@consiliency/agent-board-schema 1.68.0 → 1.74.0

package/tests/agent_board_delivery_writer_execute.test.sql

@@ -0,0 +1,371 @@
+-- DELIVERYWRITEREXEC pgTAP (#717 F1, migration 20261104180000).
+--
+-- THE DEFECT. `_upsert_delivery_recipient` was EXECUTE-able by service_role (through the 2026-05
+-- schema-wide `grant execute on all functions in schema agent_board to service_role`). Called
+-- directly, nothing in front of it checks authorship or addressing, so a service_role caller could
+-- deliver an existing private DM to a board member ('board' mode) or to any agent ('direct' mode),
+-- and the DM kept its original author. Four sibling sinks had the same grant.
+--
+-- THE CLASS COMES FROM THE CATALOG (AGENTS.md rule 1), not from that list:
+--   * the SINK RELATIONS are agent_board.messages plus every relation that reaches it by foreign
+--     key (DWX-1 pins that closure by name, so a new referencing relation fails and names itself);
+--     three closure members are NOT message/delivery/inbox sinks and are excluded, each for a
+--     stated reason: artifacts (the artifact domain; add_artifact is its own public route),
+--     signature_evidence and signature_replay_state (the signed-write evidence ledger, whose
+--     writers are classed by agent_board_write_enforcement_class / signed_* tests);
+--   * plus the two thread columns a message write moves: threads.last_message_sequence and
+--     threads.board_id;
+--   * a CLASS MEMBER is any agent_board routine whose body writes a sink, or calls a member,
+--     transitively. Name-based (`call_re`), so an overload of a member's name is a member too;
+--   * the API ROLES are the roles `authenticator` (PostgREST) can switch to, read from
+--     pg_auth_members, unioned with the four this schema grants to; DWX-0 asserts the set is not
+--     vacuous.
+-- DWX-2: the API-executable members are EXACTLY the named exemptions. A new route, a new overload,
+-- or a re-grant of an internal helper fails it and appears in `have`.
+-- Each exemption is asserted POSITIVELY, by kind:
+--   session_send   DWX-S1..S5  an authenticated caller naming another author is refused (42501)
+--   wrapper        DWX-4a      writes no sink itself and calls its same-named overload
+--   signed         DWX-4b      service-role only, actor from _signed_write_actor_id, no direct
+--                               sink write, calls its unsigned twin
+--   callback_worker DWX-4c     service-role only; transitively moves outbox events by UPDATE only (its own
+--                               callback_delivery_attempts ledger is the one sink it inserts
+--                               into) and never writes messages/delivery_recipients/inbox_items
+--   recipient_state DWX-4d     writes only inbox_items, only by UPDATE, and none of its
+--                               addressing, visibility or content columns, including reachable helpers
+-- Behaviour: service_role direct calls of the five helpers are refused (DWX-B1..B6) and the DM
+-- stays private (DWX-B7..B9); the public routes keep working for service_role and authenticated
+-- callers, with the author and metadata intact and private recipients private (DWX-P*).
+--
+-- Mutation controls: see plans/evidence/717-f1/mutations.md (each run counts all 39 assertions).
+--
+-- HAND-COUNTED plan: DWX-0, 1, 2, 3a-e, 4a-d (12) + P1-3 (3) + B1-10 (10) + P4-12 (9) + S1-5 (5) = 39.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(39);
+
+-- ---------------------------------------------------------------------------
+-- The class.
+-- ---------------------------------------------------------------------------
+create temp table dwx_api_roles on commit drop as
+  select r.rolname::text as rolname
+    from pg_auth_members a
+    join pg_roles r on r.oid = a.roleid
+    join pg_roles m on m.oid = a.member
+   where m.rolname = 'authenticator'
+  union
+  select rolname::text from pg_roles
+   where rolname in ('anon', 'authenticated', 'service_role', 'agent_board_delegate');
+
+select ok(
+  (select count(*) filter (where rolname in ('service_role', 'authenticated')) = 2 from dwx_api_roles),
+  'DWX-0: the API-role set includes service_role and authenticated');
+
+create temp table dwx_closure on commit drop as
+  with recursive rel(oid) as (
+    select 'agent_board.messages'::regclass::oid
+    union
+    select c.conrelid from pg_constraint c join rel on c.confrelid = rel.oid where c.contype = 'f')
+  select oid::regclass::text as rel, c.relname::text as relname
+    from rel join pg_class c using (oid);
+
+select is(
+  (select string_agg(rel, ', ' order by rel collate "C") from dwx_closure),
+  (select string_agg(r::regclass::text, ', ' order by r::regclass::text collate "C")
+     from unnest(array['agent_board.artifacts', 'agent_board.callback_delivery_attempts', 'agent_board.callback_outbox_events',
+                       'agent_board.delivery_recipients', 'agent_board.inbox_items', 'agent_board.messages',
+                       'agent_board.signature_evidence', 'agent_board.signature_replay_state']) r),
+  'DWX-1: the relations reaching agent_board.messages by foreign key are exactly the classified set');
+
+create temp table dwx_sinks on commit drop as
+  select relname from dwx_closure
+   where relname not in ('artifacts', 'signature_evidence', 'signature_replay_state');
+
