@consiliency/agent-board-schema 1.40.0 → 1.41.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.40.0",
+  "packageVersion": "1.41.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 138,
-  "aggregateSha256": "e5e6870533c69d20b446431b6fb19693588d9eb4bb55e1fb3f7f239afcfa76c0",
+  "migrationCount": 139,
+  "aggregateSha256": "0c0daf769baedbae5243a7345d44df09613494c5ea2495b342222a7248dde6d0",
   "migrations": [
     {
       "order": 0,
@@ -1290,6 +1290,15 @@
       "sourceRef": "message-board",
       "bytes": 7556,
       "sha256": "670d6e97ca84ef74ebd10a6ee102c328005a28aa48f8668ba444ce31b714cf02"
+    },
+    {
+      "order": 138,
+      "id": "20260921000100_agent_board_task_event_origin_posture",
+      "filename": "20260921000100_agent_board_task_event_origin_posture.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 48237,
+      "sha256": "c515e9cd08b73c118de64125da94735979add5d1128d3ff070ff904af77fef81"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 138)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 139)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(138);
+    expect(manifest.migrationCount).toBe(139);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -233,6 +233,18 @@ describe('manifest integrity', () => {
       // sources still takes the permissive branch. Definition-only: CREATE OR REPLACE with the
       // identical signature, grants and COMMENT restated in the same migration.
       '20260920000100_agent_board_realtime_credential_claim.sql',
+      // #288 ORIGINPOSTURE. v_task_tree.verification_status was NULL for every task_event
+      // except the two written by a signed wrapper, and NULL cannot be told apart from
+      // "evidence was lost", "the writer forgot" and "unsigned on purpose". The class was
+      // derived by CALL CLOSURE (a member iff its closure reaches an INSERT INTO task_events):
+      // 12 members, where the issue body said 8 and its own triage comment said 5-6 -- neither
+      // naming create_tasking_delivery or signed_create_tasking_delivery. task_events gains
+      // origin_posture NOT NULL with NO DEFAULT, so a new direct-INSERT writer cannot insert at
+      // all; the funnel body moves behind an ungranted _append_task_event whose posture
+      // parameter is FIRST and undefaulted, which is what makes "no default" structural --
+      // PostgreSQL refuses a default before non-defaulted parameters. Nothing is DROPped: both
+      // public signatures stay byte-identical, so ACLs and COMMENTs survive.
+      '20260921000100_agent_board_task_event_origin_posture.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_auth_rls.test.sql

@@ -72,10 +72,15 @@ begin
     (v_task_a, v_thread_a, v_agent_a, v_agent_a, v_task_a, 'Auth RLS Task A', 'medium', 'distributed'),
     (v_task_b, v_thread_b, v_agent_b, v_agent_b, v_task_b, 'Auth RLS Task B', 'medium', 'distributed');
 
-  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload)
+  -- #288: origin_posture is NOT NULL with no default, so this raw fixture insert must declare
+  -- one like any other writer. It emulates create_task's seq-1 'created' event, so it declares
+  -- create_task's own posture rather than a test-only placeholder -- a fixture that labelled
+  -- itself differently from the writer it stands in for would make OP-15-style invariants
+  -- assert against a shape production never produces.
+  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload, origin_posture)
   values
-    (v_task_a, v_thread_a, v_agent_a, 1, 'created', '{}'::jsonb),
-    (v_task_b, v_thread_b, v_agent_b, 1, 'created', '{}'::jsonb);
+    (v_task_a, v_thread_a, v_agent_a, 1, 'created', '{}'::jsonb, 'unattested:signed-metadata-rpc'),
+    (v_task_b, v_thread_b, v_agent_b, 1, 'created', '{}'::jsonb, 'unattested:signed-metadata-rpc');
 
   insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, message_type, body)
   values

package/tests/agent_board_signer_lifecycle.test.sql

@@ -511,7 +511,7 @@ select is(
     where n.nspname = 'agent_board'
       and p.proname like 'signed\_%'
       and agent_board_test.stripped_body(p.oid)
-          ~ '\m(send_direct_message|send_multicast_message|post_board_message|append_task_event|create_tasking_delivery)\s*\('),
+          ~ '\m(send_direct_message|send_multicast_message|post_board_message|_?append_task_event|create_tasking_delivery)\s*\('),
   'signed_append_task_event,signed_create_tasking_delivery,signed_post_board_message,'
   || 'signed_send_direct_message,signed_send_multicast_message',
   'the five exempt wrappers each perform a message/task write, which is why they are exempt');

