is skipped entirely).
+  if p_resource_kind in ('machine', 'repository', 'repo_file')
+     and not agent_board._is_service_role()
+     and agent_board._claimgate_kind_enforced(p_resource_kind)
+     and p_lease_expires_at > now() + agent_board._claimgate_max_lease_horizon() then
+    p_lease_expires_at := now() + agent_board._claimgate_max_lease_horizon();
+  end if;
+
+  -- Ownerless tail (file/tool/custom): the ONE guard SHADOW carries — GATED OFF BY DEFAULT.
+  -- _claimgate_ownerless_guards_enabled() is false unless an operator flips it post-census, so in
+  -- SHADOW this block is skipped entirely and NOTHING is blocked (only the stamp above lands).
+  -- service_role is also exempt (operator carve-out, consistent with the predicate short-circuit).
+  v_ownerless := p_resource_kind in ('file', 'tool', 'custom');
+  if v_ownerless
+     and not agent_board._is_service_role()
+     and agent_board._claimgate_ownerless_guards_enabled() then
+    -- TTL CAP: an ownerless lease may not exceed the max horizon. Rejects an over-long acquire;
+    -- this is a lease-length bound, NOT an authority block.
+    if p_lease_expires_at > now() + agent_board._claimgate_ownerless_ttl_cap() then
+      raise exception 'ownerless claim lease horizon exceeds cap (%)', agent_board._claimgate_ownerless_ttl_cap()
+        using errcode = '22023';
+    end if;
+
+    -- QUOTA (transactionally serialized): an actor-scoped advisory XACT lock serializes this
+    -- actor's concurrent acquisitions (on DIFFERENT keys, which the row-level uniqueness index
+    -- does NOT), so a count-before-insert cannot race two claims past the cap. The lock releases
+    -- at commit; it does not block other actors (the key mixes in the actor id).
+    perform pg_advisory_xact_lock(hashtext('agent_board.claimgate_ownerless_quota'), hashtext(v_actor_agent_id::text));
+    select count(*) into v_active_ownerless
+      from agent_board.claims c
+     where c.agent_id = v_actor_agent_id
+       and c.resource_kind in ('file', 'tool', 'custom')
+       and c.status = 'active'
+       and c.released_at is null
+       and c.lease_expires_at > now();
+    if v_active_ownerless >= agent_board._claimgate_ownerless_quota() then
+      raise exception 'ownerless active-claim quota reached (% per agent)', agent_board._claimgate_ownerless_quota()
+        using errcode = '54000';
+    end if;
+  end if;
+
+  -- CLAIMKEY (#133) MUST-FIX 3: the sweep AND the conflict check are ALIAS-AWARE. p_resource_key
+  -- is already canonical (above); comparing against the CANONICAL form of each existing row's key
+  -- matches both a canonical row AND an un-healed LEGACY row for the same physical resource. Without
+  -- this, acquire('machine','machine:fpDH') would normalize to 'fpDH', see no exact-'fpDH' conflict
+  -- against a still-active legacy 'machine:fpDH' row, and INSERT a second live hold — breaking mutual
+  -- exclusion during the legacy window. Closing it here in code does NOT depend on the operator-owned
+  -- live census.
+  update agent_board.claims c
+     set status = 'expired',
+         updated_at = now()
+   where c.resource_kind = p_resource_kind
+     and agent_board._canonical_claim_key(c.resource_kind, c.resource_key) = p_resource_key
+     and c.status = 'active'
+     and c.released_at is null
+     and c.lease_expires_at <= now();
+
+  if exists (
+    select 1 from agent_board.claims
+     where claims.resource_kind = p_resource_kind
+       and agent_board._canonical_claim_key(claims.resource_kind, claims.resource_key) = p_resource_key
+       and claims.status = 'active'
+       and claims.released_at is null
+       and claims.lease_expires_at > now()
+  ) then
+    raise exception 'conflicting active claim' using errcode = '23505';
+  end if;
+
+  insert into agent_board.claims(task_id, thread_id, agent_id, resource_kind, resource_key, lease_expires_at, metadata)
+  values (
+    p_task_id, v_thread_id, v_actor_agent_id, p_resource_kind, p_resource_key, p_lease_expires_at,
+    -- SHADOW stamp: record the authority verdict alongside any caller metadata. Merged last so it
+    -- is authoritative over a caller-supplied claimgate_shadow key.