+create temp table dwx_fns on commit drop as
+  select p.oid, p.proname::text collate "C" as n, agent_board_test.stripped_body(p.oid) as b
+    from pg_proc p
+   where p.pronamespace = 'agent_board'::regnamespace and p.prokind in ('f', 'p');
+
+create temp table dwx_class on commit drop as
+  with recursive direct as (
+    select oid, n from dwx_fns
+     where b ~ agent_board_test.writes_any_re((select array_agg(relname) from dwx_sinks))
+        or b ~ agent_board_test.col_write_re('threads', 'last_message_sequence')
+        or b ~ agent_board_test.col_write_re('threads', 'board_id')),
+  clos(oid, n) as (
+    select oid, n from direct
+    union
+    select f.oid, f.n from dwx_fns f join clos c on f.oid <> c.oid and f.b ~ agent_board_test.call_re(c.n))
+  select distinct oid, n,
+         (select string_agg(r.rolname, ',' order by r.rolname) from dwx_api_roles r
+           where has_function_privilege(r.rolname, clos.oid, 'execute')) as api_roles
+    from clos;
+
+create temp table dwx_exempt(sig text primary key, kind text not null) on commit drop;
+insert into dwx_exempt values
+  ('agent_board.post_message(uuid,uuid,text,text,uuid,jsonb)', 'session_send'),
+  ('agent_board.post_board_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'session_send'),
+  ('agent_board.send_direct_message(uuid,uuid,uuid,text,text,text,text,text,jsonb)', 'session_send'),
+  ('agent_board.send_multicast_message(uuid,uuid,uuid[],text,text,text,text,text,jsonb)', 'session_send'),
+  ('agent_board.create_tasking_delivery(uuid,uuid,text,text,uuid[],uuid,text,text,text,jsonb)', 'session_send'),
+  ('agent_board.post_board_message(uuid,uuid,text,text,text,text,text,text,text,jsonb)', 'wrapper'),
+  ('agent_board.send_direct_message(uuid,uuid,jsonb,text,text,text,text,text,text,jsonb)', 'wrapper'),
+  ('agent_board.send_multicast_message(uuid,uuid,jsonb,text,text,text,text,text,text,jsonb)', 'wrapper'),
+  ('agent_board.create_tasking_delivery(uuid,uuid,text,text,jsonb,text,text,text,text,text,jsonb)', 'wrapper'),
+  ('agent_board.signed_post_board_message(jsonb,jsonb)', 'signed'),
+  ('agent_board.signed_send_direct_message(jsonb,jsonb)', 'signed'),
+  ('agent_board.signed_send_multicast_message(jsonb,jsonb)', 'signed'),
+  ('agent_board.signed_create_tasking_delivery(jsonb,jsonb)', 'signed'),
+  ('agent_board.claim_callback_outbox_events(integer)', 'callback_worker'),
+  ('agent_board.record_callback_delivery_success(uuid,uuid,integer,jsonb)', 'callback_worker'),
+  ('agent_board.record_callback_delivery_retry(uuid,uuid,integer,text,timestamp with time zone,jsonb)', 'callback_worker'),
+  ('agent_board.record_callback_delivery_terminal_failure(uuid,uuid,integer,text,jsonb)', 'callback_worker'),
+  ('agent_board.disable_callback_delivery_endpoint(uuid,uuid,text,text,jsonb)', 'callback_worker'),
+  ('agent_board.update_inbox_item_state(uuid,uuid,text,jsonb)', 'recipient_state');
+
+select is(
+  (select string_agg(oid::regprocedure::text, ', ' order by oid::regprocedure::text collate "C")
+     from dwx_class where api_roles is not null),
+  (select string_agg(sig::regprocedure::text, ', ' order by sig::regprocedure::text collate "C") from dwx_exempt),
+  'DWX-2: the API-executable message/delivery/inbox writers are exactly the named exemptions');
+
+-- The five helpers #717 F1 revoked, named one per assertion so a re-grant names itself.
+select is((select api_roles from dwx_class where oid = 'agent_board._upsert_delivery_recipient(text,uuid,text,uuid,uuid,uuid,uuid,uuid,jsonb)'::regprocedure),
+  null, 'DWX-3a: _upsert_delivery_recipient is a class member with no API-role EXECUTE');
+select is((select api_roles from dwx_class where oid = 'agent_board._upsert_inbox_item(uuid,uuid,uuid,text,text,uuid,uuid,uuid,text,text,text,boolean,boolean,jsonb,jsonb)'::regprocedure),
+  null, 'DWX-3b: _upsert_inbox_item is a class member with no API-role EXECUTE');
+select is((select api_roles from dwx_class where oid = 'agent_board._queue_inbox_callbacks(uuid,text)'::regprocedure),
+  null, 'DWX-3c: _queue_inbox_callbacks is a class member with no API-role EXECUTE');
+select is((select api_roles from dwx_class where oid = 'agent_board._queue_board_post_callbacks(uuid,uuid,text,text,text,jsonb)'::regprocedure),
+  null, 'DWX-3d: _queue_board_post_callbacks is a class member with no API-role EXECUTE');
+select is((select api_roles from dwx_class where oid = 'agent_board._next_thread_message_sequence(uuid)'::regprocedure),
+  null, 'DWX-3e: _next_thread_message_sequence is a class member with no API-role EXECUTE');
+
+-- Resolve every reachable agent_board routine for restricted state-only exemptions.
+-- UNION terminates recursive cycles; name-based edges include every overload, just as DWX-2.
+create temp table dwx_state_reach on commit drop as
+  with recursive reach(sig, kind, oid) as (
+    select sig, kind, sig::regprocedure::oid from dwx_exempt
+     where kind in ('callback_worker', 'recipient_state')
+    union
+    select r.sig, r.kind, callee.oid from reach r
+      join dwx_fns caller on caller.oid = r.oid
+      join dwx_fns callee on caller.b ~ agent_board_test.call_re(callee.n))
+  select * from reach;
+
+-- Exemptions, asserted positively. Each yields the violating signatures (NULL = none).
+select is(
+  (select string_agg(e.sig, ', ' order by e.sig) from dwx_exempt e join dwx_fns f on f.oid = e.sig::regprocedure