package/tests/agent_board_task_event_origin_posture.test.sql

@@ -0,0 +1,393 @@
+-- Consiliency/message-board#288 pgTAP: every task_events row declares HOW it was written.
+--
+-- THE DEFECT. v_task_tree.verification_status is NULL for every task_event written by
+-- anything except the two signed wrappers, and NULL cannot be told apart from "evidence was
+-- lost", "the writer forgot" and "unsigned on purpose". The fix stamps the writer's posture
+-- into a DISTINCT column, so the blank becomes a fact.
+--
+-- WHY THE CLASS ASSERTION IS THE CENTREPIECE. The issue body enumerated 8 members and its own
+-- triage comment enumerated 5-6; the catalog says 12, and neither list named
+-- create_tasking_delivery or signed_create_tasking_delivery. Two hand-written lists, both
+-- wrong, in one issue. OP-4/OP-5 therefore ask pg_proc for the class rather than checking a
+-- list off, so a THIRTEENTH writer fails them AND NAMES ITSELF -- but only once OP-20 is read
+-- alongside them. An earlier version of this sentence stopped at "names itself", and three
+-- reviewers independently named the shape it missed: a writer calling the PUBLIC
+-- append_task_event enters the class, compiles, is stamped 'unattested:direct-rpc', and is
+-- named by neither OP-4 (which inspects only _append_task_event call sites) nor OP-5 (which
+-- inspects only direct INSERTs). OP-20 is what closes it.
+--
+-- WHAT EACH LAYER DOES AND DOES NOT BUY -- calling the second one structural would be the
+-- overclaim these tests exist to prevent:
+--   * OP-1/OP-2 are STRUCTURAL. origin_posture is NOT NULL with no default, so a writer that
+--     opens a new DIRECT INSERT path cannot insert a row at all. No test has to remember.
+--   * OP-4 is NAMED, NOT STRUCTURAL. A writer that goes through the funnel and omits the
+--     argument would inherit the funnel's default rather than erroring -- no SQL construct
+--     prevents that, since a caller can always route through a defaulting wrapper. This
+--     assertion is what turns that from silent into named.
+--
+-- LITERALS ARE KEPT ON PURPOSE. agent_board_test.stripped_body strips string literals BY
+-- DEFAULT, and the whole predicate here is "is a literal posture passed at the call site" --
+-- so OP-4 passes p_keep_literals => true. With the default, every call site would read as
+-- `_append_task_event(` with nothing after it and the assertion would pass VACUOUSLY.
+-- Comments are stripped in both modes, so prose naming a call site cannot satisfy it.
+--
+-- OP-6 EXISTS BECAUSE ABSENCE OF FAILURE IS NOT SUCCESS. A derivation that silently matched
+-- nothing would make OP-4 and OP-5 pass with an empty input set. OP-6 pins the closure's
+-- membership positively before the other two are believed.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(22);
+
+-- ===========================================================================
+-- The class, derived once. Membership rule:
+--   a function is a member iff its CALL CLOSURE reaches an INSERT INTO agent_board.task_events
+-- ===========================================================================
+create temp table _op_direct on commit drop as
+select p.oid, p.proname
+  from pg_proc p
+  join pg_namespace n on n.oid = p.pronamespace
+ where n.nspname = 'agent_board'
+   and agent_board_test.stripped_body(p.oid) ~* 'insert\s+into\s+(agent_board\.)?task_events';
+
+create temp table _op_class on commit drop as
+with recursive walk as (
+    select oid, proname, 0 as depth from _op_direct
+    union
+    select p.oid, p.proname, w.depth + 1
+      from pg_proc p
+      join pg_namespace n on n.oid = p.pronamespace
+      join walk w
+        on agent_board_test.stripped_body(p.oid)
+           ~* ('(^|[^a-z0-9_.])(agent_board\.)?' || w.proname || '\s*\(')
+     where n.nspname = 'agent_board' and p.oid <> w.oid and w.depth < 5
+)
+select oid, proname, min(depth) as depth from walk group by oid, proname;
+
+-- ---------------------------------------------------------------------------
+-- OP-1/OP-2/OP-3: the column itself.
+-- ---------------------------------------------------------------------------
+select is(
+  (select attnotnull from pg_attribute
+    where attrelid = 'agent_board.task_events'::regclass and attname = 'origin_posture'),
+  true,
+  'OP-1: task_events.origin_posture is NOT NULL -- a new direct-INSERT writer cannot insert at all');
+
+-- A column DEFAULT would silently satisfy a new direct-INSERT writer with a plausible-looking
