@consiliency/agent-board-schema 1.68.0 → 1.74.0

package/tests/agent_board_717_tasking_replay_scope.test.sql

@@ -0,0 +1,661 @@
+-- #717 F2: a same-key create_tasking_delivery replay cannot widen the task's delivery scope.
+--
+-- THE DEFECT (main 21b7b158, review S9). Idempotency is keyed on (thread, resolved creator, key).
+-- A replay reused the task and fanned it out to whatever the RETRY named, so a private task on a
+-- board-stamped thread, replayed with that board, became readable by every board member and --
+-- through the hosted delegate policies, which admit a task's events, claims and escalations once
+-- ANY board-scoped delivery of the task names a board the delegate is on -- by that board's
+-- delegates, together with history OTHER agents authored on the task.
+--
+-- THE CONTRACT pinned here: canonical identity and lock unchanged; a replay may name the same
+-- audience or a subset; a board only if a board-scoped tasking delivery of the task already names
+-- it; an explicit recipient only if it already holds a PRIVATE (null-board) tasking delivery of the
+-- task. Anything else is 42501 'tasking replay cannot widen delivery scope', with no side effect.
+-- Metadata and thread stamps are not evidence. A new audience needs a new key.
+--
+-- METHOD (AGENTS.md rules 2 and 3).
+--   * Every actor runs under its OWN role AND claims: `set local role authenticated|service_role|
+--     agent_board_delegate` plus a JSON claim set, and the flattened request.jwt.claim.* GUCs are
+--     cleared on every switch so they cannot shadow the JSON claims and test another identity.
+--   * Hosted delegates are minted by the real exchange_delegate_credential and placed by their
+--     owner through add_delegate_to_board, and call with their real credential id.
+--   * The private task's history is written by its ASSIGNEE C through the public RPCs, after a
+--     legal assignment, so the rows that must stay hidden are another agent's, not the creator's.
+--   * Every call is run by a helper with its own exception block that returns 'ok' or
+--     '<sqlstate>:<message>'; refusals compare the exact message, and the same helper reports the
+--     side-effect fingerprint delta it measured around the call. State reads are separate queries.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(56);
+
+do $$
+begin
+  if not (select rolsuper from pg_roles where rolname = current_user) then
+    execute format('grant agent_board_delegate to %I with set true', current_user);
+  end if;
+end $$;
+
+create temp table _h(k text primary key, v text);
+create function pg_temp.v(p_k text) returns text language sql as $$ select v from _h where k = p_k $$;
+create function pg_temp.u(p_k text) returns uuid language sql as $$ select v::uuid from _h where k = p_k $$;
+create function pg_temp.put(p_k text, p_v text) returns void language sql as $$
+  insert into _h values (p_k, p_v) on conflict (k) do update set v = excluded.v $$;
+
+-- Identity switch: one JSON claim set, every flattened claim GUC cleared.
+create function pg_temp.ident(p_role text, p_sub uuid, p_cred uuid) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claim.sub', '', true);
+  perform set_config('request.jwt.claim.role', '', true);
+  perform set_config('request.jwt.claim.agent_credential_id', '', true);
+  perform set_config('request.jwt.claim.identity_lease_epoch', '', true);
+  perform set_config('request.jwt.claims',
+    case when p_role is null then ''
+         else jsonb_strip_nulls(jsonb_build_object('role', p_role, 'sub', p_sub, 'agent_credential_id', p_cred))::text end,
+    true);
+end $$;
+
+-- Run p_sql AS actor p_who (its role and claims). Returns 'ok' or '<sqlstate>:<message>'.
+create function pg_temp.as_(p_who text, p_sql text) returns text language plpgsql as $$
+declare
+  v text;
+  v_role text := pg_temp.v(p_who || '.role');
+  v_sub uuid := pg_temp.u(p_who || '.auth');
+  v_cred uuid := pg_temp.u(p_who || '.cred');
+begin
+  perform pg_temp.ident(v_role, v_sub, v_cred);
+  execute format('set local role %I', v_role);
+  begin
+    execute p_sql;
+    v := 'ok';
+  exception when others then
+    v := sqlstate || ':' || sqlerrm;
+  end;
+  reset role;
+  perform pg_temp.ident(null, null, null);
+  return v;
+end $$;
+
+-- Run p_sql AS actor p_who and return its single scalar.
+create function pg_temp.val(p_who text, p_sql text) returns text language plpgsql as $$
+declare
+  v text;
+  v_role text := pg_temp.v(p_who || '.role');
+  v_sub uuid := pg_temp.u(p_who || '.auth');
+  v_cred uuid := pg_temp.u(p_who || '.cred');
+begin
+  perform pg_temp.ident(v_role, v_sub, v_cred);
+  execute format('set local role %I', v_role);
+  begin
+    execute p_sql into v;
+  exception when others then
+    v := 'ERR ' || sqlstate || ':' || sqlerrm;
+  end;
+  reset role;
+  perform pg_temp.ident(null, null, null);
+  return coalesce(v, '(null)');
+end $$;
+
+-- Everything a tasking send can write, counted globally (this transaction is the only writer).
+-- fp_rows() counts rows; fp() adds a digest of every inbox item's presentation, which a replay
+-- legitimately refreshes on an accepted retry but must not touch on a refused one.