+    where e.kind = 'wrapper'
+      and (f.b ~ agent_board_test.writes_any_re((select array_agg(relname) from dwx_sinks))
+           or not f.b ~ agent_board_test.call_re(f.n))),
+  null, 'DWX-4a: each descriptor overload writes no sink itself and calls its same-named overload');
+
+select is(
+  (select string_agg(e.sig, ', ' order by e.sig) from dwx_exempt e join dwx_fns f on f.oid = e.sig::regprocedure
+    where e.kind = 'signed'
+      and (exists (select 1 from dwx_api_roles r where r.rolname <> 'service_role'
+                    and has_function_privilege(r.rolname, f.oid, 'execute'))
+           or not f.b ~ agent_board_test.call_re('_signed_write_actor_id')
+           or f.b ~ agent_board_test.writes_any_re((select array_agg(relname) from dwx_sinks))
+           or not f.b ~ agent_board_test.call_re(substr(f.n, length('signed_') + 1)))),
+  null, 'DWX-4b: each signed route is service-role only, takes its actor from the gateway, writes no sink itself and calls its unsigned twin');
+
+select is(
+  (select string_agg(e.sig || ' -> ' || f.oid::regprocedure::text, ', ' order by e.sig, f.oid::regprocedure::text)
+     from dwx_state_reach e join dwx_fns f on f.oid = e.oid
+    where e.kind = 'callback_worker'
+      and ((e.oid = e.sig::regprocedure and exists (select 1 from dwx_api_roles r where r.rolname <> 'service_role'
+                    and has_function_privilege(r.rolname, f.oid, 'execute')))
+           or f.b ~ agent_board_test.stmt_re('insert into|merge into|delete from', 'callback_outbox_events')
+           or f.b ~ agent_board_test.writes_any_re(array['messages', 'delivery_recipients', 'inbox_items']))),
+  null, 'DWX-4c: each callback-worker RPC is service-role only and transitively never inserts or deletes an outbox event or writes a message, delivery or inbox row');
+
+select is(
+  (select string_agg(e.sig || ' -> ' || f.oid::regprocedure::text, ', ' order by e.sig, f.oid::regprocedure::text)
+     from dwx_state_reach e join dwx_fns f on f.oid = e.oid
+    where e.kind = 'recipient_state'
+      and (f.b ~ agent_board_test.writes_any_re(array['messages', 'delivery_recipients'])
+           -- The entry itself only updates inbox state; its callback helpers may enqueue callbacks.
+           or (e.oid = e.sig::regprocedure and f.b ~ agent_board_test.writes_any_re(array['callback_outbox_events', 'callback_delivery_attempts']))
+           or f.b ~ agent_board_test.stmt_re('insert into|merge into|delete from', 'inbox_items')
+           or exists (select 1 from unnest(array['delivery_recipient_id', 'recipient_agent_id', 'board_id', 'delivery_mode',
+                                                 'source_kind', 'source_message_id', 'source_task_id', 'source_delegation_id',
+                                                 'subject', 'preview', 'priority', 'visible_in_inbox', 'visible_in_board_feed',
+                                                 'fetch_descriptor']) c
+                       where f.b ~ agent_board_test.col_write_re('inbox_items', c)))),
+  null, 'DWX-4d: recipient-state RPC and reachable helpers never write messages or deliveries, insert/delete inbox rows, or change inbox addressing, visibility or content');
+
+-- ---------------------------------------------------------------------------
+-- Fixture: A (owner), B and C (members) on a private board; X an agent outside it;
+-- thread T already stamped to the board.
+-- ---------------------------------------------------------------------------
+create temp table dwx(a uuid, b uuid, c uuid, x uuid, ua uuid, ub uuid, uc uuid, ux uuid,
+  board uuid, thread uuid, c_membership uuid) on commit drop;
+create temp table dwx_cap(tag text, id uuid) on commit drop;
+grant select on dwx to authenticated, service_role;
+grant select, insert on dwx_cap to authenticated, service_role;
+
+do $$
+declare
+  a uuid := gen_random_uuid(); b uuid := gen_random_uuid(); c uuid := gen_random_uuid(); x uuid := gen_random_uuid();
+  ua uuid; ub uuid; uc uuid; ux uuid; board uuid := gen_random_uuid(); t uuid := gen_random_uuid();
+begin
+  ua := public.ensure_github_user('dwxa-'||a, 'dwxa-'||a||'@example.test', 'dwxa-'||a, 'A');
+  ub := public.ensure_github_user('dwxb-'||b, 'dwxb-'||b||'@example.test', 'dwxb-'||b, 'B');
+  uc := public.ensure_github_user('dwxc-'||c, 'dwxc-'||c||'@example.test', 'dwxc-'||c, 'C');
+  ux := public.ensure_github_user('dwxx-'||x, 'dwxx-'||x||'@example.test', 'dwxx-'||x, 'X');
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id) values
+    (a, 'agent', 'dwxa-'||a, 'A', 'active', ua, ua), (b, 'agent', 'dwxb-'||b, 'B', 'active', ub, ub),
+    (c, 'agent', 'dwxc-'||c, 'C', 'active', uc, uc), (x, 'agent', 'dwxx-'||x, 'X', 'active', ux, ux);
+  insert into agent_board.boards(id, slug, name, created_by_agent_id, visibility) values (board, 'dwx-'||board, 'dwx', a, 'private');
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, role) values
+    (board, a, 'joined', 'owner'), (board, b, 'joined', 'member'), (board, c, 'joined', 'member');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, board_id) values (t, 'coordination', a, 'dwx', board);
+  -- Live callback subscriptions, so a forged inbox or board-post callback would leave an outbox row
+  -- for DWX-B10 to see: B on its own inbox, C on the board feed.
+  insert into agent_board.callback_endpoints(id, owner_agent_id, endpoint_url, endpoint_status) values
