@consiliency/agent-board-schema 1.63.0 → 1.68.0

package/README.md

@@ -7,6 +7,31 @@ and materialize it — they do not author `agent_board` DDL.
 
 ## What's in the bundle
 
+Schema 1.68.0 requires a resolved active owner/admin principal to resolve pending
+memberships, independently of the board role gate or creator identity. Like the
+pending-list reader, it refuses unresolved service-role sessions. It keeps 1.67.0's
+session-derived attribution: the resolution write and redundant-request retirement
+are attributed to the resolving session agent, never to `p_created_by_agent_id`.
+
+Schema 1.67.0 derives invitation, request-resolution (including redundant-request
+retirement), and self-join attribution from the session agent. The compatibility
+`p_created_by_agent_id` argument is ignored. An unresolved service operator supplies
+no agent attribution; existing row provenance is retained on NULL updates.
+
+Schema 1.66.0 refuses join requests while removed standing remains. The request
+RPC locks the subject's existing rows before deciding standing, preserving
+eviction evidence and the existing active-member no-op.
+
+Schema 1.65.0 repairs thread and delegation RLS correlation to the protected
+row and grants authenticated execution of the existing read predicates used
+by ceiling and thread-membership policies. Unrelated rows remain hidden.
+
+Schema 1.64.0 adds `20261014000200_agent_board_last_owner.sql`: a refusal-only
+table-level last-active-owner invariant, preserving the 1.63.0 role-grant policy.
+Concurrent departures serialize per board; recovery remains service_role-only.
+SQL schema version remains 8. See `specs/rpc-contracts.md` for refusal/retry
+semantics. This is the working-tree contract, not a deployment receipt.
+
 - `migrations/` — the ordered, immutable SQL union (frozen baseline + lane
   migrations + the Message Board-owned endpoint compatibility migration).
 - `schema-manifest.json` — package version, `agent_board.schema_version`, ordered

package/fixtures/already-applied.json

@@ -644,6 +644,26 @@
   {
    "id": "20261014000100_agent_board_grant_target_role",
    "sha256": "4a6c00546a1d2837f88eece1de082cc76eec1f85cce8cf9ac7998e42bf32a5c5"
+  },
+  {
+   "id": "20261014000200_agent_board_last_owner",
+   "sha256": "2fed8fc5a2c7c0ba9acbb12872b329db3f0902d96597c52cc50e21e4682c2fff"
+  },
+  {
+   "id": "20261015000100_agent_board_session_provenance",
+   "sha256": "b5e3c7fc859dff7c3a0ccd4c0a7fb22d6ada1df68cb028be138035b586e1462a"
+  },
+  {
+   "id": "20261015000200_agent_board_request_preserve_removed",
+   "sha256": "9bad7438909e9c02cc034b59af67fa962e7251bedb53d691e762e651ba1c343c"
+  },
+  {
+   "id": "20261015000300_agent_board_rls_correlation",
+   "sha256": "aafe4a4b6eb1b6a5e3f0b5fbd8b4e4d395399de079c6a7b2eb2535ef4514bdc4"
+  },
+  {
+   "id": "20261015000400_agent_board_resolution_authority",
+   "sha256": "bfeb7bda1eb41bc431416502db69c33156ff72acfd79cefdfd556d933f79d809"
   }
  ]
 }

package/migrations/20261014000200_agent_board_last_owner.sql

@@ -0,0 +1,239 @@
+-- Consiliency/message-board#675: row-level last-active-owner invariant, schema 1.64.0.
+-- Main's grant_board_role body, ACL and COMMENT remain unchanged (schema 1.63.0).
+-- The trigger is refusal-only: it never assigns NEW or clamps a role. The
+-- 20260802000100 / 20260803000100 prohibition concerns a role-changing clamp
+-- that would erase intentional owner/admin seeds; this UPDATE/DELETE guard
+-- leaves all allowed writes and INSERT seeders unchanged.
+
+CREATE OR REPLACE FUNCTION agent_board.update_board_membership(p_board_id uuid, p_agent_id uuid, p_membership_state text, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, left_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+AS $function$
+declare
+  v_membership agent_board.board_memberships%rowtype;
+  v_board agent_board.boards%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+  v_is_service boolean := agent_board._is_service_role();
+  v_existing_state text;
+  v_target_role text;
+  v_actor_role text;
+  -- HOSTED (D7): the caller is the target hosted delegate's principal asking for `left`.