+create function pg_temp.fp_rows() returns text language plpgsql as $$
+declare v text;
+begin
+  select concat_ws(' ',
+    'tasks=' || (select count(*) from agent_board.tasks),
+    'events=' || (select count(*) from agent_board.task_events),
+    'deliveries=' || (select count(*) from agent_board.delivery_recipients),
+    'inbox=' || (select count(*) from agent_board.inbox_items),
+    'callbacks=' || (select count(*) from agent_board.callback_outbox_events),
+    'evidence=' || (select count(*) from agent_board.signature_evidence),
+    'telemetry=' || (select count(*) from agent_board.send_authz_telemetry),
+    'stamped=' || (select count(*) from agent_board.threads where board_id is not null))
+    into v;
+  return v;
+end $$;
+create function pg_temp.fp() returns text language sql as $$
+  select pg_temp.fp_rows() || ' inboxtxt=' || (select md5(coalesce(string_agg(id::text || subject || coalesce(preview, ''), ',' order by id), ''))
+                                                 from agent_board.inbox_items)
+$$;
+
+-- A call that must be REFUSED: '<result> | side-effects=none' when nothing changed.
+create function pg_temp.refuse(p_who text, p_sql text) returns text language plpgsql as $$
+declare v_before text := pg_temp.fp(); v_res text; v_after text;
+begin
+  v_res := pg_temp.as_(p_who, p_sql);
+  v_after := pg_temp.fp();
+  return v_res || ' | side-effects=' || case when v_after = v_before then 'none' else v_before || ' -> ' || v_after end;
+end $$;
+
+-- Rows of task p_task as actor p_who sees them: tasks/events/claims/escalations/evidence.
+create function pg_temp.sees(p_who text, p_task text) returns text language plpgsql as $$
+begin
+  return pg_temp.val(p_who, format($q$
+    select (select count(*) from agent_board.tasks where id = %1$L)
+      || '/' || (select count(*) from agent_board.task_events where task_id = %1$L)
+      || '/' || (select count(*) from agent_board.claims where task_id = %1$L)
+      || '/' || (select count(*) from agent_board.escalations where task_id = %1$L)
+      || '/' || (select count(*) from agent_board.signature_evidence se
+                   join agent_board.task_events te on te.id = se.source_task_event_id where te.task_id = %1$L)
+  $q$, pg_temp.v(p_task)));
+end $$;
+
+-- A task's delivery scope: sorted 'recipient-handle:board-slug|private'.
+create function pg_temp.scope(p_task text) returns text language sql as $$
+  select coalesce(string_agg(a.handle || ':' || coalesce(b.slug, 'private'), ',' order by a.handle, b.slug), '(none)')
+    from agent_board.delivery_recipients dr
+    join agent_board.agents a on a.id = dr.recipient_agent_id
+    left join agent_board.boards b on b.id = dr.board_id
+   where dr.source_task_id = pg_temp.u(p_task)
+$$;
+
+-- The private task's rows, byte for byte: ids, authors and content of the task and its history.
+create function pg_temp.history(p_task text) returns text language sql as $$
+  select md5(concat_ws('#',
+    (select t::text from agent_board.tasks t where t.id = pg_temp.u(p_task)),
+    (select string_agg(te::text, ',' order by te.id) from agent_board.task_events te where te.task_id = pg_temp.u(p_task)),
+    (select string_agg(c::text, ',' order by c.id) from agent_board.claims c where c.task_id = pg_temp.u(p_task)),
+    (select string_agg(e::text, ',' order by e.id) from agent_board.escalations e where e.task_id = pg_temp.u(p_task))))
+$$;
+
+create function pg_temp.ctd(p_who text, p_thread text, p_title text, p_recipients text, p_board text, p_key text,
+                            p_metadata jsonb default '{}'::jsonb) returns text language sql as $$
+  select format('select * from agent_board.create_tasking_delivery(%L::uuid, %L::uuid, %L, null, %s, %s, ''medium'', ''distributed'', %L, %L::jsonb)',
+    pg_temp.v(p_thread), pg_temp.v(p_who), p_title,
+    coalesce(p_recipients, 'null::uuid[]'),
+    coalesce(quote_literal(pg_temp.v(p_board)) || '::uuid', 'null::uuid'),
+    p_key, p_metadata::text)
+$$;
+-- uuid[] literal of the named agents, in the order given (duplicates kept).
+create function pg_temp.ids(variadic p_who text[]) returns text language sql as $$
+  select 'array[' || string_agg(quote_literal(pg_temp.v(w)), ',' order by o) || ']::uuid[]'
+    from unnest(p_who) with ordinality as x(w, o)
+$$;
+
+-- ===========================================================================
+-- Fixtures
+-- ===========================================================================
+insert into agent_board.identity_providers
+  (issuer, audience, supported, policy_approved, allowed_scopes, allowed_board_scopes, allowed_agent_kinds)
+values ('https://portal.f2717.test', 'message-board', true, true, '{}', '{}', '{agent,human}');
+
+do $$
+declare r record;
+begin
+  perform set_config('request.jwt.claims', '', true);
+  select * into r from agent_board.enroll_federated_human(
+    'https://portal.f2717.test', 'message-board', 'f2717-owner',
+    jsonb_build_object('sub', 'f2717-owner', 'email', 'owner@f2717.test', 'email_verified', true), 'F2 Owner');
+  perform pg_temp.put('O', r.agent_id::text);
+  perform pg_temp.put('O.auth', r.auth_user_id::text);
+  perform pg_temp.put('O.role', 'authenticated');
+end $$;
+
+-- Keyed agents: A creator, A2 second creator, C private recipient/assignee, M and N ordinary
+-- board members (N joins later), X an agent outside every board. C is a member of B too: a
+-- non-member cannot post task history on a board thread, and C's membership gives the board no
+-- read path to a task delivered to C privately.
