@consiliency/agent-board-schema 1.68.0 → 1.74.0

package/tests/agent_board_717_message_replay_scope.test.sql

@@ -0,0 +1,828 @@
+-- #717 F2b: a same-key send_direct_message / send_multicast_message replay cannot widen the
+-- source message's audience.
+--
+-- THE DEFECT (main 21b7b158). Idempotency is keyed on (rpc, thread, resolved author, key). A
+-- replay reused the author's ORIGINAL message and delivered it to whatever recipient the retry
+-- named. The authenticated messages and artifacts policies admit any delivery recipient of a
+-- message, so a newly named agent X read A's original body AND an artifact a different agent C
+-- had anchored to it.
+--
+-- THE CONTRACT pinned here: identity, lock and lookup unchanged. On a replay every requested
+-- recipient must already hold a persisted delivery of THAT source message in the function's own
+-- mode ('direct' / 'multicast') with no board scope. A direct retry may only name its existing
+-- private recipient; a multicast retry the same normalized set or a nonempty subset, and an
+-- omitted recipient keeps its delivery. Anything else is 42501 'message replay cannot widen
+-- delivery scope' with no side effect. Metadata, a forged lookup source, the thread's board stamp
+-- and board-mode deliveries are not evidence. A new audience needs a new key, which creates a new
+-- message carrying none of the source's artifacts.
+--
+-- METHOD (AGENTS.md rules 2 and 3).
+--   * Every actor runs under its OWN role AND claims (`set local role authenticated|service_role`
+--     plus a JSON claim set); the flattened request.jwt.claim.* GUCs are cleared on every switch.
+--   * Every call runs in a helper with its own exception block returning 'ok' or
+--     '<sqlstate>:<message>'; refusals compare the exact message, and the same helper reports the
+--     side-effect fingerprint delta around the call. State reads are separate queries.
+--   * The artifact on each source message is written by its RECIPIENT C through add_artifact,
+--     so the row that must stay hidden is another agent's, not the author's.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(67);
+
+create temp table _h(k text primary key, v text);
+create function pg_temp.v(p_k text) returns text language sql as $$ select v from _h where k = p_k $$;
+-- Never raises: a value that is not a uuid (an 'ERR ...' result under a mutation) reads as NULL,
+-- so a broken implementation fails an assertion instead of aborting the file (AGENTS.md rule 3).
+create function pg_temp.u(p_k text) returns uuid language sql as $$
+  select case when v ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$' then v::uuid end from _h where k = p_k $$;
+create function pg_temp.put(p_k text, p_v text) returns void language sql as $$
+  insert into _h values (p_k, p_v) on conflict (k) do update set v = excluded.v $$;
+
+-- Identity switch: one JSON claim set, every flattened claim GUC cleared.
+create function pg_temp.ident(p_role text, p_sub uuid) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claim.sub', '', true);
+  perform set_config('request.jwt.claim.role', '', true);
+  perform set_config('request.jwt.claim.agent_credential_id', '', true);
+  perform set_config('request.jwt.claim.identity_lease_epoch', '', true);
+  perform set_config('request.jwt.claims',
+    case when p_role is null then ''
+         else jsonb_strip_nulls(jsonb_build_object('role', p_role, 'sub', p_sub))::text end,
+    true);
+end $$;
+
+-- Run p_sql AS actor p_who (its role and claims). Returns 'ok' or '<sqlstate>:<message>'.
+create function pg_temp.as_(p_who text, p_sql text) returns text language plpgsql as $$
+declare
+  v text;
+  v_role text := pg_temp.v(p_who || '.role');
+begin
+  perform pg_temp.ident(v_role, pg_temp.u(p_who || '.auth'));
+  execute format('set local role %I', v_role);
+  begin
+    execute p_sql;
+    v := 'ok';
+  exception when others then
+    v := sqlstate || ':' || sqlerrm;
+  end;
+  reset role;
+  perform pg_temp.ident(null, null);
+  return v;
+end $$;
+
+-- Run p_sql AS actor p_who and return its single scalar.
+create function pg_temp.val(p_who text, p_sql text) returns text language plpgsql as $$
+declare
+  v text;
+  v_role text := pg_temp.v(p_who || '.role');
+begin
+  perform pg_temp.ident(v_role, pg_temp.u(p_who || '.auth'));
+  execute format('set local role %I', v_role);
+  begin
+    execute p_sql into v;
+  exception when others then
+    v := 'ERR ' || sqlstate || ':' || sqlerrm;
+  end;
+  reset role;
+  perform pg_temp.ident(null, null);
+  return coalesce(v, '(null)');
+end $$;
+
+-- Everything a message send can write, counted globally (this transaction is the only writer),
+-- plus a digest of every inbox item's presentation: an accepted retry may refresh it, a refused
+-- one must not.
+create function pg_temp.fp() returns text language plpgsql as $$
+declare v text;
+begin
+  select concat_ws(' ',
+    'messages=' || (select count(*) from agent_board.messages),
+    'artifacts=' || (select count(*) from agent_board.artifacts),
+    'deliveries=' || (select count(*) from agent_board.delivery_recipients),
+    'inbox=' || (select count(*) from agent_board.inbox_items),
+    'callbacks=' || (select count(*) from agent_board.callback_outbox_events),
+    'evidence=' || (select count(*) from agent_board.signature_evidence),
+    'telemetry=' || (select count(*) from agent_board.send_authz_telemetry),
+    'stamped=' || (select count(*) from agent_board.threads where board_id is not null),
+    'inboxtxt=' || (select md5(coalesce(string_agg(id::text || subject || coalesce(preview, ''), ',' order by id), ''))
+                      from agent_board.inbox_items))
+    into v;
+  return v;
+end $$;
+
+-- The row counts alone (no inbox presentation digest): what an ACCEPTED retry must leave unchanged.
+create function pg_temp.fp_rows() returns text language sql as $$ select split_part(pg_temp.fp(), ' inboxtxt=', 1) $$;
+
+-- A call that must be REFUSED: '<result> | side-effects=none' when nothing changed.
+create function pg_temp.refuse(p_who text, p_sql text) returns text language plpgsql as $$
+declare v_before text := pg_temp.fp(); v_res text; v_after text;
+begin
+  v_res := pg_temp.as_(p_who, p_sql);
+  v_after := pg_temp.fp();
+  return v_res || ' | side-effects=' || case when v_after = v_before then 'none' else v_before || ' -> ' || v_after end;
+end $$;
+
+-- What actor p_who can read of message p_msg: the message, then every table that references
+-- messages and is readable by an API role (derived and pinned in 56/57): artifacts, deliveries,
+-- inbox items, callback outbox events, signature evidence; then the body.
+create function pg_temp.sees(p_who text, p_msg text) returns text language plpgsql as $$
+begin
+  return pg_temp.val(p_who, format($q$
+    select (select count(*) from agent_board.messages where id = %1$L)
+      || '/' || (select count(*) from agent_board.artifacts where message_id = %1$L)
+      || '/' || (select count(*) from agent_board.delivery_recipients where source_message_id = %1$L)
+      || '/' || (select count(*) from agent_board.inbox_items where source_message_id = %1$L)
+      || '/' || (select count(*) from agent_board.callback_outbox_events where source_message_id = %1$L)
+      || '/' || (select count(*) from agent_board.signature_evidence where source_message_id = %1$L)
+      || ' ' || coalesce((select body from agent_board.messages where id = %1$L), '-')
+  $q$, pg_temp.v(p_msg)));
+end $$;
+
+-- A message's delivery scope: sorted 'recipient-handle:mode:board-slug|private'.
+create function pg_temp.scope(p_msg text) returns text language sql as $$
+  select coalesce(string_agg(a.handle || ':' || dr.delivery_mode || ':' || coalesce(b.slug, 'private'), ',' order by a.handle), '(none)')
+    from agent_board.delivery_recipients dr
+    join agent_board.agents a on a.id = dr.recipient_agent_id
+    left join agent_board.boards b on b.id = dr.board_id
+   where dr.source_message_id = pg_temp.u(p_msg)
+$$;
+
+-- A source message's rows byte for byte: the message (id, author, body, metadata), its
+-- artifacts (ids, authors, content) and its delivery rows.