+    coalesce(p_metadata, '{}'::jsonb)
+      || jsonb_build_object(
+           'claimgate_shadow',
+           jsonb_build_object('kind', p_resource_kind, 'authorized', v_shadow_authorized)
+         )
+  )
+  returning id into v_claim_id;
+
+  if p_task_id is not null then
+    perform agent_board._append_task_event('unattested:signed-metadata-rpc', p_task_id, v_actor_agent_id, 'claimed', jsonb_build_object('claim_id', v_claim_id, 'resource_kind', p_resource_kind, 'resource_key', p_resource_key));
+  end if;
+
+  return query
+  select c.id, c.task_id, c.thread_id, c.agent_id, c.resource_kind, c.resource_key, c.status, c.lease_token, c.lease_expires_at, c.released_at, c.created_at, c.updated_at
+    from agent_board.claims c
+   where c.id = v_claim_id;
+end;
+$function$;
+
+
+CREATE OR REPLACE FUNCTION agent_board.add_artifact(p_created_by_agent_id uuid, p_uri text, p_artifact_type text DEFAULT 'url'::text, p_storage_kind text DEFAULT 'external_url'::text, p_thread_id uuid DEFAULT NULL::uuid, p_task_id uuid DEFAULT NULL::uuid, p_message_id uuid DEFAULT NULL::uuid, p_task_event_id uuid DEFAULT NULL::uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(artifact_id uuid, task_event_sequence bigint, created_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_artifact_id uuid;
+  v_event_sequence bigint;
+  v_actor_agent_id uuid;
+  v_thread_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_created_by_agent_id, 'p_created_by_agent_id');
+
+  if p_thread_id is null and p_task_id is null and p_message_id is null and p_task_event_id is null then
+    raise exception 'artifact target is required' using errcode = '22023';
+  end if;
+
+  if p_task_id is not null then
+    if not agent_board._current_agent_can_access_task(p_task_id) then
+      raise exception 'task not accessible to current agent' using errcode = '42501';
+    end if;
+  end if;
+
+  if p_thread_id is not null and not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+
+  if p_message_id is not null then
+    select m.thread_id into v_thread_id from agent_board.messages m where m.id = p_message_id;
+    if v_thread_id is null or not agent_board._current_agent_can_access_thread(v_thread_id) then
+      raise exception 'message not accessible to current agent' using errcode = '42501';
+    end if;
+  end if;
+
+  if p_task_event_id is not null then
+    select te.thread_id into v_thread_id from agent_board.task_events te where te.id = p_task_event_id;
+    if v_thread_id is null or not agent_board._current_agent_can_access_thread(v_thread_id) then
+      raise exception 'task event not accessible to current agent' using errcode = '42501';
+    end if;
+  end if;
+
+  -- OBSGATE-2 (#123): apply the posting gate to the artifact's effective thread (resolved from
+  -- whichever target was supplied). A board-linked thread requires a non-observer board role.
+  v_thread_id := coalesce(
+    p_thread_id,
+    v_thread_id,
+    (select tk.thread_id from agent_board.tasks tk where tk.id = p_task_id)
+  );
+  if v_thread_id is not null and not agent_board._current_agent_can_post_to_thread(v_thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+
+  insert into agent_board.artifacts(thread_id, task_id, message_id, task_event_id, created_by_agent_id, artifact_type, storage_kind, uri, metadata)
+  values (p_thread_id, p_task_id, p_message_id, p_task_event_id, v_actor_agent_id, coalesce(p_artifact_type, 'url'), coalesce(p_storage_kind, 'external_url'), p_uri, coalesce(p_metadata, '{}'::jsonb))
+  returning id into v_artifact_id;
+
+  -- v_event_sequence stays NULL when there is no task (a thread/message/task_event artifact).
+  -- The prior `v_event record` + unconditional `v_event.event_sequence` raised
+  -- "record not assigned yet" on that no-task path — a latent bug fixed here while these
+  -- functions are being rewritten for the gate.