+insert into auth.users(id, instance_id, aud, role, email)
+select ('71720000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid,
+       '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated', 'f2717-' || n || '@t.test'
+  from generate_series(1, 6) n;
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+select ('71721000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid, 'agent', 'agent',
+       'f2717-' || h, 'F2 ' || h, 'active', ('71720000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid
+  from unnest(array['a', 'a2', 'c', 'm', 'n', 'x']) with ordinality as x(h, n);
+do $$
+declare h text; n int := 0;
+begin
+  foreach h in array array['A', 'A2', 'C', 'M', 'N', 'X'] loop
+    n := n + 1;
+    perform pg_temp.put(h, '71721000-0000-4000-8000-' || lpad(n::text, 12, '0'));
+    perform pg_temp.put(h || '.auth', '71720000-0000-4000-8000-' || lpad(n::text, 12, '0'));
+    perform pg_temp.put(h || '.role', 'authenticated');
+  end loop;
+end $$;
+select pg_temp.put('SVC.role', 'service_role');
+-- Verified own_inbox callback subscriptions for C, M and X, so a delivery to any of them would
+-- also queue a callback: the side-effect fingerprint then discriminates a callback write.
+insert into agent_board.callback_endpoints(id, owner_agent_id, endpoint_url, endpoint_status)
+select ('71723000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid, pg_temp.u(h), 'https://example.test/f2717/' || h, 'verified'
+  from unnest(array['C', 'M', 'X']) with ordinality as x(h, n);
+insert into agent_board.callback_subscriptions(endpoint_id, agent_id, subscription_scope, event_category)
+select ('71723000-0000-4000-8000-' || lpad(n::text, 12, '0'))::uuid, pg_temp.u(h), 'own_inbox', 'inbox.item.delivered'
+  from unnest(array['C', 'M', 'X']) with ordinality as x(h, n);
+
+insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility, status)
+values ('71722000-0000-4000-8000-000000000001', 'f2717-b', 'F2 B', pg_temp.u('A'), 'private', 'active'),
+       ('71722000-0000-4000-8000-000000000002', 'f2717-b2', 'F2 B2', pg_temp.u('A'), 'private', 'active');
+select pg_temp.put('B', '71722000-0000-4000-8000-000000000001'), pg_temp.put('B2', '71722000-0000-4000-8000-000000000002');
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+values (pg_temp.u('B'), pg_temp.u('A'), 'owner', 'joined', pg_temp.u('A')),
+       (pg_temp.u('B'), pg_temp.u('A2'), 'member', 'joined', pg_temp.u('A')),
+       (pg_temp.u('B'), pg_temp.u('C'), 'member', 'joined', pg_temp.u('A')),
+       (pg_temp.u('B'), pg_temp.u('M'), 'member', 'joined', pg_temp.u('A')),
+       (pg_temp.u('B'), pg_temp.u('O'), 'owner', 'joined', pg_temp.u('A')),
+       (pg_temp.u('B2'), pg_temp.u('A'), 'owner', 'joined', pg_temp.u('A')),
+       (pg_temp.u('B2'), pg_temp.u('O'), 'member', 'joined', pg_temp.u('A'));
+
+-- Hosted delegates D (placed on B) and E (placed on B2 only), through the real exchange.
+create function pg_temp.exch(p_iid text, p_gid text, p_key text) returns text language plpgsql as $$
+declare r record;
+begin
+  perform pg_temp.ident('service_role', null, null);
+  set local role service_role;
+  select * into r from agent_board.exchange_delegate_credential(jsonb_build_object(
+    'iss', 'https://portal.f2717.test', 'sub', 'f2717-owner', 'slot_resource', null,
+    'agent_board_delegate_instance', jsonb_build_object(
+      'instance_id', p_iid, 'grant_id', p_gid, 'generation', 1, 'owner_sub', 'f2717-owner',
+      'client_id', 'client-f2717', 'status', 'active', 'client_change', null)));
+  reset role;
+  perform pg_temp.ident(null, null, null);
+  perform pg_temp.put(p_key, r.agent_id::text);
+  perform pg_temp.put(p_key || '.auth', r.auth_user_id::text);
+  perform pg_temp.put(p_key || '.cred', r.credential_id::text);
+  perform pg_temp.put(p_key || '.role', 'agent_board_delegate');
+  return 'ok';
+end $$;
+do $$ begin
+  perform pg_temp.exch('inst_f2f2f2f2f2f27170_01', 'grant_f2f2f2f2f27170_01_1', 'D');
+  perform pg_temp.exch('inst_f2f2f2f2f2f27170_02', 'grant_f2f2f2f2f27170_02_1', 'E');
+end $$;
+
+-- 1
+select is(
+  pg_temp.as_('O', format('select agent_board.add_delegate_to_board(%L, %L)', pg_temp.v('D'), pg_temp.v('B')))
+  || ' ' || pg_temp.as_('O', format('select agent_board.add_delegate_to_board(%L, %L)', pg_temp.v('E'), pg_temp.v('B2'))),
+  'ok ok',
+  'fixture: the owner places delegate D on B and delegate E on B2 through add_delegate_to_board');
+
+-- The board-stamped thread T: created by A, stamped by A's board post to B.
+select pg_temp.put('T', pg_temp.val('A', $$ select thread_id::text from agent_board.create_or_find_thread(null, 'F2 thread', 'f2717-thread') $$));
+-- 2
+select pg_temp.put('T.post', pg_temp.as_('A', format($$ select * from agent_board.post_board_message(%L, %L, %L, 's', 'board post') $$,
+                          pg_temp.v('T'), pg_temp.v('A'), pg_temp.v('B'))));
+select is(
+  pg_temp.v('T.post') || ' ' || (select coalesce(board_id::text, 'null') from agent_board.threads where id = pg_temp.u('T')),
+  'ok ' || pg_temp.v('B'),
+  'fixture: thread T is stamped to board B by a board post before any task exists');
+
+-- The private task X: recipient-only, key k1, on the already board-stamped thread.