+  v_principal_withdraw boolean;
+begin
+  if v_actor is null and not v_is_service then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  -- Board authority lock first, before the target row and the sink's FK locks.
+  perform agent_board._lock_board_authority_ceiling(p_board_id);
+
+  v_principal_withdraw := not v_is_service
+    and v_actor <> p_agent_id
+    and p_membership_state = 'left'
+    and v_actor = agent_board._delegate_principal_agent_id(p_agent_id);
+
+  if not v_is_service and v_actor <> p_agent_id and not v_principal_withdraw then
+    select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+    if v_board.id is null then
+      raise exception 'board not found' using errcode = 'P0002';
+    end if;
+    select bm.role
+      into v_actor_role
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = v_actor
+       and bm.membership_state in ('joined', 'subscribed')
+     limit 1;
+    if v_actor_role is null or v_actor_role not in ('owner', 'admin') then
+      raise exception 'board membership change requires owner or admin role'
+        using errcode = '42501';
+    end if;
+  end if;
+
+  -- HOSTED: LOCKED, so every transition rule below is decided on the state the sink will
+  -- overwrite. Unlocked, an admin's uncommitted `removed` committed after this read, and the D7
+  -- withdrawal (and an ordinary self-leave, the same branch shape) then wrote `left` over it in
+  -- the sink, erasing the eviction R-LINK-7 reads (hosted_delegate_withdraw_evict_race). The
+  -- sink's own first lock is this same row in the same order, so the lock set is unchanged;
+  -- it is only taken earlier, before reads that lock nothing.
+  select bm.membership_state, bm.role
+    into v_existing_state, v_target_role
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   order by
+     case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+     bm.created_at desc,
+     bm.id desc
+   limit 1
+   for update;
+  if v_existing_state is null then
+    raise exception 'board membership not found' using errcode = 'P0002';
+  end if;
+
+  if v_principal_withdraw then
+    -- HOSTED (D7): the owner withdraws its own delegate whatever its board role, but ONLY from
+    -- the states a self-leave may leave. Never from `removed`: turning an eviction into `left`
+    -- would erase the standing R-LINK-7 reads and let the owner re-add the evicted delegate.
+    if v_existing_state not in ('joined', 'subscribed', 'invited', 'requested') then
+      raise exception 'a principal may withdraw its delegate only from an active or pending membership'
+        using errcode = '42501';
+    end if;
+  elsif not v_is_service then
+    if v_actor = p_agent_id then
+      if not (
+        (p_membership_state = 'left'
+         and v_existing_state in ('joined', 'subscribed', 'invited', 'requested'))
+        or (p_membership_state in ('joined', 'subscribed')
+            and v_existing_state in ('joined', 'subscribed'))
+        or (p_membership_state = v_existing_state
+            and p_membership_state in ('left', 'removed'))
+      ) then
+        raise exception 'self membership change not permitted; use the join/approval path'
+          using errcode = '42501';
+      end if;
+    else
+      if agent_board._role_rank(v_actor_role)
+         <= agent_board._role_rank(
+              case
+                when p_membership_state in ('joined', 'subscribed')
+                 and coalesce(v_existing_state, '') not in ('joined', 'subscribed')
+                then 'member'
+                else coalesce(v_target_role, '')
+              end) then
+        raise exception 'board membership change requires a higher board role than the target'
+          using errcode = '42501';
+      end if;
+
+      if p_membership_state in ('joined', 'subscribed')
+         and coalesce(v_existing_state, '') not in ('joined', 'subscribed')
+         and not agent_board._membership_consent_present(p_board_id, p_agent_id) then
+        raise exception 'admitting % requires an act by that agent', p_agent_id
+          using errcode = '42501';
+      end if;
+
+      -- INVITEPOLICY (#90): seating an inbound-disclosure membership ('invited'/'requested')
+      -- for a target that has blocked THIS actor is refused, mirroring invite_board_member.
+      -- Without this, an owner/admin re-seats the exact row the block refuses. Active-admission
+      -- states are already consent-gated above; service_role/self never reach this branch.