+  if p_task_id is not null then
+    select event_sequence into v_event_sequence
+      from agent_board._append_task_event('unattested:signed-metadata-rpc', p_task_id, v_actor_agent_id, 'artifact_added', jsonb_build_object('artifact_id', v_artifact_id));
+  end if;
+
+  return query
+  select v_artifact_id, v_event_sequence, now();
+end;
+$function$;
+
+
+CREATE OR REPLACE FUNCTION agent_board.delegate_task(p_parent_task_id uuid, p_actor_agent_id uuid, p_title text, p_details text DEFAULT NULL::text, p_delegated_to_agent_id uuid DEFAULT NULL::uuid, p_priority text DEFAULT 'medium'::text, p_note text DEFAULT NULL::text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(delegation_id uuid, child_task_id uuid, parent_task_id uuid, root_task_id uuid, delegation_status text, child_event_sequence bigint, parent_event_sequence bigint, created_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_parent agent_board.tasks%rowtype;
+  v_child record;
+  v_delegation_id uuid;
+  v_parent_event record;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_actor_agent_id, 'p_actor_agent_id');
+
+  select * into v_parent from agent_board.tasks where id = p_parent_task_id;
+  if v_parent.id is null then
+    raise exception 'parent task not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_task(p_parent_task_id) then
+    raise exception 'parent task not accessible to current agent' using errcode = '42501';
+  end if;
+
+  select * into v_child
+    from agent_board.create_task(v_parent.thread_id, v_actor_agent_id, p_title, p_details, p_delegated_to_agent_id, p_parent_task_id, p_priority, 'hierarchical', p_metadata);
+
+  insert into agent_board.delegations(parent_task_id, child_task_id, delegated_by_agent_id, delegated_to_agent_id, note, metadata)
+  values (p_parent_task_id, v_child.task_id, v_actor_agent_id, p_delegated_to_agent_id, p_note, coalesce(p_metadata, '{}'::jsonb))
+  returning id into v_delegation_id;
+
+  select * into v_parent_event
+    from agent_board._append_task_event('unattested:signed-metadata-rpc', p_parent_task_id, v_actor_agent_id, 'delegated', jsonb_build_object('delegation_id', v_delegation_id, 'child_task_id', v_child.task_id));
+
+  return query
+  select v_delegation_id, v_child.task_id, p_parent_task_id, v_child.root_task_id, 'requested'::text, v_child.created_event_sequence, v_parent_event.event_sequence, now();
+end;
+$function$;
+
+
+CREATE OR REPLACE FUNCTION agent_board.raise_conflict(p_thread_id uuid, p_raised_by_agent_id uuid, p_summary text, p_conflict_type text DEFAULT 'other'::text, p_severity text DEFAULT 'medium'::text, p_task_id uuid DEFAULT NULL::uuid, p_details jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(conflict_id uuid, status text, task_event_sequence bigint, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_conflict_id uuid;
+  v_event_sequence bigint;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_raised_by_agent_id, 'p_raised_by_agent_id');
+
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  -- OBSGATE-2 (#123): a board-linked thread requires a non-observer board role.
+  if not agent_board._current_agent_can_post_to_thread(p_thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+
+  insert into agent_board.conflicts(thread_id, task_id, raised_by_agent_id, summary, conflict_type, severity, details)
+  values (p_thread_id, p_task_id, v_actor_agent_id, p_summary, coalesce(p_conflict_type, 'other'), coalesce(p_severity, 'medium'), coalesce(p_details, '{}'::jsonb))
+  returning id into v_conflict_id;
+
+  -- v_event_sequence stays NULL for a thread-level conflict (no task) — fixes the same latent
+  -- "record not assigned yet" bug on the no-task path.
+  if p_task_id is not null then
+    select event_sequence into v_event_sequence
+      from agent_board._append_task_event('unattested:unsigned-deliberate-rpc', p_task_id, v_actor_agent_id, 'conflict_raised', jsonb_build_object('conflict_id', v_conflict_id));
+  end if;
+
+  return query
+  select c.id, c.status, v_event_sequence, c.created_at, c.updated_at
+    from agent_board.conflicts c
+   where c.id = v_conflict_id;
+end;
+$function$;
+
+
+CREATE OR REPLACE FUNCTION agent_board.raise_escalation(p_thread_id uuid, p_raised_by_agent_id uuid, p_summary text, p_escalation_type text DEFAULT 'other'::text, p_severity text DEFAULT 'medium'::text, p_task_id uuid DEFAULT NULL::uuid, p_assigned_agent_id uuid DEFAULT NULL::uuid, p_details jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(escalation_id uuid, status text, task_event_sequence bigint, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_escalation_id uuid;
+  v_event_sequence bigint;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_raised_by_agent_id, 'p_raised_by_agent_id');
+
+  if not agent_board._current_agent_can_access_thread(p_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+  -- OBSGATE-2 (#123): a board-linked thread requires a non-observer board role.