+    (b, b, 'https://example.test/dwx-b', 'verified'), (c, c, 'https://example.test/dwx-c', 'verified');
+  insert into agent_board.callback_subscriptions(endpoint_id, agent_id, subscription_scope, event_category) values
+    (b, b, 'own_inbox', 'inbox.item.delivered');
+  insert into agent_board.callback_subscriptions(endpoint_id, agent_id, subscription_scope, event_category, board_id, board_membership_id)
+    select c, c, 'board', 'board.post.delivered', board, bm.id from agent_board.board_memberships bm where bm.board_id = board and bm.agent_id = c;
+  insert into dwx values (a, b, c, x, ua, ub, uc, ux, board, t,
+    (select id from agent_board.board_memberships where board_id = board and agent_id = c));
+end $$;
+
+-- A private DM from A to B on the board thread, as an authenticated session.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select ua::text from dwx), true);
+set local role authenticated;
+select lives_ok($$insert into dwx_cap select 'dm', message_id from agent_board.send_direct_message(
+    (select thread from dwx), null, (select b from dwx), 'dwx dm', 'dwx secret', p_metadata => '{"dwx":"dm"}')$$,
+  'DWX-P1: an authenticated author sends a private DM on a board thread');
+reset role;
+
+select set_config('request.jwt.claim.sub', (select ub::text from dwx), true);
+set local role authenticated;
+select is((select count(*) from agent_board.messages where id = (select id from dwx_cap where tag = 'dm')), 1::bigint,
+  'DWX-P2: the addressed recipient reads the DM');
+reset role;
+
+select ok((select author_agent_id = (select a from dwx) and metadata ->> 'dwx' = 'dm'
+             from agent_board.messages where id = (select id from dwx_cap where tag = 'dm')),
+  'DWX-P3: the DM carries the session author and the caller metadata');
+
+-- What the refused calls must leave untouched: the DM's inbox and outbox rows and the sequence.
+create temp table dwx_pre on commit drop as
+  select (select count(*) || ':' || string_agg(subject || '|' || preview || '|' || priority, ',') from agent_board.inbox_items
+            where source_message_id = (select id from dwx_cap where tag = 'dm')) as inbox,
+         (select count(*) from agent_board.callback_outbox_events where source_message_id = (select id from dwx_cap where tag = 'dm')) as outbox,
+         (select last_message_sequence from agent_board.threads where id = (select thread from dwx)) as seq;
+grant select on dwx_pre to service_role;
+
+-- service_role calls the internal sinks directly: refused, every one.
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+set local role service_role;
+select throws_ok($$select agent_board._upsert_delivery_recipient('board', (select c from dwx), 'message',
+    (select id from dwx_cap where tag = 'dm'), null, null, (select board from dwx), (select c_membership from dwx), '{}'::jsonb)$$,
+  '42501', null, 'DWX-B1: service_role cannot publish a DM to a board member through _upsert_delivery_recipient');
+select throws_ok($$select agent_board._upsert_delivery_recipient('direct', (select x from dwx), 'message',
+    (select id from dwx_cap where tag = 'dm'), null, null, null, null, '{}'::jsonb)$$,
+  '42501', null, 'DWX-B2: service_role cannot re-address a DM to an arbitrary agent through _upsert_delivery_recipient');
+select throws_ok($$select agent_board._upsert_inbox_item(
+    (select d.id from agent_board.delivery_recipients d where d.source_message_id = (select id from dwx_cap where tag = 'dm')
+        and d.recipient_agent_id = (select b from dwx)),
+    (select b from dwx), null, 'direct', 'message', (select id from dwx_cap where tag = 'dm'), null, null,
+    'forged', 'forged', 'high', true, false, '{}'::jsonb, '{}'::jsonb)$$,
+  '42501', null, 'DWX-B3: service_role cannot call _upsert_inbox_item');
+select throws_ok($$select agent_board._queue_inbox_callbacks(
+    (select i.id from agent_board.inbox_items i where i.source_message_id = (select id from dwx_cap where tag = 'dm')
+        and i.recipient_agent_id = (select b from dwx)), 'inbox.item.delivered')$$,
+  '42501', null, 'DWX-B4: service_role cannot call _queue_inbox_callbacks');
+select throws_ok($$select agent_board._queue_board_post_callbacks((select board from dwx), (select id from dwx_cap where tag = 'dm'),
+    'forged', 'forged', 'medium', '{}'::jsonb)$$,
+  '42501', null, 'DWX-B5: service_role cannot call _queue_board_post_callbacks');
+select throws_ok($$select agent_board._next_thread_message_sequence((select thread from dwx))$$,
+  '42501', null, 'DWX-B6: service_role cannot call _next_thread_message_sequence');
+reset role;
+
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select uc::text from dwx), true);
+set local role authenticated;
+select is((select count(*) from agent_board.messages where id = (select id from dwx_cap where tag = 'dm')), 0::bigint,
+  'DWX-B7: a board member who was not addressed still cannot read the DM');
+reset role;
+select set_config('request.jwt.claim.sub', (select ux::text from dwx), true);
+set local role authenticated;
+select is((select count(*) from agent_board.messages where id = (select id from dwx_cap where tag = 'dm')), 0::bigint,
+  'DWX-B8: an agent outside the board still cannot read the DM');
+reset role;
+select is(
+  (select string_agg(d.delivery_mode || ':' || (d.recipient_agent_id = (select b from dwx))::text || ':' || coalesce(d.board_id::text, 'null'), ',')