+      if p_membership_state in ('invited', 'requested')
+         and not agent_board._invite_permitted(p_board_id, p_agent_id, v_actor) then
+        raise exception 'target has blocked invitations from this inviter on this board'
+          using errcode = '42501';
+      end if;
+    end if;
+  end if;
+
+  if not v_is_service
+     and p_membership_state = v_existing_state
+     and p_membership_state in ('left', 'removed') then
+    return query
+    select bm.id, bm.board_id, bm.agent_id, bm.membership_state, bm.left_at, bm.updated_at
+      from agent_board.board_memberships bm
+     where bm.board_id = p_board_id
+       and bm.agent_id = p_agent_id
+     order by
+       case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+       bm.created_at desc,
+       bm.id desc
+     limit 1;
+    return;
+  end if;
+
+  select * into v_membership
+    from agent_board._upsert_board_membership_state(
+      p_board_id,
+      p_agent_id,
+      p_membership_state,
+      null,
+      p_metadata
+    );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.left_at, v_membership.updated_at;
+end;
+$function$;
+
+-- Consiliency/message-board#675: enforce at the table so every RPC, raw writer,
+-- DELETE and FK cascade has the same invariant. Existing ownerless boards remain usable.
+create or replace function agent_board._board_memberships_last_owner_guard()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $function$
+declare
+  v_key bigint := pg_catalog.hashtextextended(
+    'agent_board.board_authority_ceilings:' || old.board_id::text, 0);
+begin
+  if old.role <> 'owner' or old.membership_state not in ('joined', 'subscribed') then
+    if tg_op = 'DELETE' then return old; else return new; end if;
+  end if;
+  if tg_op = 'UPDATE' then
+    if new.board_id = old.board_id and new.agent_id = old.agent_id and new.role = 'owner'
+       and new.membership_state in ('joined', 'subscribed') then
+      return new;
+    end if;
+  end if;
+  -- Deleting the board itself is not leaving an existing board ownerless.
+  if not exists (select 1 from agent_board.boards where id = old.board_id) then
+    if tg_op = 'DELETE' then return old; else return new; end if;
+  end if;
+  -- A transaction snapshot does not advance after an advisory-lock wait.
+  if current_setting('transaction_isolation') <> 'read committed' then
+    raise exception 'last_active_board_owner: owner transitions require read committed'
+      using errcode = '25001';
+  end if;
+  -- Require the board mutex to have been acquired BEFORE the row lock. This
+  -- covers raw DML and cascades without taking a waiting lock in reverse order.
+  if not exists (
+    select 1 from pg_catalog.pg_locks l
+     where l.locktype = 'advisory' and l.pid = pg_catalog.pg_backend_pid()
+       and l.database = (select oid from pg_catalog.pg_database where datname = current_database())
+       and l.classid = ((v_key >> 32) & 4294967295)::oid
+       and l.objid = (v_key & 4294967295)::oid and l.objsubid = 1
+       and l.mode = 'ExclusiveLock' and l.granted
+  ) then
+    raise exception 'last_active_board_owner: acquire board authority lock before owner transition'
+      using errcode = '55000';
+  end if;
+  -- Re-entrant: it CANNOT wait, since this backend already holds the exclusive
+  -- key. Promote a session-level lock to transaction lifetime so releasing the
+  -- session lock early cannot let a second departure miss our uncommitted exit.
+  perform pg_catalog.pg_advisory_xact_lock(v_key);
+  -- A separate volatile statement has a fresh read-committed snapshot.