+select pg_temp.put('X.task', split_part(pg_temp.val('A',
+  replace(pg_temp.ctd('A', 'T', 'F2-SECRET-TASK', pg_temp.ids('C'), null, 'k1'), 'select *', 'select task_id::text')), ' ', 1));
+select pg_temp.put('X.ev1', (select id::text from agent_board.task_events where task_id = pg_temp.u('X.task') and event_sequence = 1));
+-- 3
+select is(
+  (select count(*)::int from agent_board.tasks where thread_id = pg_temp.u('T') and metadata ->> 'idempotencyKey' = 'k1')
+  || ' ' || pg_temp.scope('X.task'),
+  '1 f2717-c:private',
+  'first recipient-only send: one task, explicit private delivery to C only');
+
+-- Legal assignment by the creator, then C's own history on the task through the public RPCs.
+-- 4
+select is(
+  pg_temp.as_('A', format($$ select * from agent_board.append_task_event(%L, %L, 'status_changed', '{}'::jsonb, null, %L) $$,
+                          pg_temp.v('X.task'), pg_temp.v('A'), pg_temp.v('C')))
+  || ' ' || pg_temp.as_('C', format($$ select * from agent_board.append_task_event(%L, %L, 'commented', '{"note":"C-PRIVATE-HISTORY"}'::jsonb) $$,
+                          pg_temp.v('X.task'), pg_temp.v('C')))
+  || ' ' || pg_temp.as_('C', format($$ select * from agent_board.acquire_claim(%L, 'task', 'f2717-c-claim', now() + interval '1 hour', %L, %L) $$,
+                          pg_temp.v('C'), pg_temp.v('X.task'), pg_temp.v('T')))
+  || ' ' || pg_temp.as_('C', format($$ select * from agent_board.raise_escalation(%L, %L, 'C-PRIVATE-ESCALATION', 'other', 'medium', %L, null, '{}'::jsonb) $$,
+                          pg_temp.v('T'), pg_temp.v('C'), pg_temp.v('X.task'))),
+  'ok ok ok ok',
+  'fixture: A assigns X to C; C appends an event, takes a task claim and raises a task escalation');
+-- 5 -- the exact history rows and their authors
+select is(
+  (select string_agg(te.event_sequence || ':' || te.event_type || ':' || a.handle, ' ' order by te.event_sequence)
+     from agent_board.task_events te join agent_board.agents a on a.id = te.actor_agent_id where te.task_id = pg_temp.u('X.task'))
+  || ' | ' || (select string_agg(a.handle, ',') from agent_board.claims c join agent_board.agents a on a.id = c.agent_id where c.task_id = pg_temp.u('X.task'))
+  || ' | ' || (select string_agg(a.handle, ',') from agent_board.escalations e join agent_board.agents a on a.id = e.raised_by_agent_id where e.task_id = pg_temp.u('X.task'))
+  || ' | assignee=' || (select a.handle from agent_board.tasks t join agent_board.agents a on a.id = t.assigned_agent_id where t.id = pg_temp.u('X.task')),
+  '1:created:f2717-a 2:status_changed:f2717-a 3:commented:f2717-c 4:claimed:f2717-c 5:escalated:f2717-c | f2717-c | f2717-c | assignee=f2717-c',
+  'fixture: X history is the creator''s two events plus C-authored event, claim and escalation; C is the assignee');
+select pg_temp.put('X.history', pg_temp.history('X.task'));
+
+-- ===========================================================================
+-- Visibility before any replay (tasks/events/claims/escalations/evidence)
+-- ===========================================================================
+-- 6
+select is(pg_temp.sees('M', 'X.task') || ' ' || pg_temp.sees('D', 'X.task') || ' ' || pg_temp.sees('E', 'X.task'),
+  '0/0/0/0/0 0/0/0/0/0 0/0/0/0/0',
+  'before replay: board member M, board delegate D and off-board delegate E see nothing of private task X');
+-- 7
+select is(pg_temp.sees('C', 'X.task') || ' ' || pg_temp.sees('A', 'X.task'),
+  '1/5/1/1/0 1/5/1/1/0',
+  'before replay: C (recipient and assignee) and A (creator) see X and its whole history');
+
+-- ===========================================================================
+-- Refused replays: each is 42501 with the named message and writes nothing
+-- ===========================================================================
+-- 8 -- S9: private -> same key + the thread's own board, by a creator who may send there
+select is(pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'other title', null, 'B', 'k1')),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'S9: a private task replayed with a board target is refused, though the creator can send to that board');
+-- 9
+select is(pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'other title', pg_temp.ids('C'), 'B', 'k1')),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'private -> same recipients plus a board is refused');
+-- 10
+select is(pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'other title', pg_temp.ids('C', 'X'), null, 'k1')),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'a replay that introduces a new explicit recipient is refused');
+-- 11
+select is(pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'other title', null, 'B', 'k1',
+            jsonb_build_object('boardId', pg_temp.v('B'), 'rpcName', 'create_tasking_delivery', 'idempotencyKey', 'k1'))),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'caller metadata claiming boardId/rpcName on the replay is not evidence of prior board scope');
+-- 12
+select is(pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'other title', null, 'B2', 'k1')),
+  '42501:thread belongs to a different board | side-effects=none',
+  'same key to a different board is refused (the thread-board mismatch answers first)');
+-- 13 -- service_role, the raw core: same refusal, and its telemetry write is rolled back too
+select is(pg_temp.refuse('SVC', pg_temp.ctd('A', 'T', 'svc title', null, 'B', 'k1')),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'service_role on the UUID core: the same refusal, with the bypass telemetry row rolled back');
+-- 14 -- addressing overload, board slug
+select is(pg_temp.refuse('A', format($$ select * from agent_board.create_tasking_delivery(%L::uuid, %L::uuid, 'addr', null, null, 'f2717-b', 'addressing_v1', 'medium', 'distributed', 'k1', '{}'::jsonb) $$,
+                                     pg_temp.v('T'), pg_temp.v('A'))),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'addressing overload: same key with the board slug is refused');
+-- 15 -- addressing overload, descriptors naming a new recipient
+select is(pg_temp.refuse('A', format($$ select * from agent_board.create_tasking_delivery(%L::uuid, %L::uuid, 'addr', null,
+                                     jsonb_build_array(jsonb_build_object('kind', 'agent_id', 'agentId', %L), jsonb_build_object('kind', 'agent_id', 'agentId', %L)),
+                                     null, 'addressing_v1', 'medium', 'distributed', 'k1', '{}'::jsonb) $$,
+                                     pg_temp.v('T'), pg_temp.v('A'), pg_temp.v('C'), pg_temp.v('X'))),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'addressing overload: same key with a descriptor naming a new recipient is refused');
+
+-- Signed wrapper, both branches, as service_role with a gateway decision for A. The decision is a
+-- SQL fixture: this proves the wrapper's routing and atomicity, not signature verification.
