@consiliency/agent-board-schema 1.40.0 → 1.42.0

package/migrations/20260922000100_agent_board_board_claim_policy.sql

@@ -0,0 +1,376 @@
+-- Board-settable claim policy: let a board opt OUT of our ownerless claim enforcement.
+--
+-- THE ASK. A board's work may be coordinated by somebody else's locking — a repository lock, a
+-- scheduler lease, an external mutex — and our claim guards must not interfere with it. If their
+-- lock already granted the work, our TTL cap or quota rejecting the acquire is us breaking a
+-- system that was working. So enforcement becomes opt-out, and the board creator owns the switch.
+--
+-- WHAT THIS DOES NOT TOUCH, WHICH IS THE WHOLE SECURITY POINT. `advisory` disables the OWNERLESS
+-- guards only — the TTL cap and per-agent quota on 'file'/'tool'/'custom'. It does NOT and MUST
+-- NOT weaken:
+--
+--   * the fleet-authority gate on 'machine' / 'repository' / 'repo_file' (_can_claim_resource),
+--     which answers "may this agent claim this resource AT ALL" and is an authorization boundary,
+--     not a locking convenience;
+--   * the claim SUBJECT gate (#291), the task/thread access checks, or the uniqueness index that
+--     makes a claim exclusive in the first place.
+--
+-- The distinction is: a board may decline OUR LOCK. A board may not grant itself SOMEONE ELSE'S
+-- RESOURCE. Structurally this holds because the opt-out is inside the `v_ownerless` branch, which
+-- only the three ownerless kinds enter — and the fleet kinds are gated far above it. BCP-6 asserts
+-- it anyway rather than trusting the structure, because "it is in the right branch" is exactly the
+-- kind of reasoning that stops being true when someone moves a line.
+--
+-- WHY THE THREAD IS THE RESOLUTION PATH. `claims` has no board_id — a claim is scoped to an agent
+-- plus an optional task/thread. So the board is reached as claim -> thread -> threads.board_id.
+-- Three cases, all deliberate:
+--   * thread has a board, board says 'advisory'  -> guards skipped
+--   * thread has a board, board says 'inherit'   -> fleet-wide flags govern (the default)
+--   * no thread, or thread has no board          -> NO BOARD TO ASK, fleet-wide flags govern
+-- The last is the important one: a bare ownerless claim cannot opt itself out by omitting a
+-- thread. Opting out requires a board that a human owner deliberately configured. BCP-5 pins it.
+--
+-- DEFAULT IS 'inherit', so every existing board behaves exactly as it does today. This ships no
+-- behaviour change until a board owner asks for one.
+
+-- 1. The column.
+alter table agent_board.boards
+  add column if not exists claim_policy text not null default 'inherit';
+
+alter table agent_board.boards drop constraint if exists boards_claim_policy_check;
+alter table agent_board.boards add constraint boards_claim_policy_check
+  check (claim_policy in (
+    'inherit',   -- follow the fleet-wide claimgate flags (default; today's behaviour)
+    'advisory'   -- record claims, never enforce them: this board's locking lives elsewhere
+  ));
+
+comment on column agent_board.boards.claim_policy is
+  'Board-settable claim enforcement. ''inherit'' follows the fleet-wide claimgate flags. ''advisory'' means this board coordinates through some OTHER locking mechanism, so our ownerless (file/tool/custom) TTL cap and per-agent quota are recorded but not enforced for its claims. It does NOT weaken the fleet-authority gate on machine/repository/repo_file, the subject gate, or claim uniqueness — a board may decline our lock, never grant itself another owner''s resource. Set via agent_board.set_board_claim_policy (board owner only).';
+
+-- 2. Resolve a claim's board policy from its thread. STABLE and SECURITY DEFINER so the read is
+--    not subject to the caller's RLS — the policy is a property of the board, not of who is asking,
+--    and a caller who cannot see the board must still be governed by it.
+create or replace function agent_board._claimgate_board_claim_policy(p_thread_id uuid)
+returns text
+language sql
+stable
+security definer
+set search_path = agent_board, public
+as $$
+  select coalesce(
+    (select b.claim_policy
+       from agent_board.threads t
+       join agent_board.boards b on b.id = t.board_id
+      where t.id = p_thread_id),
+    'inherit')
+$$;
+
+revoke all on function agent_board._claimgate_board_claim_policy(uuid) from public, anon;
+grant execute on function agent_board._claimgate_board_claim_policy(uuid) to authenticated, service_role;
+
+comment on function agent_board._claimgate_board_claim_policy(uuid) is
+  'Resolves a claim''s governing board policy through its thread. Returns ''inherit'' when the thread is null, unknown, or not board-linked — so a claim with no board cannot opt itself out by omission; opting out requires a board an owner deliberately configured.';
+-- 3. acquire_claim, with the board opt-out folded into the ownerless condition.
