@team-semicolon/semicolony-cli 4.18.126 → 4.18.127

package/migrations/226_action_items_work_loop.sql

@@ -0,0 +1,634 @@
+-- 226_action_items_work_loop.sql
+-- Baseline: aa007fb57fea7758d3a1bee7ecfecbe3f2ff8d94. Runner owns transaction.
+-- Additive ledger evolution. Existing execution state/history is never rewritten.
+-- CHECK NOT VALID preserves legacy anomalies while guarding every new write.
+-- Rollback: restore application version first; retain additive tables/history.
+-- Canary: packages/cli/scripts/verify-action-items-work-loop.sql (ROLLBACK).
+
+CREATE TABLE semicolony.action_external_contacts (
+  external_contact_id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  display_name text NOT NULL CHECK (length(btrim(display_name)) > 0),
+  source_ref text UNIQUE,
+  metadata jsonb NOT NULL DEFAULT '{}' CHECK (jsonb_typeof(metadata) = 'object'),
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE semicolony.action_items
+  ADD COLUMN version bigint NOT NULL DEFAULT 1 CHECK (version > 0),
+  ADD COLUMN external_contact_id uuid REFERENCES semicolony.action_external_contacts,
+  ADD COLUMN sponsor_member_id uuid REFERENCES semicolony.team_members,
+  ADD COLUMN waiting_on_external boolean NOT NULL DEFAULT false,
+  ADD COLUMN next_follow_up_at timestamptz,
+  ADD COLUMN last_confirmed_at timestamptz,
+  ADD CONSTRAINT action_items_metadata_object CHECK (jsonb_typeof(metadata) = 'object') NOT VALID,
+  ADD CONSTRAINT action_items_assignee_xor CHECK (
+    (assignee_kind = 'team-member' AND assignee_member_id IS NOT NULL AND assignee_agent_id IS NULL)
+    OR (assignee_kind = 'agent' AND assignee_agent_id IS NOT NULL AND assignee_member_id IS NULL)
+    OR (assignee_kind = 'unassigned' AND assignee_agent_id IS NULL AND assignee_member_id IS NULL)
+  ) NOT VALID,
+  ADD CONSTRAINT action_items_external_sponsor CHECK (
+    external_contact_id IS NULL OR (sponsor_member_id IS NOT NULL AND assignee_kind = 'unassigned')
+  ) NOT VALID;
+CREATE INDEX action_items_page_idx ON semicolony.action_items(deadline, action_item_id);
+CREATE INDEX action_items_sponsor_idx ON semicolony.action_items(sponsor_member_id, status);
+CREATE FUNCTION semicolony.bump_action_item_version() RETURNS trigger
+LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+BEGIN NEW.version := OLD.version + 1; NEW.updated_at := now(); RETURN NEW; END $$;
+CREATE TRIGGER action_item_version BEFORE UPDATE ON semicolony.action_items
+FOR EACH ROW EXECUTE FUNCTION semicolony.bump_action_item_version();
+
+CREATE TABLE semicolony.action_item_dependencies (
+  action_item_id uuid NOT NULL REFERENCES semicolony.action_items,
+  depends_on_action_item_id uuid NOT NULL REFERENCES semicolony.action_items,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY(action_item_id, depends_on_action_item_id),
+  CHECK(action_item_id <> depends_on_action_item_id)
+);
+CREATE TABLE semicolony.action_item_candidates (
+  candidate_id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  source_kind text NOT NULL CHECK (source_kind IN ('meeting','feedback','incident','review','decision','manual','cron','slack','kb')),
+  source_ref text NOT NULL CHECK (length(btrim(source_ref)) > 0),
+  source_identity text NOT NULL CHECK (length(btrim(source_identity)) > 0),
+  proposal jsonb NOT NULL CHECK (jsonb_typeof(proposal) = 'object'),
+  reasons jsonb NOT NULL CHECK (jsonb_typeof(reasons) = 'array'),
+  status text NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','accepted','rejected')),
+  meeting_id uuid REFERENCES semicolony.meetings,
+  assignee_member_id uuid REFERENCES semicolony.team_members,
+  sponsor_member_id uuid REFERENCES semicolony.team_members,
+  created_by_member_id uuid REFERENCES semicolony.team_members,
+  created_by_agent_id text REFERENCES semicolony.bot_status,
+  resolved_by_member_id uuid REFERENCES semicolony.team_members,
+  resolved_by_agent_id text REFERENCES semicolony.bot_status,
+  resolution_note text,
+  resolution_source_ref text,
+  action_item_id uuid REFERENCES semicolony.action_items,
+  version bigint NOT NULL DEFAULT 1,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(source_kind, source_ref, source_identity),
+  CHECK ((status = 'accepted') = (action_item_id IS NOT NULL))
+);
+CREATE INDEX action_item_candidates_page_idx ON semicolony.action_item_candidates(created_at,candidate_id);
+CREATE TABLE semicolony.action_delegations (
+  delegation_id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  token_hash text NOT NULL UNIQUE CHECK (token_hash ~ '^[a-f0-9]{64}$'),
+  allowed_actor_id text NOT NULL REFERENCES semicolony.bot_status,
+  requester_member_id uuid NOT NULL REFERENCES semicolony.team_members,
+  action_item_id uuid NOT NULL REFERENCES semicolony.action_items,
+  expected_version bigint NOT NULL CHECK(expected_version > 0),
+  patch jsonb NOT NULL CHECK(jsonb_typeof(patch) = 'object'),
+  source_ref text NOT NULL CHECK(length(btrim(source_ref)) > 0),
+  expires_at timestamptz NOT NULL,
+  consumed_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(source_ref, allowed_actor_id, action_item_id)
+);
+
+-- Worker lanes have no restricted-read capability. A named meeting source
+-- without a resolvable record is hidden, matching KB meeting projection policy.