+     from agent_board.delivery_recipients d where d.source_message_id = (select id from dwx_cap where tag = 'dm')),
+  'direct:true:null',
+  'DWX-B9: the DM has exactly its one direct, board-less delivery to B');
+select is(
+  (select (select count(*) || ':' || string_agg(subject || '|' || preview || '|' || priority, ',') from agent_board.inbox_items
+              where source_message_id = (select id from dwx_cap where tag = 'dm'))::text || '/'
+       || (select count(*) from agent_board.callback_outbox_events where source_message_id = (select id from dwx_cap where tag = 'dm'))::text || '/'
+       || (select last_message_sequence from agent_board.threads where id = (select thread from dwx))::text),
+  (select inbox::text || '/' || outbox::text || '/' || seq::text from dwx_pre),
+  'DWX-B10: the refused calls left the DM inbox rows (count and content), its outbox events and the thread sequence unchanged');
+
+-- The public routes keep working for service_role, reaching the sinks as the definer.
+select set_config('request.jwt.claim.role', 'service_role', true);
+select set_config('request.jwt.claim.sub', '', true);
+set local role service_role;
+select lives_ok($$insert into dwx_cap select 'svc_dm', message_id from agent_board.send_direct_message(
+    (select thread from dwx), (select a from dwx), (select b from dwx), 'svc dm', 'svc secret', p_metadata => '{"dwx":"svc"}')$$,
+  'DWX-P4: service_role send_direct_message still delivers');
+select lives_ok($$insert into dwx_cap select 'svc_board', message_id from agent_board.post_board_message(
+    (select thread from dwx), (select a from dwx), (select board from dwx), 'svc board', 'svc board body')$$,
+  'DWX-P5: service_role post_board_message still delivers');
+select lives_ok($$insert into dwx_cap select 'svc_reply', message_id from agent_board.post_message(
+    (select thread from dwx), (select a from dwx), 'svc reply')$$,
+  'DWX-P6: service_role post_message still posts');
+select lives_ok($$insert into dwx_cap select 'svc_multi', message_id from agent_board.send_multicast_message(
+    (select thread from dwx), (select a from dwx), array[(select b from dwx)], 'svc multi', 'svc multi body')$$,
+  'DWX-P7: service_role send_multicast_message still delivers');
+select lives_ok($$insert into dwx_cap select 'svc_task', task_id from agent_board.create_tasking_delivery(
+    (select thread from dwx), (select a from dwx), 'svc task', p_recipient_agent_ids => array[(select b from dwx)])$$,
+  'DWX-P8: service_role create_tasking_delivery still delivers');
+reset role;
+
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select uc::text from dwx), true);
+set local role authenticated;
+select is((select count(*) from agent_board.messages where id = (select id from dwx_cap where tag = 'svc_board')), 1::bigint,
+  'DWX-P9: a board member reads the service_role board post');
+select is((select count(*) from agent_board.messages where id in (select id from dwx_cap where tag in ('svc_dm', 'svc_multi'))), 0::bigint,
+  'DWX-P10: a board member cannot read the service_role DM or multicast it was not addressed in');
+reset role;
+select ok((select author_agent_id = (select a from dwx) and metadata ->> 'dwx' = 'svc'
+             from agent_board.messages where id = (select id from dwx_cap where tag = 'svc_dm')),
+  'DWX-P11: the service_role DM carries its stated author and the caller metadata');
+select is(
+  (select string_agg(d.delivery_mode || ':' || (d.recipient_agent_id = (select b from dwx))::text || ':' || coalesce(d.board_id::text, 'null'), ',')
+     from agent_board.delivery_recipients d where d.source_message_id = (select id from dwx_cap where tag = 'svc_dm')),
+  'direct:true:null',
+  'DWX-P12: the service_role DM has exactly its one direct delivery to B');
+
+-- session_send exemptions, positively: an authenticated caller cannot name another author.
+select set_config('request.jwt.claim.sub', (select ua::text from dwx), true);
+set local role authenticated;
+select throws_ok($$select * from agent_board.post_message((select thread from dwx), (select b from dwx), 'spoof')$$,
+  '42501', null, 'DWX-S1: post_message refuses an author other than the session agent');
+select throws_ok($$select * from agent_board.post_board_message((select thread from dwx), (select b from dwx), (select board from dwx), 'spoof', 'spoof')$$,
+  '42501', null, 'DWX-S2: post_board_message refuses an author other than the session agent');
+select throws_ok($$select * from agent_board.send_direct_message((select thread from dwx), (select b from dwx), (select c from dwx), 'spoof', 'spoof')$$,
+  '42501', null, 'DWX-S3: send_direct_message refuses an author other than the session agent');
+select throws_ok($$select * from agent_board.send_multicast_message((select thread from dwx), (select b from dwx), array[(select c from dwx)], 'spoof', 'spoof')$$,
+  '42501', null, 'DWX-S4: send_multicast_message refuses an author other than the session agent');
+select throws_ok($$select * from agent_board.create_tasking_delivery((select thread from dwx), (select b from dwx), 'spoof', p_recipient_agent_ids => array[(select c from dwx)])$$,
+  '42501', null, 'DWX-S5: create_tasking_delivery refuses a creator other than the session agent');
+reset role;
+
+select * from finish();
+rollback;