+create function pg_temp.history(p_msg text) returns text language sql as $$
+  select md5(concat_ws('#',
+    (select m::text from agent_board.messages m where m.id = pg_temp.u(p_msg)),
+    (select string_agg(ar::text, ',' order by ar.id) from agent_board.artifacts ar where ar.message_id = pg_temp.u(p_msg)),
+    (select string_agg(dr.id::text || dr.delivery_mode || dr.recipient_agent_id::text || coalesce(dr.board_id::text, '-'), ',' order by dr.id)
+       from agent_board.delivery_recipients dr where dr.source_message_id = pg_temp.u(p_msg))))
+$$;
+
+create function pg_temp.dm(p_who text, p_thread text, p_to text, p_key text, p_body text default 'retry body',
+                           p_metadata jsonb default '{}'::jsonb) returns text language sql as $$
+  select format('select * from agent_board.send_direct_message(%L::uuid, %L::uuid, %L::uuid, %L, %L, ''comment'', ''medium'', %L, %L::jsonb)',
+    pg_temp.v(p_thread), pg_temp.v(p_who), pg_temp.v(p_to), 'subj ' || p_body, p_body, p_key, p_metadata::text)
+$$;
+create function pg_temp.mc(p_who text, p_thread text, p_to text, p_key text, p_body text default 'retry body',
+                           p_metadata jsonb default '{}'::jsonb) returns text language sql as $$
+  select format('select * from agent_board.send_multicast_message(%L::uuid, %L::uuid, %s, %L, %L, ''comment'', ''medium'', %L, %L::jsonb)',
+    pg_temp.v(p_thread), pg_temp.v(p_who), p_to, 'subj ' || p_body, p_body, p_key, p_metadata::text)
+$$;
+-- uuid[] literal of the named agents, in the order given (duplicates kept).
+create function pg_temp.ids(variadic p_who text[]) returns text language sql as $$
+  select 'array[' || string_agg(quote_literal(pg_temp.v(w)), ',' order by o) || ']::uuid[]'
+    from unnest(p_who) with ordinality as x(w, o)
+$$;
+-- addressing_v1 descriptor array of the named agents.
+create function pg_temp.desc_(variadic p_who text[]) returns jsonb language sql as $$
+  select jsonb_agg(jsonb_build_object('kind', 'agent_id', 'agentId', pg_temp.v(w)) order by o)
+    from unnest(p_who) with ordinality as x(w, o)
+$$;
+
+-- Signed wrappers, as service_role with a gateway decision for p_actor. The decision is a SQL
+-- fixture: this proves the wrappers' routing and atomicity, not signature verification.
+create function pg_temp.gw(p_actor text) returns text language sql as $$
+  select quote_literal(jsonb_build_object('agent_id', pg_temp.v(p_actor), 'verification_status', 'warn',
+    'payload_digest', 'sha256:' || repeat('7', 64), 'enforcement_mode', 'warn')::text) || '::jsonb'
+$$;
+create function pg_temp.signed(p_fn text, p_payload jsonb, p_actor text default 'A') returns text language sql as $$
+  select format('select * from agent_board.%I(%L::jsonb, %s)', p_fn, p_payload::text, pg_temp.gw(p_actor))
+$$;
+
+-- ===========================================================================
+-- Fixtures
+-- ===========================================================================
+-- Keyed agents: A author, A2 second author, C and C2 private recipients (C authors the
+-- artifacts), X an agent never addressed, M a member of board B, Y a forged-evidence target.
+insert into auth.users(id, instance_id, aud, role, email)
+select ('717b0000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'f2b717-' || n || '@t.test'
+  from generate_series(1, 7) n;
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+select ('717b1000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid, 'agent', 'agent',
+       'f2b717-' || h, 'F2b ' || h, 'active', ('717b0000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid
+  from unnest(array['a', 'a2', 'c', 'c2', 'x', 'm', 'y']) with ordinality as x(h, n);
+do $$
+declare h text; n int := 0;
+begin
+  foreach h in array array['A', 'A2', 'C', 'C2', 'X', 'M', 'Y'] loop
+    n := n + 1;
+    perform pg_temp.put(h, '717b1000-0000-4000-8000-' || lpad(n::text, 12, '0'));
+    perform pg_temp.put(h || '.auth', '717b0000-0000-4000-8000-' || lpad(n::text, 12, '0'));
+    perform pg_temp.put(h || '.role', 'authenticated');
+  end loop;
+end $$;
+select pg_temp.put('SVC.role', 'service_role');
+-- Verified own_inbox callback subscriptions for C, C2, X and M: a delivery to any of them would
+-- also queue a callback, so the side-effect fingerprint discriminates a callback write.
+insert into agent_board.callback_endpoints(id, owner_agent_id, endpoint_url, endpoint_status)
+select ('717b3000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid, pg_temp.u(h), 'https://example.test/f2b717/' || h, 'verified'
+  from unnest(array['C', 'C2', 'X', 'M']) with ordinality as x(h, n);
+insert into agent_board.callback_subscriptions(endpoint_id, agent_id, subscription_scope, event_category)
+select ('717b3000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid, pg_temp.u(h), 'own_inbox', 'inbox.item.delivered'
+  from unnest(array['C', 'C2', 'X', 'M']) with ordinality as x(h, n);
+
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+values ('717b2000-0000-4000-8000-000000000001', 'f2b717-b', 'F2b B', pg_temp.u('A'), 'private', 'active');
+select pg_temp.put('B', '717b2000-0000-4000-8000-000000000001');
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+values (pg_temp.u('B'), pg_temp.u('A'), 'owner', 'joined', pg_temp.u('A')),
+       (pg_temp.u('B'), pg_temp.u('C'), 'member', 'joined', pg_temp.u('A')),
+       (pg_temp.u('B'), pg_temp.u('M'), 'member', 'joined', pg_temp.u('A')),
+       (pg_temp.u('B'), pg_temp.u('Y'), 'member', 'joined', pg_temp.u('A'));
+
+-- T: a plain thread. TB: a thread stamped to board B by A's board post.
+select pg_temp.put('T', pg_temp.val('A', $$ select thread_id::text from agent_board.create_or_find_thread(null, 'F2b thread', 'f2b717-thread') $$));
+select pg_temp.put('TB', pg_temp.val('A', $$ select thread_id::text from agent_board.create_or_find_thread(null, 'F2b board thread', 'f2b717-board-thread') $$));
+select pg_temp.put('TB.post', pg_temp.as_('A', format($$ select * from agent_board.post_board_message(%L, %L, %L, 's', 'board post') $$,
+                          pg_temp.v('TB'), pg_temp.v('A'), pg_temp.v('B'))));
+
+-- The private sources. DM: A -> C, key dk, on T. MC: A -> {C, C2}, key mk, on T. DMB: A -> C on the
+-- board-stamped TB, key bk. Each carries an artifact written by C.
+select pg_temp.put('DM', pg_temp.val('A', replace(pg_temp.dm('A', 'T', 'C', 'dk', 'A-PRIVATE-DM-BODY'), 'select *', 'select message_id::text')));
+select pg_temp.put('MC', pg_temp.val('A', replace(pg_temp.mc('A', 'T', pg_temp.ids('C', 'C2'), 'mk', 'A-PRIVATE-MC-BODY'), 'select *', 'select message_id::text')));
+-- A2 is given access to T by a DM from A (so A2 can author its own same-key messages there).