+--    CREATE OR REPLACE with an unchanged signature, so the ACL and COMMENT survive.
+CREATE OR REPLACE FUNCTION agent_board.acquire_claim(p_agent_id uuid, p_resource_kind text, p_resource_key text, p_lease_expires_at timestamp with time zone, p_task_id uuid DEFAULT NULL::uuid, p_thread_id uuid DEFAULT NULL::uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(claim_id uuid, task_id uuid, thread_id uuid, agent_id uuid, resource_kind text, resource_key text, status text, lease_token uuid, lease_expires_at timestamp with time zone, released_at timestamp with time zone, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_thread_id uuid;
+  v_claim_id uuid;
+  v_actor_agent_id uuid;
+  v_shadow_authorized boolean;
+  v_ownerless boolean;
+  v_active_ownerless int;
+begin
+  v_actor_agent_id := agent_board._resolved_actor_agent_id(p_agent_id, 'p_agent_id');
+
+  if nullif(trim(p_resource_key), '') is null then
+    raise exception 'resource key is required' using errcode = '22023';
+  end if;
+
+  -- CLAIMKEY (#133): normalize the resource key to its canonical, fleet-fingerprint-carrying
+  -- form BEFORE any lookup/insert, so the row stored (and the uniqueness index contended)
+  -- carry canonical identity. NORMALIZE-ONLY — this never rejects (rejection is ENFORCE).
+  p_resource_key := agent_board._canonical_claim_key(p_resource_kind, p_resource_key);
+
+  if p_task_id is not null then
+    select tasks.thread_id into v_thread_id from agent_board.tasks where id = p_task_id;
+    if v_thread_id is null then
+      raise exception 'task not found' using errcode = 'P0002';
+    end if;
+    if not agent_board._current_agent_can_access_task(p_task_id) then
+      raise exception 'task not accessible to current agent' using errcode = '42501';
+    end if;
+  else
+    v_thread_id := p_thread_id;
+  end if;
+
+  if v_thread_id is not null and not agent_board._current_agent_can_access_thread(v_thread_id) then
+    raise exception 'thread not accessible to current agent' using errcode = '42501';
+  end if;
+
+  -- message-board#291: the SUBJECT gate. The checks above answer "may this SESSION touch the
+  -- task/thread" and are short-circuited true for service_role; this one answers "does the
+  -- agent the claim is ABOUT already have access". Without it a service_role caller could name
+  -- any agent, and the resulting claims row -- itself an access disjunct, and a PERMANENT one
+  -- -- would MINT thread access (and, through the thread disjunct of
+  -- _current_agent_can_access_task, task access) rather than record a lock on something the
+  -- subject could already see.
+  --
+  -- UNCONDITIONAL IN *WHO*. DO NOT "optimize" this into `if _is_service_role() and not ...` or
+  -- `if v_actor_agent_id is distinct from agent_board.current_agent_id()`. For an authenticated
+  -- caller v_actor_agent_id IS current_agent_id() and the session check above already
+  -- established this same expression, so the redundancy is PROVABLE rather than suspected; it
+  -- is the price of an invariant this function states for itself instead of borrowing from
+  -- _resolved_actor_agent_id continuing to raise on a subject mismatch.
+  --
+  -- CONDITIONAL ON *THREAD PRESENCE*, which is not a loophole. A claim bound to neither a task
+  -- nor a thread stores thread_id = null, is a disjunct of nothing and mints no access.
+  -- _agent_can_access_thread answers false for a null thread, so gating unconditionally would
+  -- refuse every machine / repository / repo_file / ownerless claim in the fleet. This covers
+  -- exactly the claims that are keys.
+  --
+  -- PLACED AFTER THE TASK LOOKUP so a nonexistent task still answers P0002, not 42501 -- that
+  -- ordering IS test-pinned. Placed BEFORE the sweep only to match the predicate-before-side-
+  -- effects convention CLAIMGATE/ENFORCE states below; it is NOT what makes a denial free of
+  -- side effects. `raise exception` unwinds the whole call, so a refused caller changes no state
+  -- wherever this sits -- measured, by moving the gate below the sweep and observing the test
+  -- file stay entirely green.