package/tests/agent_board_fk_lock_edges.test.sql

@@ -283,6 +283,8 @@ select is(
       where a.rel_name = 'agent_board.agents'
         and b.rel_name = 'agent_board.board_memberships') z),
   array[
+    -- #661: the extracted fan-out retains its sink's existing FK lock order.
+    '_deliver_board_message: memberships(key share) then agents(key share) [unserialised]',
     '_enroll_federated_identity_once: agents(key share) then memberships(key share) [unserialised]',
     '_redeem_fleet_invite_for_agent: memberships(key share) then agents(key share) [unserialised]',
     '_redeem_invite_for_agent: memberships(key share) then agents(key share) [unserialised]',
@@ -305,6 +307,7 @@ select is(
     'mint_delegated_child: agents(update) then memberships(update) [advisory]',
     'onboard_federated_fleet_agent: agents(update) then memberships(update) [advisory]',
     'post_board_message: agents(key share) then memberships(key share) [unserialised]',
+    'post_message: agents(key share) then memberships(key share) [unserialised]',
     'readmit_session_identity: agents(update) then memberships(update) [advisory]',
     'redeem_invite_link: memberships(key share) then agents(key share) [unserialised]',
     'request_join_board: memberships(update) then agents(key share) [unserialised]',

package/tests/agent_board_hosted_delegates.test.sql

@@ -370,9 +370,12 @@ select is(
 insert into _ex values ('post_message(uuid, uuid, text, text, uuid, jsonb)');
 -- 23
 select is(
-  (select count(*)::int from agent_board.messages where thread_id::text = pg_temp.v('T1') and author_agent_id = pg_temp.u('I1.agent') and body = 'delegate reply'),
+  (select count(*)::int from agent_board.messages m where m.thread_id::text = pg_temp.v('T1') and m.author_agent_id = pg_temp.u('I1.agent') and m.body = 'delegate reply'
+    and m.metadata->'delegate'->>'delegate' = 'true'
+    and exists(select 1 from agent_board.delivery_recipients d join agent_board.inbox_items i on i.delivery_recipient_id=d.id
+      where d.source_message_id=m.id and d.board_id=pg_temp.u('BX') and d.recipient_agent_id<>m.author_agent_id and i.visible_in_inbox)),
   1,
-  'state: the reply exists, authored by the delegate');
+  'state: the reply exists, authored and marked by the delegate, with visible board recipient delivery (#661)');
 -- 24 -- the ambient schema preflight
 select is(
   pg_temp.as_d_val($$ select version::text from agent_board.get_schema_version() $$),

package/tests/agent_board_inbox_rpcs.test.sql

@@ -206,6 +206,7 @@ declare
   v_left_member uuid := gen_random_uuid();
   v_outsider uuid := gen_random_uuid();
   v_thread uuid := gen_random_uuid();
+  v_board_thread uuid := gen_random_uuid();
   v_board uuid;
   v_direct_endpoint uuid;
   v_board_endpoint uuid;
@@ -226,7 +227,8 @@ begin
     (v_outsider, 'agent', 'test_inboxrpc_outsider', 'Inbox RPC Outsider');
 
   insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
-  values (v_thread, 'coordination', v_sender, 'Inbox RPC Test Thread');
+  values (v_thread, 'coordination', v_sender, 'Inbox RPC Test Thread'),
+         (v_board_thread, 'coordination', v_sender, 'Inbox RPC empty board thread');
 
   select * into v_result
     from agent_board.create_board(
@@ -367,7 +369,7 @@ begin
 
   select * into v_result
     from agent_board.post_board_message(
-      v_thread,
+      v_board_thread,
       v_sender,
       v_board,
       'Board subject',
@@ -399,7 +401,7 @@ begin
 
   select * into v_result
     from agent_board.create_tasking_delivery(
-      v_thread,
+      v_board_thread,
       v_sender,
       'Tasking title',
       'Tasking details for duplicate suppression',

package/tests/agent_board_obsgate.test.sql

@@ -14,7 +14,7 @@ set search_path = extensions, public, agent_board;
 
 begin;
 
-select plan(13);
+select plan(14);
 
 create temp table _og_fixture (
   board uuid,
@@ -81,12 +81,10 @@ begin
   -- thread from source_task_id so this path is not a bypass (was the #78 round-1 panel finding).
   perform agent_board.create_tasking_delivery(v_tasking_thread, v_member, 'task title', 'details', null, v_board);
 