+  if not agent_board._current_agent_can_post_to_thread(p_thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+
+  insert into agent_board.escalations(thread_id, task_id, raised_by_agent_id, assigned_agent_id, summary, escalation_type, severity, details)
+  values (p_thread_id, p_task_id, v_actor_agent_id, p_assigned_agent_id, p_summary, coalesce(p_escalation_type, 'other'), coalesce(p_severity, 'medium'), coalesce(p_details, '{}'::jsonb))
+  returning id into v_escalation_id;
+
+  -- v_event_sequence stays NULL for a thread-level escalation (no task) — fixes the same latent
+  -- "record not assigned yet" bug on the no-task path.
+  if p_task_id is not null then
+    select event_sequence into v_event_sequence
+      from agent_board._append_task_event('unattested:unsigned-deliberate-rpc', p_task_id, v_actor_agent_id, 'escalated', jsonb_build_object('escalation_id', v_escalation_id));
+  end if;
+
+  return query
+  select e.id, e.status, v_event_sequence, e.created_at, e.updated_at
+    from agent_board.escalations e
+   where e.id = v_escalation_id;
+end;
+$function$;
+
+
+CREATE OR REPLACE FUNCTION agent_board.resolve_conflict(p_conflict_id uuid, p_resolved_by_agent_id uuid, p_details jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(conflict_id uuid, status text, resolved_at timestamp with time zone, updated_at timestamp with time zone, task_event_sequence bigint)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_conflict agent_board.conflicts%rowtype;
+  v_event_sequence bigint;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_resolved_by_agent_id, 'p_resolved_by_agent_id');
+
+  select *
+    into v_conflict
+    from agent_board.conflicts c
+   where c.id = p_conflict_id
+     and c.status <> 'resolved';
+  if v_conflict.id is null then
+    raise exception 'conflict not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(v_conflict.thread_id) then
+    raise exception 'conflict not accessible to current agent' using errcode = '42501';
+  end if;
+  -- OBSGATE-4 (#127): a task-bound resolve is gated by append_task_event (#125 mutate-task,
+  -- assignee-aware). A TASK-LESS conflict has no such chokepoint, so gate it on the board
+  -- posting rule here (a board observer may not resolve).
+  if v_conflict.task_id is null
+     and not agent_board._current_agent_can_post_to_thread(v_conflict.thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+
+  update agent_board.conflicts
+     set status = 'resolved',
+         resolved_by_agent_id = v_actor_agent_id,
+         resolved_at = now(),
+         details = details || coalesce(p_details, '{}'::jsonb),
+         updated_at = now()
+   where id = p_conflict_id
+   returning * into v_conflict;
+
+  -- v_event_sequence stays NULL for a task-less conflict (fixes the latent "record not assigned"
+  -- bug; the unconditional v_event.event_sequence reference raised 55000 on this path).
+  if v_conflict.task_id is not null then
+    select event_sequence into v_event_sequence
+      from agent_board._append_task_event('unattested:unsigned-deliberate-rpc', v_conflict.task_id, v_actor_agent_id, 'status_changed', jsonb_build_object('kind', 'conflict_resolved', 'conflict_id', p_conflict_id));
+  end if;
+
+  return query
+  select v_conflict.id, v_conflict.status, v_conflict.resolved_at, v_conflict.updated_at, v_event_sequence;
+end;
+$function$;
+
+
+CREATE OR REPLACE FUNCTION agent_board.resolve_escalation(p_escalation_id uuid, p_resolved_by_agent_id uuid, p_details jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(escalation_id uuid, status text, resolved_at timestamp with time zone, updated_at timestamp with time zone, task_event_sequence bigint)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_escalation agent_board.escalations%rowtype;
+  v_event_sequence bigint;
+  v_actor_agent_id uuid;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_resolved_by_agent_id, 'p_resolved_by_agent_id');
+
+  select *
+    into v_escalation
+    from agent_board.escalations e
+   where e.id = p_escalation_id
+     and e.status <> 'resolved';
+  if v_escalation.id is null then
+    raise exception 'escalation not found' using errcode = 'P0002';
+  end if;
+  if not agent_board._current_agent_can_access_thread(v_escalation.thread_id) then
+    raise exception 'escalation not accessible to current agent' using errcode = '42501';
+  end if;
+  -- OBSGATE-4 (#127): task-less escalation gated on the board posting rule (task-bound is gated
+  -- by the append below).