+  if v_thread_id is not null
+     and not agent_board._agent_can_access_thread(v_thread_id, v_actor_agent_id) then
+    raise exception 'claim subject has no access to thread' using errcode = '42501';
+  end if;
+
+  -- OBSGATE-4 (#127): a claim on a TASK resource is authorized on the LOCKED task = the task
+  -- named by RESOURCE_KEY (resource_kind='task'). The active-resource uniqueness is on
+  -- (resource_kind, resource_key), so that is the task a squat contends for — gating resource_key
+  -- (NOT p_task_id, which only associates the claim/event) prevents locking task B's key while
+  -- authorizing on an unrelated task A passed as p_task_id. A non-uuid 'task' key cannot collide
+  -- with a uuid-keyed legitimate claim.
+  --
+  -- The composition MIRRORS append_task_event's: ACCESS then MUTATE. mutate alone is
+  -- insufficient — _current_agent_can_mutate_task admits any non-observer board member via
+  -- _current_agent_can_post_to_thread (board send-role), which is NOT thread access; on a
+  -- RESTRICTED thread a board member lacking thread access would pass mutate but must still be
+  -- denied (they cannot access the task). Requiring access too closes that gap and matches the
+  -- authorization a task-BOUND acquire already gets through append_task_event.
+  if p_resource_kind = 'task'
+     and p_resource_key ~ '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$' then
+    if not agent_board._current_agent_can_access_task(p_resource_key::uuid) then
+      raise exception 'task not accessible to current agent' using errcode = '42501';
+    end if;
+    if not agent_board._current_agent_can_mutate_task(p_resource_key::uuid) then
+      raise exception 'claiming a task resource requires a non-observer board role, or task assignment/creation'
+        using errcode = '42501';
+    end if;
+  end if;
+
+  -- CLAIMGATE/SHADOW (#133): compute the fleet-graph authority verdict BEFORE the sweep (so
+  -- ENFORCE can flip this same point fail-closed with no observable side effect leaking to an
+  -- unauthorized caller). The verdict is stamped below regardless of enforcement.
+  v_shadow_authorized := agent_board._can_claim_resource(p_resource_kind, p_resource_key);
+
+  -- CLAIMGATE/ENFORCE (#133): per-kind GATED DENIAL, BEFORE the sweep (predicate-before-side-
+  -- effects). When this fleet-backed kind's flag is ON and the actor is UNAUTHORIZED, DENY —
+  -- no state has changed yet (sweep/insert are below). When OFF, fall through to the shadow-
+  -- stamp only (SHADOW behavior; blocks nothing). Non-fleet kinds never kind-enforce (resolver
+  -- returns FALSE). service_role is authorized by the predicate (wrapper short-circuit), so the
+  -- operator carve-out holds. Fail-closed-on-unknown is automatic: an unresolvable fleet resource
+  -- makes v_shadow_authorized FALSE, so an enforced acquire of it denies.
+  if p_resource_kind in ('machine', 'repository', 'repo_file')
+     and agent_board._claimgate_kind_enforced(p_resource_kind)
+     and not v_shadow_authorized then
+    raise exception 'not authorized to claim this % resource (fleet authority required)', p_resource_kind
+      using errcode = '42501';
+  end if;
+
+  -- CLAIMGATE/ENFORCE (#133): max-lease horizon. For an ENFORCED fleet-backed kind, CLAMP the
+  -- lease to now()+horizon (default 30d, operator-configurable) — a bound on lease term, NOT an
+  -- authority block. Clamp (not reject) so an over-long lease reconciles here / at its next renew.
+  -- service_role exempt (operator carve-out). Only reached by an AUTHORIZED acquire (unauthorized
+  -- was denied above), or when the flag is OFF (then the guard below is skipped entirely).
+  if p_resource_kind in ('machine', 'repository', 'repo_file')
+     and not agent_board._is_service_role()
+     and agent_board._claimgate_kind_enforced(p_resource_kind)
+     and p_lease_expires_at > now() + agent_board._claimgate_max_lease_horizon() then
+    p_lease_expires_at := now() + agent_board._claimgate_max_lease_horizon();
+  end if;
+
+  -- Ownerless tail (file/tool/custom): the ONE guard SHADOW carries — GATED OFF BY DEFAULT.