+select pg_temp.put('A2.access', pg_temp.as_('A', pg_temp.dm('A', 'T', 'A2', 'a2-access', 'ACCESS-FOR-A2')));
+select pg_temp.put('DMB', pg_temp.val('A', replace(pg_temp.dm('A', 'TB', 'C', 'bk', 'A-PRIVATE-BOARD-THREAD-DM'), 'select *', 'select message_id::text')));
+create function pg_temp.art(p_msg text, p_thread text) returns text language sql as $$
+  select pg_temp.val('C', format($q$ select artifact_id::text from agent_board.add_artifact(%L, %L, 'url', 'external_url', %L, null, %L) $q$,
+    pg_temp.v('C'), 'https://example.test/c-private/' || p_msg, pg_temp.v(p_thread), pg_temp.v(p_msg)))
+$$;
+select pg_temp.put('DM.art', pg_temp.art('DM', 'T')), pg_temp.put('MC.art', pg_temp.art('MC', 'T')), pg_temp.put('DMB.art', pg_temp.art('DMB', 'TB'));
+
+-- 1
+select is(
+  pg_temp.v('TB.post') || ' ' || pg_temp.v('A2.access') || ' ' || (select coalesce(board_id::text, 'null') from agent_board.threads where id = pg_temp.u('TB'))
+  || ' ' || (select coalesce(board_id::text, 'null') from agent_board.threads where id = pg_temp.u('T')),
+  'ok ok ' || pg_temp.v('B') || ' null',
+  'fixture: TB is stamped to board B by a board post; T is a plain thread A2 can reach');
+-- 2 -- exact authors, bodies and scopes of the three sources, and C as the artifacts' author
+select is(
+  (select string_agg(a.handle || ':' || m.body, ' ' order by m.body)
+     from agent_board.messages m join agent_board.agents a on a.id = m.author_agent_id
+    where m.id in (pg_temp.u('DM'), pg_temp.u('MC'), pg_temp.u('DMB')))
+  || ' | ' || pg_temp.scope('DM') || ' | ' || pg_temp.scope('MC') || ' | ' || pg_temp.scope('DMB')
+  || ' | ' || (select string_agg(a.handle || '@' || case ar.message_id when pg_temp.u('DM') then 'DM' when pg_temp.u('MC') then 'MC' when pg_temp.u('DMB') then 'DMB' end, ',' order by ar.id::text = pg_temp.v('DMB.art'), ar.id::text = pg_temp.v('MC.art'))
+                 from agent_board.artifacts ar join agent_board.agents a on a.id = ar.created_by_agent_id
+                where ar.id in (pg_temp.u('DM.art'), pg_temp.u('MC.art'), pg_temp.u('DMB.art'))),
+  'f2b717-a:A-PRIVATE-BOARD-THREAD-DM f2b717-a:A-PRIVATE-DM-BODY f2b717-a:A-PRIVATE-MC-BODY'
+  || ' | f2b717-c:direct:private | f2b717-c:multicast:private,f2b717-c2:multicast:private | f2b717-c:direct:private'
+  || ' | f2b717-c@DM,f2b717-c@MC,f2b717-c@DMB',
+  'fixture: A authored three private sources (direct, multicast, direct on the board thread); C authored an artifact on each');
+select pg_temp.put('DM.history', pg_temp.history('DM')), pg_temp.put('MC.history', pg_temp.history('MC')), pg_temp.put('DMB.history', pg_temp.history('DMB'));
+
+-- ===========================================================================
+-- Visibility before any replay
+-- ===========================================================================
+-- 3
+select is(pg_temp.sees('X', 'DM') || ' | ' || pg_temp.sees('X', 'MC'),
+  '0/0/0/0/0/0 - | 0/0/0/0/0/0 -',
+  'before: X sees none of DM or MC (message/artifacts/deliveries/inbox)');
+-- 4 -- private sends on a board thread stay private to the board's other members
+select is(pg_temp.sees('M', 'DMB') || ' | ' || pg_temp.sees('Y', 'DMB'),
+  '0/0/0/0/0/0 - | 0/0/0/0/0/0 -',
+  'before: board members M and Y see nothing of the private DM on the board-stamped thread');
+-- 5
+select is(pg_temp.sees('C', 'DM') || ' | ' || pg_temp.sees('C', 'MC') || ' | ' || pg_temp.sees('C2', 'MC') || ' | ' || pg_temp.sees('A', 'DM'),
+  '1/1/1/1/1/0 A-PRIVATE-DM-BODY | 1/1/1/1/1/0 A-PRIVATE-MC-BODY | 1/1/1/1/1/0 A-PRIVATE-MC-BODY | 1/1/0/0/0/0 A-PRIVATE-DM-BODY',
+  'before: each recipient sees its source, C''s artifact and its own delivery, inbox item and callback; the author sees its message and the artifact');
+
+-- ===========================================================================
+-- Direct: refused replays (42501, nothing written)
+-- ===========================================================================
+-- 6 -- the exploit: same key, newly named recipient
+select is(pg_temp.refuse('A', pg_temp.dm('A', 'T', 'X', 'dk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct: a same-key replay naming a new recipient is refused');
+-- 7
+select is(pg_temp.refuse('SVC', pg_temp.dm('A', 'T', 'X', 'dk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct, service_role on the UUID core: the same refusal, the bypass telemetry row rolled back');
+-- 8
+select is(pg_temp.refuse('A', format($$ select * from agent_board.send_direct_message(%L::uuid, %L::uuid, %L::jsonb, 'addressing_v1', 's', 'b', 'comment', 'medium', 'dk', '{}'::jsonb) $$,
+            pg_temp.v('T'), pg_temp.v('A'), (pg_temp.desc_('X') -> 0)::text)),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct, addressing overload: a descriptor naming a new recipient is refused');
+-- 9
+select is(pg_temp.refuse('SVC', pg_temp.signed('signed_send_direct_message', jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_author_agent_id', pg_temp.v('A'),
+            'p_recipient_agent_id', pg_temp.v('X'), 'p_subject', 's', 'p_body', 'b', 'p_idempotency_key', 'dk'))),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct, signed wrapper: refused with no signature evidence, delivery, inbox or callback');
+-- 10
+select is(pg_temp.refuse('A', pg_temp.dm('A', 'T', 'X', 'dk', 'b',
+            jsonb_build_object('rpcName', 'send_direct_message', 'idempotencyKey', 'dk', 'recipientAgentId', pg_temp.v('X'), 'deliveredTo', jsonb_build_array(pg_temp.v('X'))))),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct: caller metadata naming X as a prior recipient is not evidence');
+-- 11 -- the thread's board stamp is not evidence: M is a member of the board TB is stamped to
+select is(pg_temp.refuse('A', pg_temp.dm('A', 'TB', 'M', 'bk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct on a board-stamped thread: replaying to a member of that board is refused');
+-- 12 -- the existing actor binding still answers first
+select is(pg_temp.refuse('M', pg_temp.dm('A', 'T', 'X', 'dk')),
+  '42501:p_author_agent_id must match current_agent_id() | side-effects=none',
+  'direct: an authenticated caller naming another author is refused by the existing actor binding');
+
+-- Forged evidence, written as the table owner. These rows model what no API role should be able
+-- to write (#717 F1 revokes service_role EXECUTE on the writer); they pin the predicate's MODE and
+-- BOARD conjuncts. Y holds a BOARD-mode delivery of DMB on board B; X holds a MULTICAST-mode
+-- delivery of DMB. Neither is a private direct delivery.
+insert into agent_board.delivery_recipients(delivery_mode, recipient_agent_id, source_kind, source_message_id, board_id, board_membership_id)
+values ('board', pg_temp.u('Y'), 'message', pg_temp.u('DMB'), pg_temp.u('B'),
+        (select id from agent_board.board_memberships where board_id = pg_temp.u('B') and agent_id = pg_temp.u('Y'))),
+       ('multicast', pg_temp.u('X'), 'message', pg_temp.u('DMB'), null, null)
+on conflict (recipient_agent_id, canonical_source_key) do nothing;
+-- 13
+select is(pg_temp.refuse('A', pg_temp.dm('A', 'TB', 'Y', 'bk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct: a board-mode delivery of the source is not evidence of a private direct delivery');
+-- 14
+select is(pg_temp.refuse('A', pg_temp.dm('A', 'TB', 'X', 'bk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct: a delivery of the source in another mode (multicast) is not evidence');
+delete from agent_board.delivery_recipients
+ where source_message_id = pg_temp.u('DMB') and recipient_agent_id in (pg_temp.u('Y'), pg_temp.u('X'));
+
+-- A forged lookup source: post_message persists caller metadata, so a reply can carry the
+-- DM lookup's reserved keys. The lookup finds it, and it has no delivery at all: fail closed.