+-- label, re-opening exactly the hole this migration closes. The absence is load-bearing.
+select is(
+  (select pg_get_expr(d.adbin, d.adrelid)
+     from pg_attribute a left join pg_attrdef d on d.adrelid = a.attrelid and d.adnum = a.attnum
+    where a.attrelid = 'agent_board.task_events'::regclass and a.attname = 'origin_posture'),
+  null,
+  'OP-2: origin_posture has NO column default -- a default would relabel a forgetful writer instead of stopping it');
+
+select is(
+  (select count(*)::int from (
+     select unnest(array['attested:evidence-row','unattested:signed-metadata-rpc','unattested:unsigned-deliberate-rpc','unattested:direct-rpc','unattested:preexisting']) v
+   ) want
+   where not exists (
+     select 1 from pg_constraint c
+      where c.conrelid = 'agent_board.task_events'::regclass
+        and c.conname = 'task_events_origin_posture_check'
+        and pg_get_constraintdef(c.oid) like '%''' || want.v || '''%')),
+  0,
+  'OP-3: every vocabulary value is admitted by task_events_origin_posture_check');
+
+-- ---------------------------------------------------------------------------
+-- OP-4/OP-5: the class assertions. Catalog-derived, and they NAME the offender.
+-- ---------------------------------------------------------------------------
+-- Compliant iff EVERY _append_task_event call site passes a literal posture as its first
+-- argument. Counting both shapes and comparing catches a body with three compliant calls and
+-- one bare one -- which a bare `does it match at all` predicate would report as clean.
+select is(
+  (select coalesce(string_agg(c.proname, ', ' order by c.proname), '')
+     from _op_class c
+    where (select count(*) from regexp_matches(
+             agent_board_test.stripped_body(c.oid, true), '_append_task_event\s*\(', 'g')) <> 0
+      and (select count(*) from regexp_matches(
+             agent_board_test.stripped_body(c.oid, true), '_append_task_event\s*\(', 'g'))
+       <> (select count(*) from regexp_matches(
+             agent_board_test.stripped_body(c.oid, true), '_append_task_event\s*\(\s*''', 'g'))),
+  '',
+  'OP-4 CLASS: every funnel caller passes an explicit literal posture -- a caller that does not is NAMED here');
+
+-- The two INSERT sites must name the column. This is the half OP-4 cannot see: a writer that
+-- inserts directly never calls the funnel at all, which is precisely how create_task escaped
+-- every prior enumeration of this class.
+select is(
+  (select coalesce(string_agg(d.proname, ', ' order by d.proname), '')
+     from _op_direct d
+    where agent_board_test.stripped_body(d.oid)
+          !~* 'insert\s+into\s+(agent_board\.)?task_events\s*\([^)]*origin_posture'),
+  '',
+  'OP-5 CLASS: every DIRECT task_events INSERT names origin_posture -- one that does not is NAMED here');
+
+-- ---------------------------------------------------------------------------
+-- OP-6: the anti-vacuity guard. OP-4 and OP-5 are only worth their green if the derivation
+-- they read actually found the writers. Asserted POSITIVELY (the members are present), never
+-- by "no offenders were found" -- an empty class also produces no offenders.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(string_agg(c.proname, ', ' order by c.proname), '')
+     from _op_class c
+    where c.proname in ('_append_task_event', 'create_task', 'acquire_claim', 'raise_conflict',
+                        'signed_append_task_event', 'signed_create_tasking_delivery')),
+  '_append_task_event, acquire_claim, create_task, raise_conflict, signed_append_task_event, signed_create_tasking_delivery',
+  'OP-6: the closure really did find the writers, including the two the issue never named');
+
+-- ---------------------------------------------------------------------------
+-- OP-7/OP-8: reachable surface. The funnel moved BEHIND a function no role can invoke; the
+-- public entry point kept the ACL it had before, which is the property CREATE OR REPLACE
+-- buys and DROP FUNCTION would have destroyed.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(string_agg(r, ', ' order by r), '')
+     from unnest(array['anon','authenticated','service_role']) r
+    where has_function_privilege(r,
+      'agent_board._append_task_event(text,uuid,uuid,text,jsonb,text,uuid,timestamptz)', 'execute')),
+  '',
+  'OP-7: no non-owner role can execute _append_task_event -- every caller is SECURITY DEFINER');
+
+select is(
+  (select coalesce(string_agg(r, ', ' order by r), '')