-  -- Multi-board thread: fan the SAME thread to v_board then v_board2 (as operator). first-board-wins
-  -- means it stamps to v_board and is NEVER left NULL (the round-2 codex finding).
+  -- A first board associates the empty thread. A second board is refused below.
   perform set_config('request.jwt.claim.role', 'service_role', true);
   perform set_config('request.jwt.claim.sub', '', true);
   perform agent_board.post_board_message(v_multi_thread, v_creator, v_board, 'm1', 'first board');
-  perform agent_board.post_board_message(v_multi_thread, v_creator, v_board2, 'm2', 'second board');
 
   insert into _og_fixture values
     (v_board, v_board2, v_member, v_observer, v_board_thread, v_boardless_thread, v_tasking_thread, v_multi_thread, v_member_user, v_observer_user);
@@ -114,6 +112,12 @@ select throws_ok(
   '42501', 'thread posting requires a non-observer board role',
   'observer cannot author into a board thread via post_message (bypass closed)');
 
+select throws_ok(
+  $$select set_config('request.jwt.claim.role','service_role',true);
+    select * from agent_board.post_board_message((select multi_thread from _og_fixture),
+      (select member_agent from _og_fixture), (select board2 from _og_fixture), 'm2', 'second board')$$,
+  '42501', 'thread belongs to a different board', 'second board is refused at the boundary');
+
 -- multi-board thread: stamped to the FIRST board (never left NULL) — round-2 panel finding ----
 select is(
   (select board_id from agent_board.threads where id = (select multi_thread from _og_fixture)),

package/tests/agent_board_obsgate4.test.sql

@@ -83,11 +83,11 @@ begin
   -- but has NO thread access — the case where mutate != access. Set up as service_role.
   insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, access_mode)
   values (v_restricted_thread, 'coordination', v_creator, 'O4 restricted thread', 'restricted');
-  insert into agent_board.thread_memberships(thread_id, agent_id, role, granted_by_agent_id)
-  values (v_restricted_thread, v_creator, 'member', v_creator);
   perform set_config('request.jwt.claim.role', 'service_role', true);
   perform set_config('request.jwt.claim.sub', '', true);
   perform agent_board.post_board_message(v_restricted_thread, v_creator, v_board, 'seed', 'seed');
+  insert into agent_board.thread_memberships(thread_id, agent_id, role, granted_by_agent_id)
+  values (v_restricted_thread, v_creator, 'member', v_creator);
   select task_id into v_restricted_task from agent_board.create_task(v_restricted_thread, v_creator, 'restricted task', 'd');
 
   insert into _o4_fixture values

package/tests/agent_board_outbox_wake_ordering.test.sql

@@ -36,7 +36,7 @@
 
 begin;
 
-select plan(37);
+select plan(38);
 
 -- ---------------------------------------------------------------------------
 -- WO-1 SHAPE
@@ -201,7 +201,9 @@ select isnt(
 -- closed to PUBLIC/anon/authenticated and open to service_role. A function added to this
 -- migration (or any later one) that forgets its revoke or its grant fails here and PRINTS
 -- ITS OWN NAME. Verified exemption-free at the time of writing: all eight members of the
--- class satisfy both directions, so neither assertion passes by finding nothing.
+-- class satisfy both directions, so neither assertion passes by finding nothing. Since #717 F1
+-- (migration 20261104180000) the two internal sinks are deliberately NOT service_role-executable;
+-- the service_role direction names them as its only exemption and the third assertion proves it.
 select is(
   (select coalesce(string_agg(p.proname, ', ' order by p.proname), '')
      from pg_proc p
@@ -230,10 +232,31 @@ select is(
       -- `AGENT_BOARD.CALLBACK_OUTBOX_EVENTS` drop OUT, so its executability is
       -- never checked at all -- fail-OPEN, on a privilege gate.
       and agent_board_test.stripped_body(p.oid) ~* 'callback_outbox_events'
+      -- The two internal outbox SINKS are not API routes (#717 F1, migration 20261104180000,
+      -- pinned by agent_board_delivery_writer_execute.test.sql). Their exemption is asserted
+      -- POSITIVELY by the WO-5 assertion that follows, not by absence from this one.
+      and p.proname not in ('_queue_board_post_callbacks', '_queue_inbox_callbacks')
       and not has_function_privilege('service_role', p.oid, 'EXECUTE')),
   '',
   'WO-5 CLASS: every SECURITY DEFINER function reaching callback_outbox_events is executable by service_role -- a dropped-and-recreated function that lost its grant names itself here');
 
+-- The exemption above, positively: each exempt sink exists, no API role (nor PUBLIC) can
+-- EXECUTE it, and every function that calls it is SECURITY DEFINER, so the public routes still
+-- reach it as the definer. A recreated sink that re-granted PUBLIC, or an INVOKER caller that
+-- would now fail with 42501, names itself.
+select is(
+  (select coalesce(string_agg(e.n, ', ' order by e.n), '')
+     from unnest(array['_queue_board_post_callbacks', '_queue_inbox_callbacks']) e(n)
+    where (select count(*) from pg_proc p where p.pronamespace = 'agent_board'::regnamespace and p.proname = e.n) <> 1
+       or exists (select 1 from pg_proc p cross join unnest(array['public', 'anon', 'authenticated', 'service_role', 'agent_board_delegate']) r
+                   where p.pronamespace = 'agent_board'::regnamespace and p.proname = e.n
+                     and has_function_privilege(r, p.oid, 'EXECUTE'))
+       or exists (select 1 from pg_proc c
+                   where c.pronamespace = 'agent_board'::regnamespace and c.proname <> e.n and not c.prosecdef
+                     and agent_board_test.stripped_body(c.oid) ~ agent_board_test.call_re(e.n))),
+  '',
+  'WO-5 CLASS: the two internal outbox sinks are API-closed (no PUBLIC/anon/authenticated/service_role/delegate EXECUTE) and called only from SECURITY DEFINER functions');
+
 -- ---------------------------------------------------------------------------
 -- Fixture: a real board fan-out. Five subscribers, one verified endpoint each.
 -- ---------------------------------------------------------------------------