+select pg_temp.put('FORGED', pg_temp.val('A', format($$ select message_id::text from agent_board.post_message(%L, %L, 'FORGED-REPLY', 'comment', null, %L::jsonb) $$,
+  pg_temp.v('T'), pg_temp.v('A'), jsonb_build_object('rpcName', 'send_direct_message', 'idempotencyKey', 'fk')::text)));
+-- 15
+select is(
+  (select metadata ->> 'rpcName' || '/' || (metadata ->> 'idempotencyKey') from agent_board.messages where id = pg_temp.u('FORGED'))
+  || ' ' || pg_temp.refuse('A', pg_temp.dm('A', 'T', 'X', 'fk')),
+  'send_direct_message/fk 42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct: a lookup source with forged reserved metadata and no persisted delivery is refused (no reconstruction)');
+
+-- ===========================================================================
+-- Direct: accepted retries and new keys
+-- ===========================================================================
+create temp table _r as select * from agent_board.send_direct_message(null, null, null, null, null) where false;
+grant all on _r to authenticated, service_role;
+create function pg_temp.dm_row(p_who text, p_sql text) returns text language plpgsql as $$
+declare v text;
+begin
+  delete from _r;
+  v := pg_temp.as_(p_who, 'insert into _r ' || p_sql);
+  return v;
+end $$;
+select pg_temp.put('fp.before-retry', pg_temp.fp_rows());
+-- The call runs in its own statement: a bare subquery in the SAME statement reads the statement's
+-- start snapshot and would not see the call's writes.
+select pg_temp.put('r16', pg_temp.dm_row('A', pg_temp.dm('A', 'T', 'C', ' dk ', 'REWORDED')));
+-- 16 -- identical retry to the existing recipient: same canonical rows, intended inbox refresh
+select is(
+  pg_temp.v('r16')
+  || ' ' || ((select message_id from _r) = pg_temp.u('DM'))::text
+  || ' ' || ((select delivery_recipient_id from _r) = (select id from agent_board.delivery_recipients where source_message_id = pg_temp.u('DM') and recipient_agent_id = pg_temp.u('C')))::text
+  || ' cb=' || (select callback_outbox_count from _r)
+  || ' ' || (select subject || '/' || preview from agent_board.inbox_items where id = (select inbox_item_id from _r)),
+  'ok true true cb=0 subj REWORDED/REWORDED',
+  'direct: a retry to the existing private recipient (trimmed key) reuses message and delivery, refreshes the inbox, queues no second callback');
+-- 17
+select is(
+  pg_temp.fp_rows(), pg_temp.v('fp.before-retry'),
+  'direct: the accepted retry wrote no new message, delivery, inbox item, callback, evidence or telemetry row');
+select pg_temp.put('r18', pg_temp.as_('SVC', pg_temp.signed('signed_send_direct_message', jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_author_agent_id', pg_temp.v('A'),
+            'p_recipient_agent_id', pg_temp.v('C'), 'p_subject', 's', 'p_body', 'SIGNED-RETRY', 'p_idempotency_key', 'dk'))));
+-- 18 -- signed retry to the existing recipient: accepted, one evidence row on the source
+select is(
+  pg_temp.v('r18')
+  || ' ' || pg_temp.scope('DM')
+  || ' ' || (select count(*) from agent_board.signature_evidence where source_message_id = pg_temp.u('DM')),
+  'ok f2b717-c:direct:private 1',
+  'direct, signed wrapper: a retry to the existing recipient is accepted on the source, one evidence row, no new scope');
+-- 19 -- a new key reaches X with a NEW message carrying none of DM's artifacts
+select pg_temp.put('DM.new', pg_temp.val('A', replace(pg_temp.dm('A', 'T', 'X', 'dk2', 'NEW-KEY-BODY'), 'select *', 'select message_id::text')));
+select is(
+  (pg_temp.v('DM.new') is distinct from pg_temp.v('DM'))::text || ' ' || pg_temp.scope('DM.new') || ' | ' || pg_temp.sees('X', 'DM.new') || ' | ' || pg_temp.sees('X', 'DM'),
+  'true f2b717-x:direct:private | 1/0/1/1/1/0 NEW-KEY-BODY | 0/0/0/0/0/0 -',
+  'direct: a new key to X is a new message with no artifact; X still sees nothing of DM');
+-- 20 -- another author's same key is its own message
+select pg_temp.put('DM.a2', pg_temp.val('A2', replace(pg_temp.dm('A2', 'T', 'X', 'dk', 'A2-BODY'), 'select *', 'select message_id::text')));
+select is(
+  (pg_temp.u('DM.a2') is not null and pg_temp.v('DM.a2') not in (pg_temp.v('DM'), pg_temp.v('DM.new')))::text
+  || ' ' || (select a.handle from agent_board.messages m join agent_board.agents a on a.id = m.author_agent_id where m.id = pg_temp.u('DM.a2'))
+  || ' ' || pg_temp.sees('X', 'DM'),
+  'true f2b717-a2 0/0/0/0/0/0 -',
+  'direct: the same key used by another author is that author''s own new message; DM stays hidden from X');
+
+-- ===========================================================================
+-- Multicast: refused replays
+-- ===========================================================================
+-- 21
+select is(pg_temp.refuse('A', pg_temp.mc('A', 'T', pg_temp.ids('C', 'C2', 'X'), 'mk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'multicast: the existing set plus a new recipient is refused');
+-- 22
+select is(pg_temp.refuse('A', pg_temp.mc('A', 'T', pg_temp.ids('X'), 'mk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'multicast: a disjoint set is refused');
+-- 23
+select is(pg_temp.refuse('SVC', pg_temp.mc('A', 'T', pg_temp.ids('C', 'X'), 'mk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'multicast, service_role on the UUID core: refused, the bypass telemetry row rolled back');
+-- 24
+select is(pg_temp.refuse('A', format($$ select * from agent_board.send_multicast_message(%L::uuid, %L::uuid, %L::jsonb, 'addressing_v1', 's', 'b', 'comment', 'medium', 'mk', '{}'::jsonb) $$,
+            pg_temp.v('T'), pg_temp.v('A'), pg_temp.desc_('C', 'X')::text)),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'multicast, addressing overload: descriptors naming a new recipient are refused');
+-- 25
+select is(pg_temp.refuse('SVC', pg_temp.signed('signed_send_multicast_message', jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_author_agent_id', pg_temp.v('A'),
+            'p_recipient_agent_ids', jsonb_build_array(pg_temp.v('C'), pg_temp.v('X')), 'p_subject', 's', 'p_body', 'b', 'p_idempotency_key', 'mk'))),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'multicast, signed UUID branch: refused with no signature evidence, delivery, inbox or callback');
+-- 26
+select is(pg_temp.refuse('SVC', pg_temp.signed('signed_send_multicast_message', jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_author_agent_id', pg_temp.v('A'),
+            'p_recipient_descriptors', pg_temp.desc_('X'), 'p_addressing_mode', 'addressing_v1', 'p_subject', 's', 'p_body', 'b', 'p_idempotency_key', 'mk'))),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'multicast, signed descriptor branch: refused with no side effect');
+-- 27
+select is(pg_temp.refuse('A', pg_temp.mc('A', 'T', pg_temp.ids('C', 'X'), 'mk', 'b',
+            jsonb_build_object('rpcName', 'send_multicast_message', 'idempotencyKey', 'mk', 'recipientAgentIds', jsonb_build_array(pg_temp.v('C'), pg_temp.v('X'))))),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'multicast: caller metadata naming X is not evidence');