+create function pg_temp.gw(p_actor text) returns text language sql as $$
+  select quote_literal(jsonb_build_object('agent_id', pg_temp.v(p_actor), 'verification_status', 'warn',
+    'payload_digest', 'sha256:' || repeat('7', 64), 'enforcement_mode', 'warn')::text) || '::jsonb'
+$$;
+create function pg_temp.signed(p_payload jsonb, p_actor text default 'A') returns text language sql as $$
+  select format('select * from agent_board.signed_create_tasking_delivery(%L::jsonb, %s)', p_payload::text, pg_temp.gw(p_actor))
+$$;
+-- 16
+select is(pg_temp.refuse('SVC', pg_temp.signed(jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_created_by_agent_id', pg_temp.v('A'),
+            'p_title', 'signed', 'p_board_id', pg_temp.v('B'), 'p_idempotency_key', 'k1'))),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'signed UUID branch: board widening refused, no signature evidence, delivery or callback written');
+-- 17
+select is(pg_temp.refuse('SVC', pg_temp.signed(jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_created_by_agent_id', pg_temp.v('A'),
+            'p_title', 'signed', 'p_recipient_agent_ids', jsonb_build_array(pg_temp.v('C'), pg_temp.v('X')), 'p_idempotency_key', 'k1'))),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'signed UUID branch: recipient widening refused with no side effect');
+-- 18
+select is(pg_temp.refuse('SVC', pg_temp.signed(jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_created_by_agent_id', pg_temp.v('A'),
+            'p_title', 'signed', 'p_board_slug', 'f2717-b', 'p_addressing_mode', 'addressing_v1', 'p_idempotency_key', 'k1'))),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'signed descriptor/slug branch: board widening refused with no side effect');
+-- 19
+select is(pg_temp.refuse('SVC', pg_temp.signed(jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_created_by_agent_id', pg_temp.v('A'),
+            'p_title', 'signed', 'p_recipient_descriptors', jsonb_build_array(jsonb_build_object('kind', 'agent_id', 'agentId', pg_temp.v('X'))),
+            'p_addressing_mode', 'addressing_v1', 'p_idempotency_key', 'k1'))),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'signed descriptor branch: a new descriptor recipient is refused with no side effect');
+-- 20
+select is(pg_temp.refuse('SVC', pg_temp.signed(jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_created_by_agent_id', pg_temp.v('A2'),
+            'p_title', 'signed', 'p_board_id', pg_temp.v('B'), 'p_idempotency_key', 'k1'))),
+  '42501:actor_mismatch: signed write payload actor must match gateway actor | side-effects=none',
+  'signed: a payload actor that differs from the gateway actor is refused');
+-- 21
+select is(pg_temp.refuse('A', pg_temp.signed(jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_title', 'signed', 'p_board_id', pg_temp.v('B'), 'p_idempotency_key', 'k1')))
+          || ' || ' || pg_temp.refuse('D', pg_temp.signed(jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_title', 'signed', 'p_board_id', pg_temp.v('B'), 'p_idempotency_key', 'k1'))),
+  '42501:permission denied for function signed_create_tasking_delivery | side-effects=none || 42501:permission denied for function signed_create_tasking_delivery | side-effects=none',
+  'signed wrapper: an authenticated agent and a hosted delegate cannot call it directly');
+-- 22
+select is(pg_temp.refuse('D', pg_temp.ctd('A', 'T', 'delegate', null, 'B', 'k1')),
+  '42501:permission denied for function create_tasking_delivery | side-effects=none',
+  'a hosted delegate cannot reach the tasking core at all');
+-- 23 -- existing authorization: a caller cannot supply another creator
+select is(pg_temp.refuse('M', pg_temp.ctd('A', 'T', 'impersonated', null, 'B', 'k1')),
+  '42501:p_created_by_agent_id must match current_agent_id() | side-effects=none',
+  'an authenticated caller naming another creator is refused by the existing actor binding');
+
+-- Forged reserved metadata through create_task: the lookup finds the forged task, and no
+-- metadata on it can establish a delivery scope.