package/tests/agent_board_own_post_not_delivered.test.sql

@@ -40,7 +40,7 @@ select plan(40);
 -- The class, derived from pg_proc.
 -- ---------------------------------------------------------------------------
 select is(
-  (select array_agg(p.proname::text order by p.proname)
+  (select array_agg(p.proname::text order by p.proname::text collate "C")
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.stmt_re('insert into|merge into', 'inbox_items')),
@@ -48,17 +48,17 @@ select is(
   'OPN-01: _upsert_inbox_item is the only function that inserts into inbox_items');
 
 select is(
-  (select array_agg(p.proname::text order by p.proname)
+  (select array_agg(p.proname::text order by p.proname::text collate "C")
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_upsert_inbox_item')
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.qname_re('board_memberships')
       and p.proname <> '_upsert_inbox_item'),
-  array['create_tasking_delivery', 'post_board_message'],
+  array['_deliver_board_message', 'create_tasking_delivery'],
   'OPN-02: the board-expanding delivery writers are exactly the two this file asserts behaviourally');
 
 select is(
-  (select array_agg(p.proname::text order by p.proname)
+  (select array_agg(p.proname::text order by p.proname::text collate "C")
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_upsert_inbox_item')
@@ -73,7 +73,7 @@ select is(
 create temp table _opn (
   a_user uuid, b_user uuid,
   a_agent uuid, b_agent uuid,
-  board_ab uuid, board_s uuid, thread uuid, thread_unlinked uuid, thread_unlinked2 uuid
+  board_ab uuid, board_s uuid, thread uuid, thread_unlinked uuid, thread_unlinked2 uuid, thread_sole_post uuid
 ) on commit drop;
 create temp table _opn_post (message_id uuid, board_id uuid, delivered_recipient_count integer,
   callback_outbox_count integer, created_at timestamptz) on commit drop;
@@ -106,6 +106,7 @@ declare
   v_thread uuid := '76080000-0000-4000-8000-000000000010';
   v_thread_unlinked uuid := '76080000-0000-4000-8000-000000000011';
   v_thread_unlinked2 uuid := '76080000-0000-4000-8000-000000000012';
+  v_thread_sole_post uuid := '76080000-0000-4000-8000-000000000013';
   v_board_ab uuid;
   v_board_s uuid;
   v_endpoint uuid;
@@ -120,7 +121,8 @@ begin
   insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
   values (v_thread, 'coordination', v_a, 'OPN thread'),
          (v_thread_unlinked, 'coordination', v_a, 'OPN unlinked thread'),
-         (v_thread_unlinked2, 'coordination', v_a, 'OPN second unlinked thread');
+         (v_thread_unlinked2, 'coordination', v_a, 'OPN second unlinked thread'),
+         (v_thread_sole_post, 'coordination', v_a, 'OPN empty sole-post thread');
 
   select board_id into v_board_ab
     from agent_board.create_board(v_a, 'opn-board-ab', 'OPN AB', 'two members', '{}'::jsonb, 'private');
@@ -137,7 +139,7 @@ begin
   perform agent_board.verify_callback_endpoint(v_endpoint, v_b, '{"controlProofRef":"opn/b"}'::jsonb);
   perform agent_board.subscribe_callback_endpoint(v_endpoint, v_b, 'own_inbox', 'inbox.item.delivered', null, '{}'::jsonb);
 
-  insert into _opn values (v_a_user, v_b_user, v_a, v_b, v_board_ab, v_board_s, v_thread, v_thread_unlinked, v_thread_unlinked2);
+  insert into _opn values (v_a_user, v_b_user, v_a, v_b, v_board_ab, v_board_s, v_thread, v_thread_unlinked, v_thread_unlinked2, v_thread_sole_post);
 end;
 $$;
 
@@ -219,7 +221,7 @@ set local role authenticated;
 select lives_ok(
   $$ insert into _opn_sole
        select * from agent_board.post_board_message(
-         (select thread from _opn), null, (select board_s from _opn),
+         (select thread_sole_post from _opn), null, (select board_s from _opn),
          'opn sole post', 'the author posts to a board it is alone on', 'comment', 'medium', null, '{}'::jsonb) $$,
   'OPN-12: the author can post to a board it is the only member of');
 
@@ -479,7 +481,7 @@ select is(
 -- (explicit_set recursion), the read-only resolve_recipients, and _addressing_agent_ids_or_raise --
 -- the one delivery path, where the #608 rule lives. A new caller that delivers fails this by name.
 select is(
-  (select array_agg(p.proname::text order by p.proname)
+  (select array_agg(p.proname::text order by p.proname::text collate "C")
      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and agent_board_test.stripped_body(p.oid) ~ agent_board_test.call_re('_resolve_addressing_recipient_rows')),