+     from unnest(array['authenticated','service_role']) r
+    where has_function_privilege(r,
+      'agent_board.append_task_event(uuid,uuid,text,jsonb,text,uuid,timestamptz)', 'execute')),
+  'authenticated, service_role',
+  'OP-8: the public entry point kept its ACL through CREATE OR REPLACE');
+
+-- ---------------------------------------------------------------------------
+-- OP-9: the two columns stay SEPARATE. Folding a stamped posture into verification_status
+-- would let it satisfy a gate written against the evidence vocabulary.
+-- ---------------------------------------------------------------------------
+select is(
+  (select count(*)::int from pg_attribute
+    where attrelid = 'agent_board.v_task_tree'::regclass
+      and attname in ('origin_posture','verification_status') and attnum > 0),
+  2,
+  'OP-9: v_task_tree exposes origin_posture and verification_status as two distinct columns');
+
+-- ===========================================================================
+-- Behaviour. A file that only read the catalog would pass against writers that no longer
+-- work. Every RPC runs inside the fixture block, never inside an assertion's value
+-- expression -- a raise there would abort the file with no `not ok` (#113).
+-- ===========================================================================
+create temp table _op_fx (actor uuid, actor_user uuid, thread uuid, task uuid, board uuid) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_creator uuid := gen_random_uuid();
+  v_actor uuid := gen_random_uuid();
+  v_actor_user uuid;
+  v_board uuid; v_thread uuid := gen_random_uuid(); v_task uuid;
+begin
+  v_actor_user := public.ensure_github_user('op-actor-' || v_suffix, 'op-actor-' || v_suffix || '@example.test',
+                                            'op-actor-' || v_suffix, 'OP Actor');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values (v_creator, 'agent', 'op-creator-' || v_suffix, 'OP Creator', 'active', null, null),
+         (v_actor,   'agent', 'op-actor-'   || v_suffix, 'OP Actor',   'active', v_actor_user, v_actor_user);
+
+  select board_id into v_board
+    from agent_board.create_board(v_creator, 'op-board-' || v_suffix, 'OP Board', 'origin posture', '{}'::jsonb, 'private');
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values (v_board, v_actor, 'joined', v_creator, 'member');
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values (v_thread, 'coordination', v_actor, 'OP thread');
+
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+  perform set_config('request.jwt.claim.sub', v_actor_user::text, true);
+  perform agent_board.post_board_message(v_thread, v_actor, v_board, 'seed', 'seed body');
+
+  -- One write per posture the live writers can produce.
+  select task_id into v_task from agent_board.create_task(v_thread, v_actor, 'op task', 'd');
+  perform agent_board.append_task_event(v_task, v_actor, 'commented');                    -- direct-rpc
+  perform agent_board.raise_conflict(v_thread, v_actor, 'op conflict', 'other', 'medium', v_task);
+  perform agent_board.acquire_claim(v_actor, 'task', 'op-' || v_suffix, now() + interval '1 hour', v_task);
+
+  insert into _op_fx values (v_actor, v_actor_user, v_thread, v_task, v_board);
+end
+$$;
+
+select is(
+  (select origin_posture from agent_board.task_events
+    where task_id = (select task from _op_fx) and event_sequence = 1),
+  'unattested:signed-metadata-rpc',
+  'OP-10: create_task''s own direct insert stamps signed-metadata');
+
+select is(
+  (select origin_posture from agent_board.task_events
+    where task_id = (select task from _op_fx) and event_type = 'commented'),
+  'unattested:direct-rpc',
+  'OP-11: the public append_task_event stamps direct-rpc -- the caller declared nothing');
+
+select is(
+  (select origin_posture from agent_board.task_events
+    where task_id = (select task from _op_fx) and event_type = 'conflict_raised'),
+  'unattested:unsigned-deliberate-rpc',
+  'OP-12: raise_conflict stamps unsigned-deliberate, its #261 step 2 adjudication');
+
+select is(
+  (select origin_posture from agent_board.task_events
+    where task_id = (select task from _op_fx) and event_type = 'claimed'),
+  'unattested:signed-metadata-rpc',
+  'OP-13: acquire_claim stamps signed-metadata -- a signed parent whose derived event is still not itself signed');
+
+-- Scoped to this fixture's task: an agent-wide or table-wide count is polluted by earlier
+-- fixtures and would fail looking like a real defect.