+  if not exists (
+    select 1 from agent_board.board_memberships bm
+     where bm.board_id = old.board_id and bm.id <> old.id
+       and bm.role = 'owner' and bm.membership_state in ('joined', 'subscribed')
+  ) then
+    raise exception 'last_active_board_owner: cannot remove the last active owner'
+      using errcode = '23514';
+  end if;
+  if tg_op = 'DELETE' then return old; else return new; end if;
+end;
+$function$;
+
+revoke all on function agent_board._board_memberships_last_owner_guard()
+  from public, anon, authenticated, service_role, agent_board_delegate;
+comment on function agent_board._board_memberships_last_owner_guard() is
+  'Consiliency/message-board#675: table-level UPDATE/DELETE guard against removing the last joined/subscribed owner of an existing board, including raw DML and cascades. No service-role bypass. Owner transitions require read committed and serialize to commit on the board authority advisory key; a pre-held exclusive board advisory lock is required (55000 otherwise) and reacquired re-entrantly for transaction lifetime. All waiting locks precede row locks. Existing ownerless boards and unrelated writes are unaffected; recovery by restoring ownership remains service_role-only.';
+
+create trigger trg_board_memberships_last_owner_guard
+  before update or delete on agent_board.board_memberships
+  for each row execute function agent_board._board_memberships_last_owner_guard();
+comment on trigger trg_board_memberships_last_owner_guard on agent_board.board_memberships is
+  'Refuse only a transition that removes an existing active owner and leaves no other active owner; every membership writer is covered by construction. Refusal-only: NEW is never rewritten. A future hard agent delete must acquire every owned board advisory lock before agent or membership row locks.';
+
+revoke all on function agent_board.update_board_membership(uuid,uuid,text,jsonb)
+  from public, anon, agent_board_delegate;
+grant execute on function agent_board.update_board_membership(uuid,uuid,text,jsonb)
+  to authenticated, service_role;
+
+comment on function agent_board.update_board_membership(uuid,uuid,text,jsonb) is
+  'Authorized membership state transitions with existing self, principal-withdrawal, rank, consent and idempotency rules. Consiliency/message-board#675: board advisory lock before target membership/FK locks; the table refuses any transition removing the last active owner.';
+
+comment on function agent_board._lock_board_authority_ceiling(uuid) is
+  'Board-keyed transaction advisory lock serializing the ABSENCE of a board_authority_ceilings row, held to commit. WRITERS[serialized: set_board_authority_ceiling][UNSERIALIZED: (none)] READERS[serialized: add_delegate_to_board, grant_board_role, link_session_alias, mint_delegated_child, onboard_federated_fleet_agent, readmit_session_identity][UNSERIALIZED: _redeem_unbounded_invite_for_agent, create_invite_link] The SIDSCHEMA readers take the mutexes for every requested or existing descendant room before root, identity and membership locks. The two UNSERIALIZED readers still evaluate a missing ceiling as default-owner without serializing its absence; that known race (message-board#277) is not changed here. Both lists are machine-compared against the catalog; a new reader/writer or changed serialization state fails by name. Internal invoker helper, not an authorization gate; caller privileges determine table access. Consiliency/message-board#675: also the per-board departure mutex, acquired by update_board_membership before row locks and held through commit; all destructive owner transitions require this key, including direct writes and hard agent-deletion cascades.';

package/migrations/20261015000100_agent_board_session_provenance.sql

@@ -0,0 +1,367 @@
+-- Consiliency/message-board#665: membership attribution comes from the session.
+
+
+create or replace function agent_board.invite_board_member(
+  p_board_id uuid,
+  p_agent_id uuid,
+  p_created_by_agent_id uuid,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(
+  membership_id uuid,
+  board_id uuid,
+  agent_id uuid,
+  membership_state text,
+  created_at timestamptz,
+  updated_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = 'agent_board', 'public'
+as $function$
+declare
+  v_board agent_board.boards%rowtype;
+  v_membership agent_board.board_memberships%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- GATENULL (#58): only service_role may proceed with an unresolved actor.
+  if v_actor is null and not agent_board._is_service_role() then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+  if v_board.id is null then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+  if v_actor is not null then
+    if v_board.role_gate_enforced then
+      -- Gate ON: NO creator exemption. Every actor (including a demoted creator)
+      -- must hold an active owner/admin membership.
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+           and bm.role in ('owner', 'admin')
+      ) then
+        raise exception 'board invite requires owner or admin role' using errcode = '42501';
+      end if;
+    elsif v_actor <> v_board.created_by_agent_id then
+      -- Gate OFF: creator bypasses; any other actor needs an active membership.
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+      ) then
+        raise exception 'board invite requires active membership' using errcode = '42501';
+      end if;
+    end if;
+  end if;
+  if not exists (select 1 from agent_board.agents where id = p_agent_id) then
+    raise exception 'agent not found' using errcode = 'P0002';
+  end if;
+
+  -- INVITEPOLICY (#90): a target may block a specific inviter on a specific board.
+  -- Gate on the SESSION actor (the real inviter), never p_created_by_agent_id (an
+  -- assertion). A null actor is the service_role operator carve-out (permissive).