+  if v_escalation.task_id is null
+     and not agent_board._current_agent_can_post_to_thread(v_escalation.thread_id) then
+    raise exception 'thread posting requires a non-observer board role' using errcode = '42501';
+  end if;
+
+  update agent_board.escalations
+     set status = 'resolved',
+         resolved_by_agent_id = v_actor_agent_id,
+         resolved_at = now(),
+         details = details || coalesce(p_details, '{}'::jsonb),
+         updated_at = now()
+   where id = p_escalation_id
+   returning * into v_escalation;
+
+  if v_escalation.task_id is not null then
+    select event_sequence into v_event_sequence
+      from agent_board._append_task_event('unattested:unsigned-deliberate-rpc', v_escalation.task_id, v_actor_agent_id, 'status_changed', jsonb_build_object('kind', 'escalation_resolved', 'escalation_id', p_escalation_id));
+  end if;
+
+  return query
+  select v_escalation.id, v_escalation.status, v_escalation.resolved_at, v_escalation.updated_at, v_event_sequence;
+end;
+$function$;
+
+
+CREATE OR REPLACE FUNCTION agent_board.signed_append_task_event(p_payload jsonb, p_gateway_decision jsonb)
+ RETURNS TABLE(task_id uuid, thread_id uuid, event_id uuid, event_sequence bigint, signature_evidence_id uuid, verification_status text, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_row record;
+  v_evidence_id uuid;
+  v_actor uuid;
+begin
+  v_actor := agent_board._signed_write_actor_id(p_payload, p_gateway_decision, 'p_actor_agent_id');
+  select *
+    into v_row
+    from agent_board._append_task_event('attested:evidence-row', 
+      (p_payload ->> 'p_task_id')::uuid,
+      v_actor,
+      p_payload ->> 'p_event_type',
+      coalesce(p_payload -> 'p_payload', '{}'::jsonb) || jsonb_build_object('signed_write', jsonb_build_object('verification_status', coalesce(p_gateway_decision ->> 'verification_status', 'unsigned'), 'redacted', true)),
+      nullif(p_payload ->> 'p_status', ''),
+      nullif(p_payload ->> 'p_assigned_agent_id', '')::uuid,
+      nullif(p_payload ->> 'p_completed_at', '')::timestamptz
+    );
+
+  v_evidence_id := agent_board._record_signed_write_evidence('task_event', v_row.event_id, 'append_task_event', p_payload, p_gateway_decision);
+
+  return query
+  select v_row.task_id, v_row.thread_id, v_row.event_id, v_row.event_sequence, v_evidence_id, coalesce(p_gateway_decision ->> 'verification_status', 'unsigned'), v_row.updated_at;
+end;
+$function$;
+
+-- 3. The public entry point keeps its EXACT signature and becomes a thin delegation.
+--
+-- CREATE OR REPLACE with an unchanged argument list, so the ACL (authenticated, service_role)
+-- and the COMMENT survive without being restated. Adding p_origin_posture to THIS signature
+-- would have created an OVERLOAD rather than a replacement — two callable functions and an
+-- ambiguity risk — which is why the parameter lives on the internal function instead.
+--
+-- 'unattested:direct-rpc' is the honest label for this path: a caller reaching the public RPC declared
+-- nothing about its posture, and the database cannot introspect its caller.
+create or replace function agent_board.append_task_event(
+  p_task_id uuid,
+  p_actor_agent_id uuid,
+  p_event_type text,
+  p_payload jsonb default '{}'::jsonb,
+  p_status text default null,
+  p_assigned_agent_id uuid default null,
+  p_completed_at timestamp with time zone default null
+)
+returns table(task_id uuid, thread_id uuid, event_id uuid, event_sequence bigint, task_status text, assigned_agent_id uuid, updated_at timestamp with time zone, completed_at timestamp with time zone)
+language plpgsql
+security definer
+set search_path to 'agent_board', 'public'
+as $function$
+begin
+  return query
+  select *
+    from agent_board._append_task_event(
+      'unattested:direct-rpc',
+      p_task_id, p_actor_agent_id, p_event_type, p_payload, p_status, p_assigned_agent_id, p_completed_at
+    );
+end;
+$function$;
+
+-- The COMMENT is restated because the body's behaviour changed: the gating and lock order it
+-- described now live in _append_task_event. Restating is required whenever behaviour moves,
+-- even though CREATE OR REPLACE would have preserved the stale text.