+select is(
+  (select count(*)::int from agent_board.task_events
+    where task_id = (select task from _op_fx) and origin_posture is null),
+  0,
+  'OP-14: no row this run wrote carries a NULL posture');
+
+-- M6: an 'attested:evidence-row' stamp is a CLAIM that evidence exists. If it can be stamped without
+-- the row, it is decoration. Table-wide on purpose -- this one is a whole-database invariant,
+-- and a false claim anywhere is a defect regardless of which fixture wrote it.
+select is(
+  (select count(*)::int from agent_board.task_events te
+    where te.origin_posture = 'attested:evidence-row'
+      and not exists (select 1 from agent_board.signature_evidence se
+                       where se.source_kind = 'task_event' and se.source_task_event_id = te.id)),
+  0,
+  'OP-15: every row stamped evidence-row really has a signature_evidence row -- the stamp is not decoration');
+
+-- M8, pinned BEHAVIOURALLY rather than by reading the view's source. OP-9 counts two columns
+-- and a fold keeps both names, so OP-9 alone would stay green through the exact mutation it
+-- was supposed to catch -- found by running the battery against it, not by reading it.
+-- This task has a posture and NO signature_evidence row, so if the two are ever folded,
+-- verification_status starts answering 'unattested:signed-metadata-rpc' and this fails.
+select is(
+  (select verification_status || '/' || origin_posture
+     from agent_board.v_task_tree where task_id = (select task from _op_fx)),
+  null,
+  'OP-16: a stamped posture does NOT leak into verification_status -- it stays NULL with no evidence row');
+
+-- M5. A default on p_origin_posture would let an internal caller omit it and inherit a
+-- plausible label. PostgreSQL forbids a defaulted parameter before non-defaulted ones, so
+-- putting the posture FIRST is what makes "no default" structural rather than a convention
+-- -- the database rejects the mutation instead of a test catching it afterwards. This pins
+-- the ORDER, which is the thing actually doing the work.
+select is(
+  (select p.proargnames[1] from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = '_append_task_event'),
+  'p_origin_posture',
+  'OP-17: p_origin_posture is the FIRST parameter, so PostgreSQL itself forbids giving it a default');
+
+-- ---------------------------------------------------------------------------
+-- OP-18: THE FLOOR THE CLASS CLAIM ACTUALLY RESTS ON.
+--
+-- OP-4/OP-5 walk FUNCTION BODIES, and a body walk cannot be complete in the presence of
+-- dynamic SQL -- proven in this very schema: mark_retention_metadata issues an UPDATE against
+-- task_events through a format() template, and an earlier version of this work asserted in
+-- writing that it "issues no DML", because a text scan cannot see a template.
+--
+-- This assertion is what makes the enumeration sound anyway. If no role can INSERT into
+-- task_events, then every row arrives through a SECURITY DEFINER function owned by the schema
+-- owner -- which is precisely the set the closure walks. Bound the claim with
+-- has_table_privilege, not with a longer regex. Grant INSERT to any role and the class becomes
+-- unbounded in a way no body scan would report, so this fails FIRST.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(string_agg(r, ', ' order by r), '')
+     from unnest(array['anon','authenticated','service_role']) r
+    where has_table_privilege(r, 'agent_board.task_events', 'insert')),
+  '',
+  'OP-18: no role holds INSERT on task_events, so every row comes through a definer function -- the bound the body walk cannot supply itself');
+
+-- ---------------------------------------------------------------------------
+-- OP-19: the stamp is written once and never rewritten. A posture that can be UPDATEd after
+-- the fact is not evidence about the writer, it is a mutable label -- and rewriting a row via
+-- definer privilege to "fix" it is a move this repo has explicitly ruled out.
+--
+-- Literals are KEPT here for a second reason beyond OP-4's: a format() template is a string
+-- LITERAL in the body, so keeping literals is what lets this see dynamic SQL at all. It sees a
+-- template; it would NOT see SQL concatenated from fragments across variables. That residual is
+-- stated rather than papered over, and OP-18 is what covers it.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.prolang <> (select oid from pg_language where lanname = 'internal')