+-- 24
+select is(pg_temp.as_('A', format($$ select * from agent_board.create_task(%L, %L, 'FORGED', null, null, null, 'medium', 'distributed', %L::jsonb) $$,
+             pg_temp.v('T'), pg_temp.v('A'),
+             jsonb_build_object('rpcName', 'create_tasking_delivery', 'idempotencyKey', 'kf', 'boardId', pg_temp.v('B'))::text)),
+  'ok', 'fixture: create_task accepts caller metadata carrying the reserved rpcName/idempotencyKey/boardId fields');
+select pg_temp.put('F.task', (select id::text from agent_board.tasks where title = 'FORGED' and thread_id = pg_temp.u('T')));
+-- 25
+select is(pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'forged replay', null, 'B', 'kf'))
+          || ' || ' || pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'forged replay', pg_temp.ids('C'), null, 'kf')),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none || 42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'a task whose metadata forges boardId has no persisted delivery scope: board and recipient replays are refused');
+-- 26
+select is(pg_temp.scope('F.task') || ' ' || pg_temp.sees('M', 'F.task') || ' ' || pg_temp.sees('D', 'F.task'),
+  '(none) 0/0/0/0/0 0/0/0/0/0',
+  'the forged task stays undelivered and invisible to the board');
+
+-- ===========================================================================
+-- Board-only task Y: explicit private scope cannot be introduced on replay
+-- ===========================================================================
+select pg_temp.put('Y.task', split_part(pg_temp.val('A',
+  replace(pg_temp.ctd('A', 'T', 'F2-BOARD-TASK', null, 'B', 'kb'), 'select *', 'select task_id::text')), ' ', 1));
+-- 27
+select is(pg_temp.scope('Y.task'),
+  (select string_agg(a.handle || ':f2717-b', ',' order by a.handle) from agent_board.board_memberships bm
+     join agent_board.agents a on a.id = bm.agent_id
+    where bm.board_id = pg_temp.u('B') and bm.membership_state in ('joined', 'subscribed')),
+  'board-only task Y: one board-scoped delivery per current member of B (the creator''s feed-only row included)');
+-- 28
+select is(pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'y', pg_temp.ids('M'), 'B', 'kb'))
+          || ' || ' || pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'y', pg_temp.ids('X'), 'B', 'kb')),
+  '42501:tasking replay cannot widen delivery scope | side-effects=none || 42501:tasking replay cannot widen delivery scope | side-effects=none',
+  'board task -> same key naming an explicit recipient is refused, even one that already holds a board-only delivery');
+-- 29
+select is(pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'y', null, 'B2', 'kb')),
+  '42501:thread belongs to a different board | side-effects=none',
+  'board task -> same key to a different board is refused');
+
+-- ===========================================================================
+-- Accepted replays
+-- ===========================================================================
+-- 30 -- same explicit set, reordered and duplicated: same task and event, nothing new written
+select pg_temp.put('fp.before', pg_temp.fp_rows());
+select is(
+  pg_temp.val('A', replace(pg_temp.ctd('A', 'T', 'retry', pg_temp.ids('C', 'C'), null, 'k1'), 'select *', 'select task_id::text || '' '' || created_event_id::text')),
+  pg_temp.v('X.task') || ' ' || pg_temp.v('X.ev1'),
+  'normal retry (recipient duplicated): same task id and created event id');
+-- 31
+select is(pg_temp.fp_rows(), pg_temp.v('fp.before'),
+  'normal retry: no new task, event, delivery, inbox item, callback, evidence or telemetry row');
+-- 32 -- the service path's normal retry is also the canonical task
+select is(
+  pg_temp.val('SVC', replace(pg_temp.ctd('A', 'T', 'retry', pg_temp.ids('C'), null, 'k1'), 'select *', 'select task_id::text')),
+  pg_temp.v('X.task'),
+  'service_role normal retry with the same audience returns the canonical task');
+-- 33 -- signed normal retry, UUID branch
+select is(
+  pg_temp.val('SVC', replace(pg_temp.signed(jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_created_by_agent_id', pg_temp.v('A'),
+            'p_title', 'signed retry', 'p_recipient_agent_ids', jsonb_build_array(pg_temp.v('C')), 'p_idempotency_key', 'k1')), 'select *', 'select task_id::text')),
+  pg_temp.v('X.task'),
+  'signed UUID branch normal retry returns the canonical task');
+-- 34 -- signed normal retry, descriptor branch
+select is(
+  pg_temp.val('SVC', replace(pg_temp.signed(jsonb_build_object('p_thread_id', pg_temp.v('T'), 'p_created_by_agent_id', pg_temp.v('A'),
+            'p_title', 'signed retry', 'p_recipient_descriptors', jsonb_build_array(jsonb_build_object('kind', 'agent_id', 'agentId', pg_temp.v('C'))),
+            'p_addressing_mode', 'addressing_v1', 'p_idempotency_key', 'k1')), 'select *', 'select task_id::text')),
+  pg_temp.v('X.task'),
+  'signed descriptor branch normal retry returns the canonical task');
+
+-- Subset: Z goes to C and X; a replay naming only X is accepted and removes nothing.
+select pg_temp.put('Z.task', split_part(pg_temp.val('A',
+  replace(pg_temp.ctd('A', 'T', 'F2-Z', pg_temp.ids('C', 'X'), null, 'kz'), 'select *', 'select task_id::text')), ' ', 1));
+-- 35
+select is(
+  pg_temp.val('A', replace(pg_temp.ctd('A', 'T', 'z', pg_temp.ids('X'), null, 'kz'), 'select *', 'select task_id::text'))
+  || ' ' || pg_temp.scope('Z.task'),
+  pg_temp.v('Z.task') || ' f2717-c:private,f2717-x:private',
+  'subset of the existing private recipients is accepted; the omitted recipient keeps its delivery');
+
+-- Mixed W (C + board B): omitting the board on replay is accepted and revokes nothing.