+  -- _claimgate_ownerless_guards_enabled() is false unless an operator flips it post-census, so in
+  -- SHADOW this block is skipped entirely and NOTHING is blocked (only the stamp above lands).
+  -- service_role is also exempt (operator carve-out, consistent with the predicate short-circuit).
+  v_ownerless := p_resource_kind in ('file', 'tool', 'custom');
+  if v_ownerless
+     and not agent_board._is_service_role()
+     and agent_board._claimgate_ownerless_guards_enabled()
+     -- BOARD OPT-OUT: a board whose work is coordinated by SOMEONE ELSE'S locking (a repo lock, a
+     -- scheduler lease, an external mutex) can set claim_policy='advisory'. Our claims are then
+     -- RECORDED for visibility and never ENFORCED, so we cannot reject an acquire that their own
+     -- lock already permitted. Resolved from the claim's thread; a claim with no thread, or a
+     -- thread with no board, has no board to ask and falls back to the fleet-wide flags.
+     and agent_board._claimgate_board_claim_policy(v_thread_id) <> 'advisory' then
+    -- TTL CAP: an ownerless lease may not exceed the max horizon. Rejects an over-long acquire;
+    -- this is a lease-length bound, NOT an authority block.
+    if p_lease_expires_at > now() + agent_board._claimgate_ownerless_ttl_cap() then
+      raise exception 'ownerless claim lease horizon exceeds cap (%)', agent_board._claimgate_ownerless_ttl_cap()
+        using errcode = '22023';
+    end if;
+
+    -- QUOTA (transactionally serialized): an actor-scoped advisory XACT lock serializes this
+    -- actor's concurrent acquisitions (on DIFFERENT keys, which the row-level uniqueness index
+    -- does NOT), so a count-before-insert cannot race two claims past the cap. The lock releases
+    -- at commit; it does not block other actors (the key mixes in the actor id).
+    perform pg_advisory_xact_lock(hashtext('agent_board.claimgate_ownerless_quota'), hashtext(v_actor_agent_id::text));
+    select count(*) into v_active_ownerless
+      from agent_board.claims c
+     where c.agent_id = v_actor_agent_id
+       and c.resource_kind in ('file', 'tool', 'custom')
+       and c.status = 'active'
+       and c.released_at is null
+       and c.lease_expires_at > now();
+    if v_active_ownerless >= agent_board._claimgate_ownerless_quota() then
+      raise exception 'ownerless active-claim quota reached (% per agent)', agent_board._claimgate_ownerless_quota()
+        using errcode = '54000';
+    end if;
+  end if;
+
+  -- CLAIMKEY (#133) MUST-FIX 3: the sweep AND the conflict check are ALIAS-AWARE. p_resource_key
+  -- is already canonical (above); comparing against the CANONICAL form of each existing row's key
+  -- matches both a canonical row AND an un-healed LEGACY row for the same physical resource. Without
+  -- this, acquire('machine','machine:fpDH') would normalize to 'fpDH', see no exact-'fpDH' conflict
+  -- against a still-active legacy 'machine:fpDH' row, and INSERT a second live hold — breaking mutual
+  -- exclusion during the legacy window. Closing it here in code does NOT depend on the operator-owned
+  -- live census.
+  update agent_board.claims c
+     set status = 'expired',
+         updated_at = now()
+   where c.resource_kind = p_resource_kind
+     and agent_board._canonical_claim_key(c.resource_kind, c.resource_key) = p_resource_key
+     and c.status = 'active'
+     and c.released_at is null
+     and c.lease_expires_at <= now();
+
+  if exists (
+    select 1 from agent_board.claims
+     where claims.resource_kind = p_resource_kind
+       and agent_board._canonical_claim_key(claims.resource_kind, claims.resource_key) = p_resource_key
+       and claims.status = 'active'
+       and claims.released_at is null
+       and claims.lease_expires_at > now()
+  ) then
+    raise exception 'conflicting active claim' using errcode = '23505';
+  end if;
+
+  insert into agent_board.claims(task_id, thread_id, agent_id, resource_kind, resource_key, lease_expires_at, metadata)
+  values (
+    p_task_id, v_thread_id, v_actor_agent_id, p_resource_kind, p_resource_key, p_lease_expires_at,
+    -- SHADOW stamp: record the authority verdict alongside any caller metadata. Merged last so it
+    -- is authoritative over a caller-supplied claimgate_shadow key.