+      and agent_board_test.stripped_body(p.oid, true) ~* 'set\s[^;]*\morigin_posture\s*='),
+  '',
+  'OP-19: nothing UPDATEs origin_posture -- including through a dynamic-SQL template, which keeping literals makes visible');
+
+-- ---------------------------------------------------------------------------
+-- OP-20: THE HOLE THREE REVIEWERS FOUND, NOW CLOSED.
+--
+-- OP-4 only inspects bodies that call _append_task_event. A thirteenth in-schema writer that
+-- called the PUBLIC append_task_event instead would enter the class, compile cleanly, be
+-- stamped 'unattested:direct-rpc', and be named by NOTHING. The header of this file claimed a
+-- thirteenth writer "fails them AND NAMES ITSELF"; against that shape it did not, and the
+-- sentence has been corrected rather than defended.
+--
+-- The public entry point exists for callers OUTSIDE the schema. Zero in-schema functions call
+-- it, so requiring that is not a restriction on anything that exists -- it is the assertion
+-- that makes "names itself" true for the one shape where it was false.
+-- ---------------------------------------------------------------------------
+select is(
+  (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'
+      and p.proname <> 'append_task_event'
+      and agent_board_test.stripped_body(p.oid, true)
+          ~ '(^|[^a-z0-9_.])agent_board\.append_task_event\s*\('),
+  '',
+  'OP-20: no in-schema function calls the PUBLIC append_task_event -- one that did would be stamped direct-rpc and named by nothing else');
+
+-- ---------------------------------------------------------------------------
+-- OP-21: the premise under OP-7. Granting _append_task_event to no role is only safe because
+-- a SECURITY DEFINER caller runs as ITS OWN owner -- so if a caller were owned by a different
+-- role, it would lose EXECUTE and fail at runtime rather than being protected. OP-7 asserts
+-- ordinary roles lack access; it says nothing about owners. Raised by a reviewer as an
+-- unverified premise, and it was: measured true (one owner across the schema), now pinned.
+-- ---------------------------------------------------------------------------
+select is(
+  (select count(distinct p.proowner)::int
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board'),
+  1,
+  'OP-21: every agent_board function shares one owner, which is what makes an ungranted internal funnel reachable by its callers');
+
+-- ---------------------------------------------------------------------------
+-- OP-22: OP-15 WAS VACUOUS AND A REVIEWER SAID SO.
+--
+-- OP-15 counts rows stamped attested:% that have no evidence row. In an unmutated run the
+-- fixture creates NO attested row at all, so it was 0 = 0 and green for the wrong reason.
+-- M6 reds it, which is why the property is not unpinned -- but a green that only means "the
+-- set was empty" is the exact shape rule 3 forbids.
+--
+-- This constructs the POSITIVE case: an attested row WITH its evidence, so the invariant is
+-- exercised in the direction that can actually distinguish a correct implementation from an
+-- empty table. Written directly rather than through signed_append_task_event because that
+-- wrapper needs a gateway decision this file has no business forging -- so it is labelled as
+-- a constructed pair, not as a claim about what any writer did.
+-- ---------------------------------------------------------------------------
+do $$
+declare v_ev uuid; v_task uuid; v_actor uuid; v_thread uuid;
+begin
+  select task, actor, thread into v_task, v_actor, v_thread from _op_fx;
+  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload, origin_posture)
+  values (v_task, v_thread, v_actor, 99, 'commented', '{}'::jsonb, 'attested:evidence-row')
+  returning id into v_ev;
+  insert into agent_board.signature_evidence(agent_id, source_kind, source_task_event_id, operation,
+                                             payload_digest, verification_status)
+  values (v_actor, 'task_event', v_ev, 'append_task_event', 'sha256:op22-constructed', 'verified');
+end $$;
+
+select is(
+  (select count(*)::int from agent_board.task_events te
+    where te.origin_posture like 'attested:%'
+      and exists (select 1 from agent_board.signature_evidence se
+                   where se.source_kind = 'task_event' and se.source_task_event_id = te.id)),
+  1,
+  'OP-22: OP-15 is exercised against a REAL attested row, not an empty set -- the positive direction of the same invariant');
+
+select * from finish();
+rollback;