+-- 28 -- a direct delivery of the same message to X would be another mode: not evidence either
+insert into agent_board.delivery_recipients(delivery_mode, recipient_agent_id, source_kind, source_message_id)
+values ('direct', pg_temp.u('X'), 'message', pg_temp.u('MC'))
+on conflict (recipient_agent_id, canonical_source_key) do nothing;
+select is(pg_temp.refuse('A', pg_temp.mc('A', 'T', pg_temp.ids('C', 'X'), 'mk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'multicast: a delivery of the source in another mode (direct, forged as owner) is not evidence');
+delete from agent_board.delivery_recipients where source_message_id = pg_temp.u('MC') and recipient_agent_id = pg_temp.u('X');
+-- 29
+select is(pg_temp.refuse('A', pg_temp.mc('A', 'T', 'array[]::uuid[]', 'mk')) || ' || ' || pg_temp.refuse('A', pg_temp.mc('A', 'T', 'null::uuid[]', 'mk')),
+  '22023:recipient_agent_ids must not be empty | side-effects=none || 22023:recipient_agent_ids must not be empty | side-effects=none',
+  'multicast: an empty or null set is still refused as before (a subset must be nonempty)');
+
+-- ===========================================================================
+-- Multicast: accepted retries (normalization, subset) and new keys
+-- ===========================================================================
+create temp table _rm as select * from agent_board.send_multicast_message(null, null, null, null, null) where false;
+grant all on _rm to authenticated, service_role;
+create function pg_temp.mc_row(p_who text, p_sql text) returns text language plpgsql as $$
+begin
+  delete from _rm;
+  return pg_temp.as_(p_who, 'insert into _rm ' || p_sql);
+end $$;
+select pg_temp.put('fp.before-mc-retry', pg_temp.fp_rows());
+select pg_temp.put('r30', pg_temp.mc_row('A', pg_temp.mc('A', 'T', pg_temp.ids('C2', 'C', 'C2', 'C'), 'mk', 'MC-RETRY')));
+-- 30 -- the same set, reordered and duplicated
+select is(
+  pg_temp.v('r30')
+  || ' ' || ((select message_id from _rm) = pg_temp.u('MC'))::text
+  || ' ' || (select delivered_recipient_count || '/' || inbox_item_count || '/' || callback_outbox_count from _rm)
+  || ' ' || pg_temp.scope('MC'),
+  'ok true 2/2/0 f2b717-c:multicast:private,f2b717-c2:multicast:private',
+  'multicast: the same set reordered and duplicated reuses the message, re-touches two deliveries, queues no new callback');
+-- 31
+select is(
+  pg_temp.fp_rows(), pg_temp.v('fp.before-mc-retry'),
+  'multicast: the accepted normalized retry wrote no new row anywhere');
+select pg_temp.put('r32', pg_temp.mc_row('A', pg_temp.mc('A', 'T', pg_temp.ids('C'), 'mk', 'MC-SUBSET')));
+-- 32 -- a nonempty subset: accepted, and C2's delivery is kept, not revoked
+select is(
+  pg_temp.v('r32')
+  || ' ' || ((select message_id from _rm) = pg_temp.u('MC'))::text
+  || ' ' || (select delivered_recipient_count::text from _rm)
+  || ' ' || pg_temp.scope('MC') || ' | ' || pg_temp.sees('C2', 'MC'),
+  'ok true 1 f2b717-c:multicast:private,f2b717-c2:multicast:private | 1/1/1/1/1/0 A-PRIVATE-MC-BODY',
+  'multicast: a subset retry is accepted; the omitted recipient keeps its delivery and its access');
+-- 33 -- addressing overload with the existing set: accepted on the source
+select is(
+  pg_temp.as_('A', format($$ select * from agent_board.send_multicast_message(%L::uuid, %L::uuid, %L::jsonb, 'addressing_v1', 's', 'MC-ADDR', 'comment', 'medium', 'mk', '{}'::jsonb) $$,
+            pg_temp.v('T'), pg_temp.v('A'), pg_temp.desc_('C', 'C2')::text))
+  || ' ' || pg_temp.scope('MC'),
+  'ok f2b717-c:multicast:private,f2b717-c2:multicast:private',
+  'multicast, addressing overload: the existing set is accepted, scope unchanged');
+select pg_temp.put('r34', pg_temp.as_('SVC', pg_temp.signed('signed_send_multicast_message', jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_author_agent_id', pg_temp.v('A'),
+            'p_recipient_agent_ids', jsonb_build_array(pg_temp.v('C2')), 'p_subject', 's', 'p_body', 'b', 'p_idempotency_key', 'mk')))
+  || ' ' || pg_temp.as_('SVC', pg_temp.signed('signed_send_multicast_message', jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_author_agent_id', pg_temp.v('A'),
+            'p_recipient_descriptors', pg_temp.desc_('C', 'C2'), 'p_addressing_mode', 'addressing_v1', 'p_subject', 's', 'p_body', 'b', 'p_idempotency_key', 'mk'))));
+-- 34 -- both signed branches with the existing set: accepted, one evidence row each
+select is(
+  pg_temp.v('r34')
+  || ' ' || pg_temp.scope('MC')
+  || ' ' || (select count(*) from agent_board.signature_evidence where source_message_id = pg_temp.u('MC')),
+  'ok ok f2b717-c:multicast:private,f2b717-c2:multicast:private 2',
+  'multicast, both signed branches: retries within the set are accepted on the source with their evidence, no new scope');
+-- 35 -- a new key: a new message, no copied artifact
+select pg_temp.put('MC.new', pg_temp.val('A', replace(pg_temp.mc('A', 'T', pg_temp.ids('C', 'X'), 'mk2', 'MC-NEW-KEY'), 'select *', 'select message_id::text')));
+select is(
+  (pg_temp.v('MC.new') is distinct from pg_temp.v('MC'))::text || ' ' || pg_temp.scope('MC.new') || ' | ' || pg_temp.sees('X', 'MC.new') || ' | ' || pg_temp.sees('X', 'MC'),
+  'true f2b717-c:multicast:private,f2b717-x:multicast:private | 1/0/1/1/1/0 MC-NEW-KEY | 0/0/0/0/0/0 -',
+  'multicast: a new key to {C, X} is a new message with no artifact; X still sees nothing of MC');
+-- 36
+select pg_temp.put('MC.a2', pg_temp.val('A2', replace(pg_temp.mc('A2', 'T', pg_temp.ids('X'), 'mk', 'A2-MC'), 'select *', 'select message_id::text')));
+select is(
+  (pg_temp.u('MC.a2') is not null and pg_temp.v('MC.a2') not in (pg_temp.v('MC'), pg_temp.v('MC.new')))::text || ' ' || pg_temp.scope('MC.a2') || ' ' || pg_temp.sees('X', 'MC'),
+  'true f2b717-x:multicast:private 0/0/0/0/0/0 -',
+  'multicast: the same key used by another author is its own message; MC stays hidden from X');
+
+-- ===========================================================================
+-- After every attempt: the sources are exactly as they were and invisible to X, M and Y
+-- ===========================================================================
+-- 37
+select is(pg_temp.history('DM') || ' ' || pg_temp.history('MC') || ' ' || pg_temp.history('DMB'),
+  pg_temp.v('DM.history') || ' ' || pg_temp.v('MC.history') || ' ' || pg_temp.v('DMB.history'),
+  'after: DM, MC and DMB keep their ids, author, body, metadata, artifacts and delivery rows');
+-- 38
+select is(pg_temp.sees('X', 'DM') || ' | ' || pg_temp.sees('X', 'MC') || ' | ' || pg_temp.sees('X', 'DMB'),
+  '0/0/0/0/0/0 - | 0/0/0/0/0/0 - | 0/0/0/0/0/0 -',
+  'after: X sees none of the three sources or the artifacts C anchored to them');
+-- 39
+select is(pg_temp.sees('M', 'DMB') || ' | ' || pg_temp.sees('Y', 'DMB') || ' | ' || pg_temp.sees('M', 'DM'),
+  '0/0/0/0/0/0 - | 0/0/0/0/0/0 - | 0/0/0/0/0/0 -',
+  'after: board members still see nothing of the private DM on the board-stamped thread');
+-- 40 -- old recipients keep exactly their access