+    coalesce(p_metadata, '{}'::jsonb)
+      || jsonb_build_object(
+           'claimgate_shadow',
+           jsonb_build_object('kind', p_resource_kind, 'authorized', v_shadow_authorized)
+         )
+  )
+  returning id into v_claim_id;
+
+  if p_task_id is not null then
+    perform agent_board._append_task_event('unattested:signed-metadata-rpc', p_task_id, v_actor_agent_id, 'claimed', jsonb_build_object('claim_id', v_claim_id, 'resource_kind', p_resource_kind, 'resource_key', p_resource_key));
+  end if;
+
+  return query
+  select c.id, c.task_id, c.thread_id, c.agent_id, c.resource_kind, c.resource_key, c.status, c.lease_token, c.lease_expires_at, c.released_at, c.created_at, c.updated_at
+    from agent_board.claims c
+   where c.id = v_claim_id;
+end;
+$function$;
+-- 4. The setter. Owner-gated, mirroring set_board_role_gate rather than inventing a second
+--    authorization shape: the same membership test, the same service_role refusal, and the same
+--    post-UPDATE fleet-revocation assertion.
+--
+--    THE REFUSAL IS A REAL BOUNDARY, not a formality. An earlier draft of this comment said an
+--    operator "can write the column directly with the grant it already holds" — inherited wording,
+--    and it overstates the operator's reach in THIS repo: service_role holds SELECT on boards and
+--    an RLS FOR ALL policy, but NO GRANT UPDATE, so that policy does not write. Changing the
+--    column outside this RPC needs the table owner. Flagged by a review seat that checked the
+--    grants instead of reading the sentence.
+--
+--    The point of the RPC is that a BOARD CREATOR can set this without an operator at all.
+create or replace function agent_board.set_board_claim_policy(
+  p_board_id uuid,
+  p_claim_policy text
+)
+returns table(
+  board_id uuid,
+  claim_policy text,
+  updated_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_actor uuid := agent_board.current_agent_id();
+  v_row agent_board.boards%rowtype;
+begin
+  if p_claim_policy is null then
+    raise exception 'p_claim_policy must not be null' using errcode = '22023';
+  end if;
+  -- Validated HERE as well as by the column CHECK. The CHECK would reject an unknown value
+  -- anyway, but with a constraint-violation error naming an internal constraint; a caller asking
+  -- for 'off' deserves to be told the vocabulary, not handed 23514.
+  if p_claim_policy not in ('inherit', 'advisory') then
+    raise exception 'claim policy must be one of inherit, advisory (received %)', p_claim_policy
+      using errcode = '22023';
+  end if;
+
+  -- Owner gate: only an active owner-role member may set this. service_role
+  -- (current_agent_id() = null) is not an owner and is rejected here.
+  if v_actor is null
+     or not exists (
+       select 1
+         from agent_board.board_memberships bm
+        where bm.board_id = p_board_id
+          and bm.agent_id = v_actor
+          and bm.role = 'owner'
+          and bm.membership_state in ('joined', 'subscribed')
+     ) then
+    raise exception 'only a board owner may set the claim policy' using errcode = '42501';
+  end if;
+
+  update agent_board.boards b
+     set claim_policy = p_claim_policy,
+         updated_at = now()
+   where b.id = p_board_id
+  returning * into v_row;
+
+  if v_row.id is null then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+
+  -- #276, AFTER the boards UPDATE so this function's order is boards -> agents, the canonical one
+  -- (#194). Fleet revocation deliberately LEAVES agents.status = 'active' -- the ledger row is the
+  -- only authority signal -- so the owner-membership check above passes for a revoked owner and
+  -- cannot stand alone. Disabling this board's claim enforcement is an authority write in the same
+  -- class as flipping the role gate, which is why the mirror has to include this call and not just
+  -- the membership test. Same transaction: the raise rolls the UPDATE back.
+  --
+  -- This was MISSING in the first version of this function, which claimed in its own commit
+  -- message to mirror set_board_role_gate "exactly". A review seat found it by reading both
+  -- functions side by side rather than taking that claim.