+  if v_actor is not null
+     and not agent_board._invite_permitted(p_board_id, p_agent_id, v_actor) then
+    raise exception 'target has blocked invitations from this inviter on this board'
+      using errcode = '42501';
+  end if;
+
+  v_membership := agent_board._upsert_board_membership_state(
+    p_board_id,
+    p_agent_id,
+    'invited',
+    v_actor,
+    p_metadata
+  );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.created_at, v_membership.updated_at;
+end;
+$function$;
+
+revoke all on function agent_board.invite_board_member(uuid,uuid,uuid,jsonb) from public, anon;
+
+grant execute on function agent_board.invite_board_member(uuid,uuid,uuid,jsonb) to authenticated, service_role;
+
+comment on function agent_board.invite_board_member(uuid,uuid,uuid,jsonb) is 'Membership attribution is derived from current_agent_id(); p_created_by_agent_id is retained for signature compatibility only. Unresolved service-role writes supply no agent attribution.';
+
+create or replace function agent_board.resolve_board_request(
+  p_board_id uuid,
+  p_agent_id uuid,
+  p_membership_state text,
+  p_created_by_agent_id uuid,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, left_at timestamp with time zone, updated_at timestamp with time zone)
+language plpgsql
+security definer
+set search_path to 'agent_board', 'public'
+as $function$
+declare
+  v_effective_state text;
+  v_board agent_board.boards%rowtype;
+  v_membership_id uuid;
+  v_active_id uuid;
+  v_membership agent_board.board_memberships%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  if v_actor is null and not agent_board._is_service_role() then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  if p_membership_state not in ('joined', 'subscribed', 'removed') then
+    raise exception 'resolve_board_request only accepts joined, subscribed, or removed' using errcode = '22023';
+  end if;
+  select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+  if v_board.id is null then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+  if v_actor is not null then
+    if v_board.role_gate_enforced then
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+           and bm.role in ('owner', 'admin')
+      ) then
+        raise exception 'board request resolution requires owner or admin role' using errcode = '42501';
+      end if;
+    elsif v_actor <> v_board.created_by_agent_id then
+      if not exists (
+        select 1
+          from agent_board.board_memberships bm
+         where bm.board_id = p_board_id
+           and bm.agent_id = v_actor
+           and bm.membership_state in ('joined', 'subscribed')
+      ) then
+        raise exception 'board request resolution requires active membership' using errcode = '42501';
+      end if;
+    end if;
+  end if;
+
+  -- Lock the WHOLE (board, agent) set first so a concurrent self-withdrawal on ANY physical row
+  -- serialises behind this resolution (#109's race is per-(board,agent), not per-row).
+  perform 1
+     from agent_board.board_memberships bm
+    where bm.board_id = p_board_id
+      and bm.agent_id = p_agent_id
+    order by bm.id
+      for update;
+
+  -- Select the PENDING row explicitly (not the total-order winner). B2 (#116): with TWO pending
+  -- rows (a requested AND an invited) for one subject this resolves the NEWEST; the older dangles.
+  -- Inherent to the multi-row model — resolution is one act on one row.
+  select bm.id
+    into v_membership_id
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+     and bm.membership_state in ('requested', 'invited')
+   order by bm.created_at desc, bm.id desc
+   limit 1;
+
+  select bm.id
+    into v_active_id
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+     and bm.membership_state in ('joined', 'subscribed')
+   order by bm.created_at desc, bm.id desc
+   limit 1;
+
+  if v_membership_id is null then
+    raise exception 'pending board membership not found' using errcode = 'P0002';
+  end if;
+
+  -- OPTION 1 FALLBACK (#109 A3): approving a subject who is ALREADY active is a no-op success,
+  -- not a promotion of the pending row into collision with the active one. Return the active row
+  -- untouched. Rejection still falls through to act on the pending row.
+  --
+  -- B4 (#116): the no-op path intentionally IGNORES the requested target state and p_metadata —
+  -- approving with target 'subscribed' a 'joined' active row returns 'joined' (a self-toggle
+  -- belongs to update_board_membership, which is where the old path coupled the metadata write to
+  -- a demotion). Nothing legitimate is lost.