+CREATE FUNCTION semicolony.action_item_worker_visible(p_id uuid) RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path=pg_catalog AS $$
+ SELECT EXISTS(SELECT 1 FROM semicolony.action_items a WHERE a.action_item_id=p_id
+  AND coalesce(a.metadata #>> '{classification,sensitivity}','internal') <> 'restricted'
+  AND NOT EXISTS(SELECT 1 FROM semicolony.meetings m WHERE
+    (m.meeting_id=a.meeting_id OR (a.source_kind='meeting' AND m.meeting_id::text=a.source_ref)) AND m.visibility IS DISTINCT FROM 'team')
+  AND (a.source_kind<>'meeting' OR EXISTS(SELECT 1 FROM semicolony.meetings m WHERE m.meeting_id=a.meeting_id OR m.meeting_id::text=a.source_ref)));
+$$;
+CREATE FUNCTION semicolony.action_candidate_source_visible(p_id uuid) RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path=pg_catalog AS $$
+ SELECT EXISTS(SELECT 1 FROM semicolony.action_item_candidates c WHERE c.candidate_id=p_id
+  AND coalesce(c.proposal #>> '{metadata,classification,sensitivity}','internal') <> 'restricted'
+  AND NOT EXISTS(SELECT 1 FROM semicolony.meetings m WHERE
+    (m.meeting_id=c.meeting_id OR (c.source_kind='meeting' AND m.meeting_id::text=c.source_ref)) AND m.visibility IS DISTINCT FROM 'team')
+  AND (c.source_kind<>'meeting' OR EXISTS(SELECT 1 FROM semicolony.meetings m WHERE m.meeting_id=c.meeting_id OR m.meeting_id::text=c.source_ref)));
+$$;
+CREATE FUNCTION semicolony.action_contact_worker_visible(p_id text) RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path=pg_catalog AS $$
+ SELECT EXISTS(SELECT 1 FROM semicolony.action_external_contacts e WHERE e.external_contact_id::text=lower(btrim(p_id))
+  AND coalesce(e.metadata #>> '{classification,sensitivity}','internal') <> 'restricted'
+  AND NOT EXISTS(SELECT 1 FROM semicolony.action_items a WHERE a.external_contact_id=e.external_contact_id AND NOT semicolony.action_item_worker_visible(a.action_item_id))
+  AND NOT EXISTS(SELECT 1 FROM semicolony.action_item_candidates c WHERE lower(btrim(c.proposal->>'external_contact_id'))=lower(btrim(p_id)) AND NOT semicolony.action_candidate_source_visible(c.candidate_id)));
+$$;
+
+-- Separate source classification from linked-contact classification: contact visibility
+-- reads only source visibility, so candidate -> contact never recurses back to itself.
+CREATE FUNCTION semicolony.action_candidate_worker_visible(p_id uuid) RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path=pg_catalog AS $$
+ SELECT EXISTS(SELECT 1 FROM semicolony.action_item_candidates c WHERE c.candidate_id=p_id
+  AND semicolony.action_candidate_source_visible(c.candidate_id)
+  -- Invalid or unknown contact facts remain visible pending proposals for repair.