package/tests/agent_board_task_thread_lock_order.test.sql

@@ -80,6 +80,10 @@ select distinct h.fn_name || ': ' ||
 select is(
   (select array_agg(m order by m) from _tt_ord),
   array[
+    -- #288: the funnel body moved here from append_task_event, carrying the #281 R1 order
+    -- with it. The public append_task_event still appears below, reaching the same two
+    -- acquisitions `via callee` -- so this row is a NEW member, not a relocated one.
+    '_append_task_event: threads(key share) then tasks(update)',
     '_upsert_delivery_recipient: threads(update) then tasks(key share)',
     'acquire_claim: same statement: threads(key share) + tasks(update)',
     'add_artifact: same statement: threads(key share) + tasks(update)',
@@ -112,8 +116,8 @@ select is(
   (select count(*)::text || ' functions acquire both; '
           || count(*) filter (where tasks_first)::text || ' take tasks before threads'
      from _tt_ord),
-  '20 functions acquire both; 0 take tasks before threads',
-  'TT-2: 20 functions acquire both relations and NONE takes tasks before threads');
+  '21 functions acquire both; 0 take tasks before threads',
+  'TT-2: 21 functions acquire both relations and NONE takes tasks before threads');
 
 -- ===========================================================================
 -- TT-3: append_task_event's acquisitions on the two relations, in path order, with mode
@@ -125,14 +129,14 @@ select is(
   (select string_agg(e.rel_name || ' ' || e.lock_mode || ' via ' || e.via, ' -> '
                      order by e.path, e.rel_name, e.lock_mode, e.via)
      from _tt_le e
-    where e.fn_name = 'append_task_event'
+    where e.fn_name = '_append_task_event'
       and e.rel_name in ('agent_board.tasks', 'agent_board.threads')),
   'agent_board.threads key share via textual'
   || ' -> agent_board.tasks update via textual'
   || ' -> agent_board.tasks key share via fk-insert:task_events_task_id_fkey'
   || ' -> agent_board.threads key share via fk-insert:task_events_thread_id_fkey'
   || ' -> agent_board.tasks update via write-update',
-  'TT-3: append_task_event takes threads(KEY SHARE, explicit) FIRST, then the tasks FOR UPDATE');
+  'TT-3: _append_task_event takes threads(KEY SHARE, explicit) FIRST, then the tasks FOR UPDATE');
 
 -- ===========================================================================
 -- TT-4: THE PREMISE THE PRE-READ RESTS ON. append_task_event now reads tasks.thread_id
@@ -179,11 +183,11 @@ select is(
 select is(
   (select coalesce(string_agg(distinct e.lock_mode, ', ' order by e.lock_mode), '<none>')
      from _tt_le e
-    where e.fn_name = 'append_task_event'
+    where e.fn_name = '_append_task_event'
       and e.rel_name = 'agent_board.tasks'
       and e.via = 'textual'),
   'update',
-  'TT-6: append_task_event still takes an EXPLICIT FOR UPDATE on tasks -- the sequence guard is intact');
+  'TT-6: _append_task_event still takes an EXPLICIT FOR UPDATE on tasks -- the sequence guard is intact');
 
 -- ===========================================================================
 -- TT-7: the second half of the fix, on its own. `_upsert_delivery_recipient` has no

package/tests/catalog/p_metadata_parameters.json

@@ -29,6 +29,10 @@
       "signature": "_agent_principal_active(p_agent_id uuid)",
       "declares_p_metadata": false
     },
+    {
+      "signature": "_append_task_event(p_origin_posture text, p_task_id uuid, p_actor_agent_id uuid, p_event_type text, p_payload jsonb, p_status text, p_assigned_agent_id uuid, p_completed_at timestamp with time zone)",
+      "declares_p_metadata": false
+    },
     {
       "signature": "_assert_actor_not_fleet_revoked(p_actor_agent_id uuid, p_operation text)",
       "declares_p_metadata": false