+select pg_temp.put('W.task', split_part(pg_temp.val('A',
+  replace(pg_temp.ctd('A', 'T', 'F2-W', pg_temp.ids('C'), 'B', 'kw'), 'select *', 'select task_id::text')), ' ', 1));
+select pg_temp.put('W.scope', pg_temp.scope('W.task'));
+-- 36
+select is(
+  pg_temp.val('A', replace(pg_temp.ctd('A', 'T', 'w', pg_temp.ids('C'), null, 'kw'), 'select *', 'select task_id::text'))
+  || ' ' || (pg_temp.scope('W.task') = pg_temp.v('W.scope'))::text,
+  pg_temp.v('W.task') || ' true',
+  'mixed task: replay omitting the board is accepted; the board deliveries are not removed');
+-- 37
+select is(pg_temp.v('W.scope') ~ 'f2717-c:private' and pg_temp.v('W.scope') ~ 'f2717-m:f2717-b', true,
+  'mixed task control: C holds a private delivery and M a board one');
+-- 38 -- mixed: C is BOTH explicit and on no board; replay with the same mix is accepted
+select is(
+  pg_temp.val('A', replace(pg_temp.ctd('A', 'T', 'w', pg_temp.ids('C'), 'B', 'kw'), 'select *', 'select task_id::text')),
+  pg_temp.v('W.task'),
+  'mixed task: same explicit set and same board is accepted');
+
+-- Same board, new member: N joins B after Y; a same-board replay reaches N under live fan-out.
+insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+values (pg_temp.u('B'), pg_temp.u('N'), 'member', 'joined', pg_temp.u('A'));
+-- 39
+select is(
+  pg_temp.val('A', replace(pg_temp.ctd('A', 'T', 'y', null, 'B', 'kb'), 'select *', 'select task_id::text'))
+  || ' ' || (pg_temp.scope('Y.task') ~ 'f2717-n:f2717-b')::text || ' ' || pg_temp.sees('N', 'Y.task'),
+  pg_temp.v('Y.task') || ' true 1/0/0/0/0',
+  'same-board replay after N joined: same task, N receives the board delivery and can read the task');
+
+-- New key: a deliberate board task is a NEW task with no copied private history.
+select pg_temp.put('Y2.task', split_part(pg_temp.val('A',
+  replace(pg_temp.ctd('A', 'T', 'F2-NEW-BOARD-TASK', null, 'B', 'k1-board'), 'select *', 'select task_id::text')), ' ', 1));
+-- 40
+select is(
+  (pg_temp.v('Y2.task') <> pg_temp.v('X.task'))::text
+  || ' ' || (select count(*) from agent_board.task_events where task_id = pg_temp.u('Y2.task'))
+  || '/' || (select count(*) from agent_board.claims where task_id = pg_temp.u('Y2.task'))
+  || '/' || (select count(*) from agent_board.escalations where task_id = pg_temp.u('Y2.task'))
+  || '/' || (select count(*) from agent_board.tasks where id = pg_temp.u('Y2.task') and assigned_agent_id is null),
+  'true 1/0/0/1',
+  'a new key with a board target creates a new task: one created event, no claim, escalation or assignee copied');
+-- 41 -- positive control for the delegate predicate: D reads the new board task
+select is(pg_temp.sees('D', 'Y2.task') || ' ' || pg_temp.sees('E', 'Y2.task'),
+  '1/1/0/0/0 0/0/0/0/0',
+  'delegate control: D (on B) reads the new board task and its event; E (not on B) does not');
+-- 42 -- ordinary members are a separate policy: M reads the board task, not its history
+select is(pg_temp.sees('M', 'Y2.task'),
+  '1/0/0/0/0',
+  'ordinary member M reads the board task row but, under the authenticated policy, none of its events');
+
+-- Another resolved creator with the same key gets its own task and cannot reach X.
+-- Same audience as X (C, private), so a lookup widened across creators would hand A2 task X.
+select pg_temp.put('A2.task', pg_temp.val('A2', replace(pg_temp.ctd('A2', 'T', 'A2 task', pg_temp.ids('C'), null, 'k1'), 'select *', 'select task_id::text')));
+-- 43
+select is(
+  (pg_temp.v('A2.task') <> pg_temp.v('X.task'))::text
+  || ' ' || coalesce((select a.handle || '/' || t.title from agent_board.tasks t join agent_board.agents a on a.id = t.created_by_agent_id
+                       where t.id::text = pg_temp.v('A2.task')), pg_temp.v('A2.task'))
+  || ' ' || pg_temp.scope('X.task') || ' ' || (pg_temp.history('X.task') = pg_temp.v('X.history'))::text,
+  'true f2717-a2/A2 task f2717-c:private true',
+  'same key by another creator: A2 gets its own new task; X''s scope and history are untouched');
+
+-- Existing authorization still applies: a creator who lost its send role cannot replay to the board.