+comment on function agent_board.append_task_event(uuid, uuid, text, jsonb, text, uuid, timestamp with time zone) is
+  '#288: delegates to agent_board._append_task_event with origin_posture ''unattested:direct-rpc'' — a caller reaching this public RPC declares no posture and the database cannot introspect its caller. The #281 R1 lock order (threads KEY SHARE before tasks FOR UPDATE), the OBSGATE-3 (#125) gating and every error code are unchanged; they moved verbatim into _append_task_event.';
+
+-- 4. The internal funnel is a FRESH create, so its ACL does not exist yet and a SECURITY
+--    DEFINER function grants EXECUTE to PUBLIC by default. Revoke, and grant to NOBODY:
+--    every caller is itself SECURITY DEFINER, so the inner call already runs as the owner.
+--    This is a net REDUCTION in reachable surface — the body is now behind a function no role
+--    can invoke directly. Mutation M7 pins it.
+revoke all on function agent_board._append_task_event(text, uuid, uuid, text, jsonb, text, uuid, timestamp with time zone) from public, anon, authenticated, service_role;
+
+comment on function agent_board._append_task_event(text, uuid, uuid, text, jsonb, text, uuid, timestamp with time zone) is
+  '#288: the single funnel every task_events append passes through. p_origin_posture has NO DEFAULT deliberately — an internal caller must declare its posture, and a caller that omits it fails to compile rather than inheriting a plausible-looking label (mutation M5). Holds the #281 R1 lock order and OBSGATE-3 (#125) gating verbatim from the public append_task_event it was extracted from. Granted to no role: every caller is SECURITY DEFINER, so the inner call runs as the owner.';
+
+-- 5. The read surface. origin_posture is appended as a TRAILING column — CREATE OR REPLACE
+--    VIEW permits adding only at the end, and preserves the view's ACL.
+--
+--    verification_status is UNCHANGED, still NULL where no evidence row exists. That is the
+--    point: the two columns answer different questions. A consumer asking "was this signed?"
+--    reads verification_status and still gets NULL; a consumer asking "how was this written?"
+--    now gets an answer instead of the same blank. Folding them would let a stamped posture
+--    satisfy a gate written against the evidence vocabulary (mutation M8).
+create or replace view agent_board.v_task_tree
+with (security_invoker = true)
+as
+select
+  coalesce(t.root_task_id, t.id) as root_task_id,
+  t.id as task_id,
+  t.parent_task_id,
+  t.thread_id,
+  t.created_by_agent_id,
+  t.assigned_agent_id,
+  assigned.handle as assigned_agent_handle,
+  t.status,
+  t.priority,
+  t.orchestration_mode,
+  t.title,
+  t.details,
+  t.created_at,
+  t.updated_at,
+  t.completed_at,
+  latest.event_sequence as latest_event_sequence,
+  latest.event_type as latest_event_type,
+  latest.payload->>'kind' as latest_event_kind,
+  sig.verification_status,
+  sig.key_fingerprint,
+  sig.key_version,
+  sig.algorithm,
+  sig.verified_at,
+  sig.failure_class,
+  latest.origin_posture
+from agent_board.tasks t
+left join agent_board.agents assigned on assigned.id = t.assigned_agent_id
+left join lateral (
+  select te.id, te.event_sequence, te.event_type, te.payload, te.origin_posture
+    from agent_board.task_events te
+   where te.task_id = t.id
+   order by te.event_sequence desc
+   limit 1
+) latest on true
+left join lateral (
+  select
+    se.verification_status,
+    ask.fingerprint as key_fingerprint,
+    se.key_version,
+    se.algorithm,
+    se.verified_at,
+    se.failure_class
+  from agent_board.signature_evidence se
+  left join agent_board.agent_signing_keys ask on ask.id = se.signing_key_id
+  where se.source_kind = 'task_event'
+    and se.source_task_event_id = latest.id
+  order by se.created_at desc
+  limit 1
+) sig on true;