+select is(pg_temp.sees('C', 'DM') || ' | ' || pg_temp.sees('C', 'MC') || ' | ' || pg_temp.sees('C2', 'MC') || ' | ' || pg_temp.sees('C', 'DMB'),
+  '1/1/1/1/1/1 A-PRIVATE-DM-BODY | 1/1/1/1/1/2 A-PRIVATE-MC-BODY | 1/1/1/1/1/2 A-PRIVATE-MC-BODY | 1/1/1/1/1/0 A-PRIVATE-BOARD-THREAD-DM',
+  'after: C and C2 keep exactly their own access (plus the evidence rows of the accepted signed retries 18 and 34)');
+-- 41
+select is(
+  (select count(*)::int from agent_board.inbox_items where source_message_id in (pg_temp.u('DM'), pg_temp.u('MC'), pg_temp.u('DMB')))
+  || '/' || (select count(*)::int from agent_board.callback_outbox_events where source_message_id in (pg_temp.u('DM'), pg_temp.u('MC'), pg_temp.u('DMB'))),
+  '4/4',
+  'after: the sources have exactly their four original inbox items and four callbacks (no retry duplicated one)');
+
+-- ===========================================================================
+-- Preserved behaviour beside the ceiling
+-- ===========================================================================
+-- 42 -- canonical reply on an inherited board thread still fans out to the board (#661)
+select pg_temp.put('REPLY', pg_temp.val('A', format($$ select message_id::text from agent_board.post_message(%L, %L, 'BOARD-REPLY') $$, pg_temp.v('TB'), pg_temp.v('A'))));
+select is(pg_temp.sees('M', 'REPLY'),
+  '1/0/4/4/1/0 BOARD-REPLY',
+  'preserved: a reply on the board-stamped thread still fans out to B (#661); M reads it and the board-scoped delivery/inbox rows, and its own callback');
+-- 43 -- post_message has no replay: the same reserved metadata twice is two messages
+select is(
+  (pg_temp.val('A', format($$ select message_id::text from agent_board.post_message(%L, %L, 'R', 'comment', null, %L::jsonb) $$,
+     pg_temp.v('T'), pg_temp.v('A'), jsonb_build_object('rpcName', 'send_direct_message', 'idempotencyKey', 'pk')::text))
+   <> pg_temp.val('A', format($$ select message_id::text from agent_board.post_message(%L, %L, 'R', 'comment', null, %L::jsonb) $$,
+     pg_temp.v('T'), pg_temp.v('A'), jsonb_build_object('rpcName', 'send_direct_message', 'idempotencyKey', 'pk')::text)))::text,
+  'true',
+  'no-replay disposition: post_message never reuses a message, even under identical reserved metadata');
+-- 44 -- the one-board disposition: a same-key board post cannot move to another board
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+values ('717b2000-0000-4000-8000-000000000002', 'f2b717-b2', 'F2b B2', pg_temp.u('A'), 'private', 'active');
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+values ('717b2000-0000-4000-8000-000000000002', pg_temp.u('A'), 'owner', 'joined', pg_temp.u('A'));
+select is(pg_temp.refuse('A', format($$ select * from agent_board.post_board_message(%L, %L, %L, 's', 'moved', 'comment', 'medium', 'pbk') $$,
+            pg_temp.v('TB'), pg_temp.v('A'), '717b2000-0000-4000-8000-000000000002')),
+  '42501:thread belongs to a different board | side-effects=none',
+  'one-board disposition: a board post on TB cannot target another board');
+-- 45 -- service_role acting for A on an identical retry is still accepted on the source
+select is(
+  pg_temp.as_('SVC', pg_temp.dm('A', 'T', 'C', 'dk', 'SVC-RETRY')) || ' ' || pg_temp.scope('DM'),
+  'ok f2b717-c:direct:private',
+  'direct, service_role: an identical retry for the supplied author is accepted, scope unchanged');
+-- 46 -- A2's key dk already reached X (20), so a service-role replay of A2/dk to C names a NEW
+--       recipient of A2's message and is refused
+select is(pg_temp.refuse('SVC', pg_temp.dm('A2', 'T', 'C', 'dk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'direct: the ceiling is per source author: A2''s own dk message cannot be widened to C either');
+
+-- ===========================================================================
+-- The cores' catalog surface
+-- ===========================================================================
+-- Lock identity and refusal placement are pinned BEHAVIOURALLY: tests/isolation/specs/
+-- message_replay_scope.spec (a lock keyed differently or removed lets the conflicting send through,
+-- or lets identical retries duplicate), 20/36 here (another author is a separate identity), and
+-- every refusal above reporting side-effects=none.
+-- 47
+select is(
+  (select string_agg(p.proname || ':' || p.prosecdef::text || '/' || coalesce(array_to_string(p.proconfig, ','), '')
+            || ' ' || (select string_agg(r || '=' || has_function_privilege(r, p.oid, 'EXECUTE')::text, ' ' order by r)
+                         from unnest(array['anon', 'authenticated', 'agent_board_delegate', 'service_role']) r), ' | ' order by p.proname)
+     from pg_proc p
+    where p.oid in ('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure,
+                    'agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure)),
+  'send_direct_message:true/search_path=agent_board, public agent_board_delegate=false anon=false authenticated=true service_role=true'
+  || ' | send_multicast_message:true/search_path=agent_board, public agent_board_delegate=false anon=false authenticated=true service_role=true',
+  'both cores stay SECURITY DEFINER with their search_path, EXECUTE for authenticated and service_role only');
+-- 48
+select ok(
+  obj_description('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)'::regprocedure, 'pg_proc') ~ 'cannot widen the message''s audience'
+  and obj_description('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)'::regprocedure, 'pg_proc') ~ 'cannot widen the message''s audience',
+  'both cores'' comments state the replay ceiling');
+
+-- ===========================================================================
+-- THE CLASS, derived from the catalog (AGENTS.md rule 1)
+-- ===========================================================================
+-- Three derived sets, unioned, each read from pg_proc through the shared matcher family
+-- (tests/fixtures/test-prereqs.sql), never a regex written here:
+--   WRITERS   every agent_board routine whose literal-stripped body writes delivery_recipients or
+--             inbox_items (writes_any_re: INSERT/UPDATE/DELETE/MERGE/COPY, every spelling CPR-0 pins);
+--   CLOSURE   every routine that reaches a writer through any chain of calls (fn_call_closure, by
+--             name, so every overload of a matched name is included: over-inclusive by design);
+--   REPLAY    every routine that serializes through _lock_idempotency_key, or whose code (literals
+--             kept, comments stripped) names the 'idempotencyKey' metadata key the replay lookups
+--             read back -- a lookup by that key cannot be written without naming it.
+-- BOUNDARY: agent_board routines only. Calls are matched by name in stripped bodies, so dynamic SQL
+-- that names a writer is not followed: 52 asserts no routine in the class contains an EXECUTE at
+-- all, so that hole names itself rather than hides. Views and RLS policies are not routines and
+-- cannot write; out-of-schema routines are #717 F1's census (DWX), not repeated here.