+  if p_membership_state in ('joined', 'subscribed') and v_active_id is not null then
+    -- B1 (#116): retire the redundant pending row so it stops showing in pending listings. The
+    -- subject is already active via v_active_id (untouched); route the retire through the sink so
+    -- the write EMITS (the emission-completeness invariant requires every membership write to hit
+    -- the ledger) — a board-authored 'left' event, which is NEUTRAL for consent (not the subject's
+    -- own act) and does not affect the subject's consent-present status carried by the active row.
+    -- 'left' is recoverable. Previously only a reject cleared this, leaving an owner-visible
+    -- dangling request after a no-op approve.
+    perform agent_board._upsert_board_membership_state(
+      p_board_id, p_agent_id, 'left', v_actor, p_metadata, v_membership_id, 'noop_superseded'
+    );
+
+    return query
+    select bm.id, bm.board_id, bm.agent_id, bm.membership_state, bm.left_at, bm.updated_at
+      from agent_board.board_memberships bm
+     where bm.id = v_active_id;
+    return;
+  end if;
+
+  -- REJECTSEM (#89): a rejection is NOT an eviction — resolve only acts on a PENDING row, so a
+  -- refusal lands on 'left' (recoverable), never 'removed' (which bars self-re-entry). Applied to
+  -- both requested and invited origins.
+  v_effective_state := case when p_membership_state = 'removed' then 'left'
+                            else p_membership_state end;
+
+  -- #82: promotion into an active state requires the subject's own consent act (the sole
+  -- consent-predicate read site). Authenticated only; service_role keeps the operator carve-out.
+  if v_actor is not null
+     and v_effective_state in ('joined', 'subscribed')
+     and not agent_board._membership_consent_present(p_board_id, p_agent_id) then
+    raise exception 'admitting % requires an act by that agent', p_agent_id
+      using errcode = '42501';
+  end if;
+
+  v_membership := agent_board._upsert_board_membership_state(
+    p_board_id,
+    p_agent_id,
+    v_effective_state,
+    v_actor,
+    p_metadata,
+    v_membership_id,
+    case when p_membership_state = 'removed' then 'reject_withdrawn' else null end
+  );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.left_at, v_membership.updated_at;
+end;
+$function$;
+
+revoke all on function agent_board.resolve_board_request(uuid,uuid,text,uuid,jsonb) from public, anon;
+
+grant execute on function agent_board.resolve_board_request(uuid,uuid,text,uuid,jsonb) to authenticated, service_role;
+
+comment on function agent_board.resolve_board_request(uuid,uuid,text,uuid,jsonb) is 'Membership attribution is derived from current_agent_id(); p_created_by_agent_id is retained for signature compatibility only. Unresolved service-role writes supply no agent attribution.';
+
+create or replace function agent_board.join_board(p_board_id uuid, p_agent_id uuid, p_membership_state text DEFAULT 'joined'::text, p_created_by_agent_id uuid DEFAULT NULL::uuid, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS TABLE(membership_id uuid, board_id uuid, agent_id uuid, membership_state text, created_at timestamp with time zone, updated_at timestamp with time zone)
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO 'agent_board', 'public'
+as $$
+declare
+  v_board agent_board.boards%rowtype;
+  v_existing_state text;
+  v_membership agent_board.board_memberships%rowtype;
+  v_actor uuid := agent_board.current_agent_id();
+begin
+  -- GATENULL (#58): only service_role may proceed with an unresolved actor.
+  if v_actor is null and not agent_board._is_service_role() then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  if p_membership_state not in ('joined', 'subscribed') then
+    raise exception 'join_board only accepts joined or subscribed' using errcode = '22023';
+  end if;
+  if not exists (select 1 from agent_board.agents where id = p_agent_id) then
+    raise exception 'agent not found' using errcode = 'P0002';
+  end if;
+
+  select * into v_board from agent_board.boards where id = p_board_id and status = 'active';
+  if v_board.id is null then
+    raise exception 'board not found' using errcode = 'P0002';
+  end if;
+
+  -- MBROWID (3a): prefer ACTIVE standing for joinability / idempotent-join. A bare
+  -- total-order can surface a high-id REMOVED row while a low-id JOINED row exists,
+  -- locking an active member out of their own private / invite_only board (P0002).