+  perform agent_board._assert_actor_not_fleet_revoked(v_actor, 'set_board_claim_policy');
+
+  return query select v_row.id, v_row.claim_policy, v_row.updated_at;
+end;
+$$;
+
+revoke all on function agent_board.set_board_claim_policy(uuid, text) from public, anon;
+grant execute on function agent_board.set_board_claim_policy(uuid, text) to authenticated, service_role;
+
+comment on function agent_board.set_board_claim_policy(uuid, text) is
+  'Board-owner-only. Sets boards.claim_policy to ''inherit'' (follow the fleet-wide claimgate flags) or ''advisory'' (this board coordinates through another locking mechanism, so our ownerless file/tool/custom TTL cap and quota are recorded but not enforced). Never weakens the fleet-authority gate on machine/repository/repo_file, the subject gate, or claim uniqueness. Owner gate and service_role refusal mirror set_board_role_gate.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.40.0",
+  "version": "1.42.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.40.0",
+  "packageVersion": "1.42.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 138,
-  "aggregateSha256": "e5e6870533c69d20b446431b6fb19693588d9eb4bb55e1fb3f7f239afcfa76c0",
+  "migrationCount": 140,
+  "aggregateSha256": "d82adb3013e8a1118ecae11a3aff4d3f0e7b6f7d53f7116d9565d22b2eca1e93",
   "migrations": [
     {
       "order": 0,
@@ -1290,6 +1290,24 @@
       "sourceRef": "message-board",
       "bytes": 7556,
       "sha256": "670d6e97ca84ef74ebd10a6ee102c328005a28aa48f8668ba444ce31b714cf02"
+    },
+    {
+      "order": 138,
+      "id": "20260921000100_agent_board_task_event_origin_posture",
+      "filename": "20260921000100_agent_board_task_event_origin_posture.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 48237,
+      "sha256": "c515e9cd08b73c118de64125da94735979add5d1128d3ff070ff904af77fef81"
+    },
+    {
+      "order": 139,
+      "id": "20260922000100_agent_board_board_claim_policy",
+      "filename": "20260922000100_agent_board_board_claim_policy.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 22285,
+      "sha256": "1363a194f50342feb613a1aa1e01321a2a81783d88dfebe2c8f2002170cdc25c"
     }
   ],
   "excludedBridge": {

package/src/tooling.test.mjs

@@ -38,9 +38,9 @@ describe('manifest integrity', () => {
     expect(manifest.schemaVersion).toBe(8);
     expect(manifest.minClientVersion).toMatch(/^\d+\.\d+\.\d+$/);
   });
-  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 138)', () => {
+  it('registers the four MBAUTHZ + four MBSENDAUTHZ + four MBSESSION + four MBDELEG + three MBFED + three MBHARDEN + two MBPORTALGATE + two MBPORTAL-PR32 + two ROOMOWN + two ROOMLINK + one ROOMDELEG + one LOCALAUTH + one ROOMUIAPI + one FEDSESSION + one FEDSESSION-AUTOJOIN + one GATENULL + one MEMBSTATE + one AGENTSDIR + one LEAVEIDEM + one ROLERESET + one MBROWID + one MBHYGIENE + one MBCONSENT-A + one MBCONSENT-B(a) + one MBCONSENT-B(i) + one MBCONSENT-B(ii) + one MBCONSENT-B(iii) + one MBHARDEN-#97 + one MBHARDEN-#118 + one INVITEPOLICY + one OBSGATE + one OBSGATE-2 + one OBSGATE-3 + one OBSGATE-4 + one FLEETMACHINERLS + one RESOLVENOOP + one ROOMDELEG-LANEB + one CLAIMKEY + two MINTHARDEN + one FLEETMACHINEHIJACK + one CLAIMGATE-SHADOW + one CLAIMGATE-ENFORCE + one FLEETMACHINEREACTIVATION + one DELEGCAPCEILING + one FLEETMACHINERECLAIM + one DELEGSOLEWRITER + one FLEETDOMAINRECLAIM + five ATOMICFLEETONBOARDING (onboarding + ceiling-lock + revocation-evidence + fedsession-gate + fedsession-lock-order) + one OUTBOXWAKE + one ENROLLLOCKORDER + one FEDPROVIDERABSENCE + one WAKERECOVERY + one CONSENTRECONCILE + one ENROLLRESUMPTION + one SIGNEDAUTHORITY + one SIGNERLIFECYCLE + one LEDGERAUTHORITY + one CEILINGLOCKCOMMENT + one LEDGERBOARDCREATE + one RECEIPTSUBJECTGATE + one TASKTHREADLOCKORDER + one CLAIMSUBJECTGATE + one FEDSESSIONIDENTITYGATE + one FEDIDENTITYSLUG + one INVITENODOWNGRADE + one SIGNEDWRITEFLAG + one SIGNEDWRITEMODEL + one RTCREDCLAIM + one ORIGINPOSTURE + one BOARDCLAIMPOLICY forward migrations (migrationCount = prior 113 + 5 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 = 140)', () => {
     expect(manifest.migrationCount).toBe(manifest.migrations.length);
-    expect(manifest.migrationCount).toBe(138);
+    expect(manifest.migrationCount).toBe(140);
     // MBSESSION switched enforcement on (scoped-send re-grant): the client-visible
     // schema version bumped to 8. MBDELEG tightens delegation and MBFED adds only
     // enrollment-only additive surface (identity_providers registry, enrollment audit,
@@ -233,6 +233,26 @@ describe('manifest integrity', () => {
       // sources still takes the permissive branch. Definition-only: CREATE OR REPLACE with the
       // identical signature, grants and COMMENT restated in the same migration.