+-- Each member has ONE disposition, each pinned positively:
+--   ceiling         the two cores: refusals 6-15, 21-29 here
+--   routes-core     a wrapper whose body calls its core and writes nothing itself (51), and whose
+--                   widening is refused here (8, 9, 24, 25, 26)
+--   internal        not EXECUTE-able by anon/authenticated/agent_board_delegate (50); service_role
+--                   EXECUTE on _upsert_delivery_recipient/_upsert_inbox_item is #717 F1's to revoke
+--                   and is REPORTED in the value, not hidden
+--   one-board       post_board_message family: 44
+--   no-replay       post_message: 43 (two identical calls, two messages)
+--   recipient-state update_inbox_item_state: UPDATEs the caller's OWN inbox item only (63)
+--   tasking-f2      create_tasking_delivery family: #717 F2's ceiling (separate PR); NOT claimed here
+create temp table _class(signature text primary key, disposition text not null);
+insert into _class values
+  ('send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'ceiling'),
+  ('send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)', 'ceiling'),
+  ('send_direct_message(uuid,uuid,jsonb,text,text,text,text,text,text,jsonb)', 'routes-core:send_direct_message'),
+  ('send_multicast_message(uuid,uuid,jsonb,text,text,text,text,text,text,jsonb)', 'routes-core:send_multicast_message'),
+  ('signed_send_direct_message(jsonb,jsonb)', 'routes-core:send_direct_message'),
+  ('signed_send_multicast_message(jsonb,jsonb)', 'routes-core:send_multicast_message'),
+  ('_upsert_delivery_recipient(text,uuid,text,uuid,uuid,uuid,uuid,uuid,jsonb)', 'internal'),
+  ('_upsert_inbox_item(uuid,uuid,uuid,text,text,uuid,uuid,uuid,text,text,text,boolean,boolean,jsonb,jsonb)', 'internal'),
+  ('_deliver_board_message(uuid,text,text,text)', 'internal'),
+  ('post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'one-board'),
+  ('post_board_message(uuid,uuid,text,text,text,text,text,text,text,jsonb)', 'one-board'),
+  ('signed_post_board_message(jsonb,jsonb)', 'one-board'),
+  ('post_message(uuid,uuid,text,text,uuid,jsonb)', 'no-replay'),
+  ('update_inbox_item_state(uuid,uuid,text,jsonb)', 'recipient-state'),
+  ('create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)', 'tasking-f2'),
+  ('create_tasking_delivery(uuid,uuid,text,text,jsonb,text,text,text,text,text,jsonb)', 'tasking-f2'),
+  ('signed_create_tasking_delivery(jsonb,jsonb)', 'tasking-f2');
+
+create function pg_temp.derived() returns table(signature text, body text) language sql as $d$
+  with fns as (
+    select p.oid, p.proname::text as proname,
+           p.proname || '(' || replace(oidvectortypes(p.proargtypes), ' ', '') || ')' as signature,
+           agent_board_test.stripped_body(p.oid) as body,
+           agent_board_test.stripped_body(p.oid, true) as lit_body
+      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+     where n.nspname = 'agent_board' and p.prokind in ('f', 'p')
+       and p.prolang <> (select oid from pg_language where lanname = 'internal')),
+  writers as (
+    select oid from fns where body ~ agent_board_test.writes_any_re(array['delivery_recipients', 'inbox_items'])),
+  closure as (
+    select c.root_oid as oid from agent_board_test.fn_call_closure() c where c.reached_oid in (select oid from writers)),
+  replay as (
+    select oid from fns
+     where body ~ agent_board_test.call_re('_lock_idempotency_key')
+        or lit_body ~ 'idempotencyKey')
+  select f.signature, f.body
+    from fns f
+   where (f.oid in (select oid from closure) or f.oid in (select oid from replay))
+     and f.proname <> '_lock_idempotency_key'
+$d$;
+create temp table _derived as select * from pg_temp.derived();
+-- 49
+select is(
+  (select coalesce(string_agg(signature, ' ' order by signature), '(none)') from (
+     select signature from _derived except select signature from _class) d)
+  || ' || stale: ' ||
+  (select coalesce(string_agg(signature, ' ' order by signature), '(none)') from (
+     select signature from _class except select signature from _derived) d),
+  '(none) || stale: (none)',
+  'CLASS: the derived writer/caller/replay class equals the dispositioned set exactly (a new site, or a stale exemption, names itself)');
+-- 50 -- internal: positively, no end-user API role can execute it; service_role reported as found
+select is(
+  (select string_agg(c.signature || '=' || coalesce((select string_agg(r, ',' order by r) from unnest(array['anon', 'authenticated', 'agent_board_delegate', 'service_role']) r
+                                                       where has_function_privilege(r, ('agent_board.' || c.signature)::regprocedure, 'EXECUTE')), '-'), ' ' order by c.signature)
+     from _class c where c.disposition = 'internal'),
+  '_deliver_board_message(uuid,text,text,text)=-'
+  || ' _upsert_delivery_recipient(text,uuid,text,uuid,uuid,uuid,uuid,uuid,jsonb)=' || case when has_function_privilege('service_role', 'agent_board._upsert_delivery_recipient(text,uuid,text,uuid,uuid,uuid,uuid,uuid,jsonb)', 'EXECUTE') then 'service_role' else '-' end
+  || ' _upsert_inbox_item(uuid,uuid,uuid,text,text,uuid,uuid,uuid,text,text,text,boolean,boolean,jsonb,jsonb)=' || case when has_function_privilege('service_role', 'agent_board._upsert_inbox_item(uuid,uuid,uuid,text,text,uuid,uuid,uuid,text,text,text,boolean,boolean,jsonb,jsonb)', 'EXECUTE') then 'service_role' else '-' end,
+  'internal writers: anon, authenticated and agent_board_delegate cannot execute any of them (service_role reported; #717 F1 revokes it)');
+-- 51 -- routes-core: each wrapper calls its core and writes no delivery/inbox row itself
+select is(
+  (select coalesce(string_agg(c.signature, ' ' order by c.signature), '(none)')
+     from _class c join _derived d on d.signature = c.signature
+    where c.disposition like 'routes-core:%'
+      and not (d.body ~ agent_board_test.call_re(split_part(c.disposition, ':', 2))
+               and d.body !~ agent_board_test.writes_any_re(array['delivery_recipients', 'inbox_items'])
+               and d.body !~ agent_board_test.call_re('_upsert_delivery_recipient')
+               and d.body !~ agent_board_test.call_re('_upsert_inbox_item'))),
+  '(none)',
+  'routes-core: every wrapper disposition calls its named core and writes no delivery itself');
+-- 52 -- the boundary: no member of the class contains an EXECUTE (dynamic SQL a name match cannot follow)
+select is(
+  (select coalesce(string_agg(signature, ' ' order by signature), '(none)') from _derived
+    where body ~ agent_board_test.re(agent_board_test.lead_guard() || agent_board_test.ci_re('execute') || agent_board_test.trail_guard())),
+  '(none)',
+  'BOUNDARY: no routine in the class contains EXECUTE, so name-matched call closure is complete for it');
+
+-- 53 -- discriminance of the derivation itself: it must name a planted site of each kind. The
+-- plants live only inside this rolled-back transaction and are dropped straight after.