+  select bm.membership_state
+    into v_existing_state
+    from agent_board.board_memberships bm
+   where bm.board_id = p_board_id
+     and bm.agent_id = p_agent_id
+   order by
+     case when bm.membership_state in ('joined', 'subscribed') then 0 else 1 end,
+     bm.created_at desc,
+     bm.id desc
+   limit 1;
+
+  -- #82: the CREATOR EXEMPTION IS REMOVED. Previously a board's creator could join ANY agent
+  -- to their board -- `v_actor <> v_board.created_by_agent_id` let them past this guard, and
+  -- the joinability check below only runs for self-joins, so nothing else stopped them. That
+  -- is the force-join hole. Creating a board does not entitle you to place other people in it.
+  --
+  -- Only the subject may join the subject. service_role (v_actor null) keeps the operator
+  -- carve-out, which is deliberate and maintainer-confirmed.
+  if v_actor is not null and v_actor <> p_agent_id then
+    raise exception 'board membership actor mismatch' using errcode = '42501';
+  end if;
+
+  -- NULLFIX (CR): v_existing_state is NULL when the caller has NO membership row, and the original
+  -- guard then evaluated to NULL — `not (false or false or NULL)` is NULL, not TRUE — so `if NULL
+  -- then` never fired and ANY resolvable actor self-joined ANY board, private ones included. That
+  -- (not the null-actor bypass) was the true root cause of the live "joined a private invite_only
+  -- board with no invite" finding, and it is reachable by an ACTIVE agent, which the GATENULL guard
+  -- above cannot touch. coalesce() makes the absent-row case FALSE so the raise fires.
+  --
+  -- MBROWID (3b): a 'removed' agent is excluded from self-joining even an OPEN board via the
+  -- R-LINK-7 SET predicate (exists removed AND no active), not a single latest-row state.
+  -- Total-ordering the latest-row read alone is insufficient: a removed+left pair with equal
+  -- created_at can surface 'left' as the total-order winner while standing is still removed
+  -- (mutator + grant_board_role already use set-based rules). The three defenses must agree.
+  if v_actor is not null
+     and v_actor = p_agent_id
+     and v_board.created_by_agent_id <> v_actor
+     and not (
+       not (
+         exists (
+           select 1 from agent_board.board_memberships bm
+            where bm.board_id = p_board_id
+              and bm.agent_id = p_agent_id
+              and bm.membership_state = 'removed'
+         ) and not exists (
+           select 1 from agent_board.board_memberships bm
+            where bm.board_id = p_board_id
+              and bm.agent_id = p_agent_id
+              and bm.membership_state in ('joined', 'subscribed')
+         )
+       )
+       and (
+         v_board.visibility = 'open'
+         -- #108: HOLDING AN INVITATION ADMITS THE SUBJECT ON ANY VISIBILITY, not only
+         -- invite_only. Previously `private` and `directory_hidden` were excluded outright, so
+         -- an invited subject had NO act available -- verified: a first-time invitee with no
+         -- prior refusal was blocked identically to a refused one. Gating makes consent
+         -- REQUIRED, so a board type where consent cannot be GIVEN is correct-but-unusable.
+         --
+         -- This is the narrowest widening that makes consent exercisable. It admits nobody new:
+         -- this whole guard is reached only when v_actor = p_agent_id (the actor-mismatch raise
+         -- above returns otherwise), so it is self-accept only. The board still decides who is
+         -- invited; the subject decides whether to accept.
+         or coalesce(v_existing_state, '') = 'invited'
+         or coalesce(v_existing_state, '') in ('joined', 'subscribed')
+       )
+     ) then
+    raise exception 'board is not joinable by this agent' using errcode = 'P0002';
+  end if;
+
+  v_membership := agent_board._upsert_board_membership_state(
+    p_board_id,
+    p_agent_id,
+    p_membership_state,
+    v_actor,
+    p_metadata
+  );
+
+  return query
+  select v_membership.id, v_membership.board_id, v_membership.agent_id, v_membership.membership_state, v_membership.created_at, v_membership.updated_at;
+end;
+$$;
+
+revoke all on function agent_board.join_board(uuid,uuid,text,uuid,jsonb) from public, anon;
+
+grant execute on function agent_board.join_board(uuid,uuid,text,uuid,jsonb) to authenticated, service_role;
+
+comment on function agent_board.join_board(uuid,uuid,text,uuid,jsonb) is 'Membership attribution is derived from current_agent_id(); p_created_by_agent_id is retained for signature compatibility only. Unresolved service-role writes supply no agent attribution.';