       '20260920000100_agent_board_realtime_credential_claim.sql',
+      // #288 ORIGINPOSTURE. v_task_tree.verification_status was NULL for every task_event
+      // except the two written by a signed wrapper, and NULL cannot be told apart from
+      // "evidence was lost", "the writer forgot" and "unsigned on purpose". The class was
+      // derived by CALL CLOSURE (a member iff its closure reaches an INSERT INTO task_events):
+      // 12 members, where the issue body said 8 and its own triage comment said 5-6 -- neither
+      // naming create_tasking_delivery or signed_create_tasking_delivery. task_events gains
+      // origin_posture NOT NULL with NO DEFAULT, so a new direct-INSERT writer cannot insert at
+      // all; the funnel body moves behind an ungranted _append_task_event whose posture
+      // parameter is FIRST and undefaulted, which is what makes "no default" structural --
+      // PostgreSQL refuses a default before non-defaulted parameters. Nothing is DROPped: both
+      // public signatures stay byte-identical, so ACLs and COMMENTs survive.
+      '20260921000100_agent_board_task_event_origin_posture.sql',
+      // BOARDCLAIMPOLICY. A board's work may be coordinated by SOMEONE ELSE'S locking -- a repo
+      // lock, a scheduler lease, an external mutex -- and our claim guards must not break a system
+      // that was already working. boards.claim_policy lets the board OWNER opt out: 'inherit'
+      // (default, today's behaviour) or 'advisory' (record claims, never enforce them). It
+      // disables the OWNERLESS file/tool/custom lease cap and quota ONLY, and cannot reach the
+      // fleet-authority gate on machine/repository/repo_file -- a board may decline our lock,
+      // never grant itself another owner's resource (BCP-6 asserts that from the catalog).
+      '20260922000100_agent_board_board_claim_policy.sql',
     ]) {
       expect(names.has(f)).toBe(true);
     }

package/tests/agent_board_auth_rls.test.sql

@@ -72,10 +72,15 @@ begin
     (v_task_a, v_thread_a, v_agent_a, v_agent_a, v_task_a, 'Auth RLS Task A', 'medium', 'distributed'),
     (v_task_b, v_thread_b, v_agent_b, v_agent_b, v_task_b, 'Auth RLS Task B', 'medium', 'distributed');
 
-  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload)
+  -- #288: origin_posture is NOT NULL with no default, so this raw fixture insert must declare
+  -- one like any other writer. It emulates create_task's seq-1 'created' event, so it declares
+  -- create_task's own posture rather than a test-only placeholder -- a fixture that labelled
+  -- itself differently from the writer it stands in for would make OP-15-style invariants
+  -- assert against a shape production never produces.
+  insert into agent_board.task_events(task_id, thread_id, actor_agent_id, event_sequence, event_type, payload, origin_posture)
   values
-    (v_task_a, v_thread_a, v_agent_a, 1, 'created', '{}'::jsonb),
-    (v_task_b, v_thread_b, v_agent_b, 1, 'created', '{}'::jsonb);
+    (v_task_a, v_thread_a, v_agent_a, 1, 'created', '{}'::jsonb, 'unattested:signed-metadata-rpc'),
+    (v_task_b, v_thread_b, v_agent_b, 1, 'created', '{}'::jsonb, 'unattested:signed-metadata-rpc');
 
   insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, message_type, body)
   values