+update agent_board.board_memberships set role = 'observer' where board_id = pg_temp.u('B') and agent_id = pg_temp.u('A');
+-- 44
+select is(pg_temp.refuse('A', pg_temp.ctd('A', 'T', 'y', null, 'B', 'kb')),
+  '42501:board send requires a non-observer board role | side-effects=none',
+  'a creator demoted to observer cannot replay its board task (existing send authority)');
+update agent_board.board_memberships set role = 'owner' where board_id = pg_temp.u('B') and agent_id = pg_temp.u('A');
+
+-- ===========================================================================
+-- After every attempt: X is exactly as it was, and invisible to the board
+-- ===========================================================================
+-- 45
+select is(pg_temp.scope('X.task'), 'f2717-c:private', 'after all attempts: X is still delivered to C only');
+-- 46
+select is(pg_temp.history('X.task'), pg_temp.v('X.history'),
+  'after all attempts: X and its history keep their ids, authors and content');
+-- 47
+select is(pg_temp.sees('M', 'X.task'), '0/0/0/0/0', 'after all attempts: board member M sees nothing of X');
+-- 48
+select is(pg_temp.sees('D', 'X.task'), '0/0/0/0/0',
+  'after all attempts: board delegate D sees neither X nor C''s event, claim or escalation');
+-- 49
+select is(pg_temp.sees('E', 'X.task'), '0/0/0/0/0', 'after all attempts: off-board delegate E sees nothing of X');
+-- 50
+-- The two signed normal retries (33, 34) each recorded A's signature evidence on X's created
+-- event; C reads it as the assignee. Nothing else changed for C.
+select is(pg_temp.sees('C', 'X.task'), '1/5/1/1/2', 'after all attempts: C keeps exactly its own access to X (plus the two signed-retry evidence rows)');
+-- 51
+select is(
+  (select count(*)::int from agent_board.inbox_items where source_task_id = pg_temp.u('X.task'))
+  || '/' || (select count(*)::int from agent_board.callback_outbox_events where source_task_id = pg_temp.u('X.task')),
+  '1/1',
+  'after all attempts: X has one inbox item and one callback, both C''s (retries queued no duplicate)');
+
+-- ===========================================================================
+-- The core's catalog surface, and the replay class enumerated from the catalog
+-- ===========================================================================
+-- Lock identity, lock order and refusal placement are pinned BEHAVIOURALLY, not by reading the
+-- source: tests/isolation/specs/tasking_replay_scope.spec (a lock keyed or ordered differently
+-- lets the racing board send create a second task), 30/43 here (same identity reuses, another
+-- creator does not), and every refusal above reporting side-effects=none.
+-- 52
+select is(
+  (select prosecdef::text || '/' || coalesce(array_to_string(proconfig, ','), '') from pg_proc
+    where oid = 'agent_board.create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)'::regprocedure)
+  || ' ' || (select string_agg(r || '=' || has_function_privilege(r, 'agent_board.create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)', 'EXECUTE')::text, ' ' order by r)
+       from unnest(array['anon', 'authenticated', 'agent_board_delegate', 'service_role']) r),
+  'true/search_path=agent_board, public agent_board_delegate=false anon=false authenticated=true service_role=true',
+  'the core stays SECURITY DEFINER with its search_path, EXECUTE for authenticated and service_role only');
+-- 53
+select ok(obj_description('agent_board.create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)'::regprocedure, 'pg_proc')
+            ~ 'cannot widen the task''s audience',
+  'the core''s comment states the replay ceiling');
+
+-- THE REPLAY CLASS: every agent_board routine that serializes an idempotent replay through
+-- _lock_idempotency_key, read from pg_proc. A new site fails here and names itself. Each
+-- disposition is a claim pinned by behaviour elsewhere, named in the value:
+--   create_tasking_delivery  ceiling            -- this file
+--   post_board_message       one-board          -- association pins the thread to one board (56 here,
+--                                                   #667 boundary/writers tests), so a replay can only
+--                                                   re-reach that board's current members
+--   send_direct_message      fixed-717-F2b-740  -- message replay ceiling (#740): a replay may only
+--   send_multicast_message   fixed-717-F2b-740     re-reach recipients already holding a private
+--                                                   delivery of the source in the core's own mode;
+--                                                   pinned behaviourally and by mutation in
+--                                                   agent_board_717_message_replay_scope.test.sql
+create temp table _replay_class(signature text primary key, disposition text not null);
+insert into _replay_class values
+  ('create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)', 'ceiling'),
+  ('post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'one-board'),
+  ('send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'fixed-717-F2b-740'),
+  ('send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)', 'fixed-717-F2b-740');
+-- 54
+select is(
+  (select coalesce(string_agg(s, ' ' order by s), '(none)') from (
+     select p.proname || '(' || replace(oidvectortypes(p.proargtypes), ' ', '') || ')' as s
+       from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'agent_board' and p.prokind = 'f'
+        and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_lock_idempotency_key')
+     except
+     select replace(signature, ' ', '') from _replay_class
+     ) d),
+  '(none)',
+  'CLASS: every caller of _lock_idempotency_key has a disposition (a new replay site names itself)');
+-- 55
+select is(
+  (select coalesce(string_agg(c.signature, ' ' order by c.signature), '(none)') from _replay_class c
+    where not exists (select 1 from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+                       where n.nspname = 'agent_board'
+                         and p.proname || '(' || replace(oidvectortypes(p.proargtypes), ' ', '') || ')' = replace(c.signature, ' ', '')
+                         and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_lock_idempotency_key'))),
+  '(none)',
+  'CLASS: every dispositioned signature still exists and still calls _lock_idempotency_key (no stale exemption)');
+-- 56 -- the one-board disposition, behaviourally: a same-key board post cannot move to another board
+select is(pg_temp.refuse('A', format($$ select * from agent_board.post_board_message(%L, %L, %L, 's', 'moved', 'comment', 'medium', 'pk1') $$,
+            pg_temp.v('T'), pg_temp.v('A'), pg_temp.v('B2'))),
+  '42501:thread belongs to a different board | side-effects=none',
+  'one-board disposition: a board post on T cannot target another board');
+select * from finish();
+rollback;