+create function agent_board.zz_f2b_probe_writer(p uuid) returns void language plpgsql as $f$
+begin update agent_board.inbox_items set subject = subject where id = p; end $f$;
+create function agent_board.zz_f2b_probe_caller() returns void language plpgsql as $f$
+begin perform agent_board._upsert_delivery_recipient('direct', null, 'message'); end $f$;
+create function agent_board.zz_f2b_probe_replay(p text) returns void language plpgsql as $f$
+begin perform 1 from agent_board.messages where metadata ->> 'idempotencyKey' = p; end $f$;
+select is(
+  (select string_agg(signature, ' ' order by signature) from pg_temp.derived() where signature like 'zz\_f2b\_probe\_%'),
+  'zz_f2b_probe_caller() zz_f2b_probe_replay(text) zz_f2b_probe_writer(uuid)',
+  'DISCRIMINANCE: the derivation names a planted writer, a planted caller of a writer and a planted replay lookup');
+drop function agent_board.zz_f2b_probe_writer(uuid);
+drop function agent_board.zz_f2b_probe_caller();
+drop function agent_board.zz_f2b_probe_replay(text);
+
+-- ===========================================================================
+-- Direct-call controls for the signed wrappers
+-- ===========================================================================
+-- 54
+select is(pg_temp.refuse('A', pg_temp.signed('signed_send_direct_message', jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_recipient_agent_id', pg_temp.v('X'), 'p_subject', 's', 'p_body', 'b', 'p_idempotency_key', 'dk')))
+          || ' || ' || pg_temp.refuse('A', pg_temp.signed('signed_send_multicast_message', jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_recipient_agent_ids', jsonb_build_array(pg_temp.v('X')), 'p_subject', 's', 'p_body', 'b', 'p_idempotency_key', 'mk'))),
+  '42501:permission denied for function signed_send_direct_message | side-effects=none || 42501:permission denied for function signed_send_multicast_message | side-effects=none',
+  'signed wrappers: an authenticated agent cannot call them directly');
+-- 55
+select is(pg_temp.refuse('SVC', pg_temp.signed('signed_send_direct_message', jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_author_agent_id', pg_temp.v('A2'),
+            'p_recipient_agent_id', pg_temp.v('X'), 'p_subject', 's', 'p_body', 'b', 'p_idempotency_key', 'dk'))),
+  '42501:actor_mismatch: signed write payload actor must match gateway actor | side-effects=none',
+  'signed: a payload author that differs from the gateway actor is refused');
+
+-- ===========================================================================
+-- Visibility census: every authenticated read path to a message-anchored row follows deliveries
+-- ===========================================================================
+-- 56 -- the tables an authenticated agent can read that carry a message reference, from the catalog
+select is(
+  (select string_agg(distinct c.conrelid::regclass::text, ' ' order by c.conrelid::regclass::text)
+     from pg_constraint c
+    where c.contype = 'f' and c.confrelid = 'agent_board.messages'::regclass
+      and has_table_privilege('authenticated', c.conrelid, 'SELECT')),
+  'artifacts callback_outbox_events delivery_recipients inbox_items signature_evidence',
+  'CLASS: the authenticated-readable tables referencing messages, from pg_constraint: each one is counted by sees()');
+-- 57 -- the same for hosted delegates (they cannot be addressed privately; their read paths are board-scoped)
+select is(
+  (select coalesce(string_agg(distinct c.conrelid::regclass::text, ' ' order by c.conrelid::regclass::text), '(none)')
+     from pg_constraint c
+    where c.contype = 'f' and c.confrelid = 'agent_board.messages'::regclass
+      and has_table_privilege('agent_board_delegate', c.conrelid, 'SELECT')),
+  'delivery_recipients inbox_items signature_evidence',
+  'CLASS: the delegate-readable tables referencing messages are a subset of what sees() counts');
+-- 58
+select is(pg_temp.sees('X', 'DM.a2') || ' | ' || pg_temp.sees('X', 'MC.a2'),
+  '1/0/1/1/1/0 A2-BODY | 1/0/1/1/1/0 A2-MC',
+  'separate author: X sees A2''s own messages (no artifacts), which carry nothing of A''s');
+-- 59
+select is(pg_temp.sees('C', 'DM.a2'),
+  '0/0/0/0/0/0 -',
+  'separate author: the refused service-role widening of A2''s message to C wrote nothing C can see');
+-- 60
+select is((select count(*)::int from agent_board.messages where thread_id = pg_temp.u('T') and metadata ->> 'idempotencyKey' = 'dk'),
+  2,
+  'identity: exactly two dk messages on T, one per author (A, A2); no retry minted another');
+-- 61
+select is((select count(*)::int from agent_board.messages where thread_id = pg_temp.u('T') and metadata ->> 'idempotencyKey' = 'mk'),
+  2,
+  'identity: exactly two mk messages on T, one per author');
+-- 62
+select is(pg_temp.sees('C', 'DM'), '1/1/1/1/1/1 A-PRIVATE-DM-BODY', 'after: C still reads DM after the signed retry and every refusal');
+
+-- Snapshot protected inbox fields across every row: state, metadata and timestamp may change,
+-- but a private helper reached by the state RPC must not alter content, addressing or visibility.
+create function pg_temp.protected_inbox() returns text language sql as $$
+  select coalesce(jsonb_agg(to_jsonb(i) - array['action_state','metadata','updated_at'] order by i.id), '[]'::jsonb)::text
+    from agent_board.inbox_items i
+$$;
+select pg_temp.put('state.protected.before', pg_temp.protected_inbox());
+
+-- 63 -- recipient-state disposition: another agent cannot touch C's inbox item; C can, and no scope moves
+select pg_temp.put('C.dm.inbox', (select id::text from agent_board.inbox_items where source_message_id = pg_temp.u('DM') and recipient_agent_id = pg_temp.u('C')));
+select is(
+  pg_temp.refuse('X', format($$ select * from agent_board.update_inbox_item_state(%L, %L, 'read') $$, pg_temp.v('C.dm.inbox'), pg_temp.v('X')))
+  || ' || ' || pg_temp.as_('C', format($$ select * from agent_board.update_inbox_item_state(%L, %L, 'read') $$, pg_temp.v('C.dm.inbox'), pg_temp.v('C')))
+  || ' ' || pg_temp.scope('DM'),
+  'P0002:inbox item not found | side-effects=none || ok f2b717-c:direct:private',
+  'recipient-state disposition: update_inbox_item_state reaches only the caller''s own item and creates no delivery');
+select pg_temp.put('state.protected.after', pg_temp.protected_inbox());
+
+-- 64 -- why the cores' `board_id is null` conjunct cannot be mutation-pinned on its own: the table's
+-- delivery_recipients_board_scope CHECK already forbids a board-scoped direct or multicast row, so a
+-- matching-mode delivery is private by construction. Dropping the conjunct alone is an EQUIVALENT
+-- mutation (receipt M6, 0 failures); this assertion pins the constraint it relies on (receipt C6).
+create function pg_temp.try_owner(p_sql text) returns text language plpgsql as $$
+begin execute p_sql; return 'ok'; exception when others then return sqlstate; end $$;
+select is(
+  pg_temp.try_owner(format($$ insert into agent_board.delivery_recipients(delivery_mode, recipient_agent_id, source_kind, source_message_id, board_id, board_membership_id)
+                              values ('direct', %L, 'message', %L, %L, (select id from agent_board.board_memberships where board_id = %L and agent_id = %L)) $$,
+                           pg_temp.v('M'), pg_temp.v('DMB'), pg_temp.v('B'), pg_temp.v('B'), pg_temp.v('M')))
+  || ' ' || pg_temp.try_owner(format($$ insert into agent_board.delivery_recipients(delivery_mode, recipient_agent_id, source_kind, source_message_id, board_id, board_membership_id)
+                              values ('multicast', %L, 'message', %L, %L, (select id from agent_board.board_memberships where board_id = %L and agent_id = %L)) $$,
+                           pg_temp.v('M'), pg_temp.v('DMB'), pg_temp.v('B'), pg_temp.v('B'), pg_temp.v('M'))),
+  '23514 23514',
+  'the table CHECK forbids a board-scoped direct or multicast delivery, so a matching-mode proof is private by construction');
+
+-- 65: protected content proof covers the actual call including every private helper it reaches.
+select is(pg_temp.v('state.protected.after'), pg_temp.v('state.protected.before'),
+  'recipient-state disposition: the successful update and all reached helpers preserve every inbox row protected field');
+-- X already received unrelated multicast messages through the new-key and separate-author cases.
+-- 66: their delivery rows cannot establish scope for A's original MC message.
+select is(pg_temp.refuse('A', pg_temp.mc('A','T',pg_temp.ids('X'),'mk')),
+  '42501:message replay cannot widen delivery scope | side-effects=none',
+  'multicast source proof: X holding unrelated multicast cannot authorize delivery of the original message');
+-- 67
+select is(pg_temp.sees('X','MC'), '0/0/0/0/0/0 -',
+  'multicast source proof: the original body and C-authored artifact remain invisible after unrelated-delivery replay');
+
+select * from finish();
+rollback;