+  AND NOT EXISTS(SELECT 1 FROM semicolony.action_external_contacts e WHERE e.external_contact_id::text=lower(btrim(c.proposal->>'external_contact_id')) AND NOT semicolony.action_contact_worker_visible(e.external_contact_id::text))
+  AND NOT EXISTS(SELECT 1 FROM semicolony.action_items a WHERE a.action_item_id=c.action_item_id AND a.external_contact_id IS NOT NULL AND NOT semicolony.action_contact_worker_visible(a.external_contact_id::text)));
+$$;
+REVOKE ALL ON FUNCTION semicolony.action_candidate_source_visible(uuid) FROM PUBLIC;
+
+-- Shared admission checks return missing/invalid facts instead of manufacturing them.
+CREATE FUNCTION semicolony.action_candidate_reasons(p jsonb) RETURNS jsonb
+LANGUAGE plpgsql STABLE SET search_path = pg_catalog AS $$
+DECLARE r jsonb := '[]'; d date; owners integer;
+BEGIN
+  IF jsonb_typeof(p) IS DISTINCT FROM 'object' THEN RETURN '["invalid_proposal"]'; END IF;
+  IF jsonb_typeof(p->'description') IS DISTINCT FROM 'string' THEN r := r || '"description_must_be_string"'::jsonb; END IF;
+  IF length(btrim(coalesce(p->>'description',''))) < 5 THEN r := r || '"description_required"'::jsonb; END IF;
+  IF NOT EXISTS(SELECT 1 FROM semicolony.ontology WHERE domain = p->>'project_domain') THEN r := r || '"project_required_or_unknown"'::jsonb; END IF;
+  BEGIN
+    IF coalesce(p->>'deadline','') !~ '^\d{4}-\d{2}-\d{2}$' THEN RAISE invalid_datetime_format; END IF;
+    d := (p->>'deadline')::date;
+  EXCEPTION WHEN invalid_datetime_format OR datetime_field_overflow THEN r := r || '"deadline_required_or_invalid"'::jsonb; END;
+  owners := (nullif(p->>'assignee_member','') IS NOT NULL)::integer
+          + (nullif(p->>'assignee_agent','') IS NOT NULL)::integer
+          + (coalesce(nullif(p->>'external_contact_id',''),nullif(p->>'external_contact','')) IS NOT NULL)::integer;
+  IF owners <> 1 THEN r := r || '"exactly_one_assignee_required"'::jsonb; END IF;
+  IF p->>'assignee_member' IS NOT NULL AND NOT EXISTS(SELECT 1 FROM semicolony.team_members WHERE domain=p->>'assignee_member' AND status='active') THEN r := r || '"assignee_member_unknown_or_inactive"'::jsonb; END IF;
+  IF p->>'assignee_agent' IS NOT NULL AND NOT EXISTS(SELECT 1 FROM semicolony.bot_status WHERE bot_id=p->>'assignee_agent' AND status IS DISTINCT FROM 'retired') THEN r := r || '"assignee_agent_unknown_or_retired"'::jsonb; END IF;
+  IF coalesce(p->>'external_contact_id',p->>'external_contact') IS NOT NULL THEN
+    IF p->>'external_contact_id' IS NOT NULL AND NOT semicolony.action_contact_worker_visible(p->>'external_contact_id') THEN r := r || '"external_contact_unknown"'::jsonb; END IF;
+    IF nullif(p->>'sponsor_member','') IS NULL THEN r := r || '"internal_sponsor_required"'::jsonb; END IF;
+  END IF;
+  IF p->>'sponsor_member' IS NOT NULL AND NOT EXISTS(SELECT 1 FROM semicolony.team_members WHERE domain=p->>'sponsor_member' AND status='active') THEN r := r || '"sponsor_unknown_or_inactive"'::jsonb; END IF;
+  IF p ? 'metadata' AND jsonb_typeof(p->'metadata') IS DISTINCT FROM 'object' THEN r := r || '"metadata_must_be_object"'::jsonb; END IF;
+  IF p ? 'priority' AND coalesce(p->>'priority','') NOT IN ('low','normal','high','urgent') THEN r := r || '"priority_invalid"'::jsonb; END IF;
+  RETURN r;
+END $$;
+
+CREATE FUNCTION semicolony.create_action_candidate(p_proposal jsonb, p_source_kind text,
+  p_source_ref text,p_source_identity text,p_caller_kind text,p_caller_member text,p_caller_agent text,
+  p_meeting_id uuid DEFAULT NULL) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $$
+DECLARE v_id uuid; v_member uuid;
+BEGIN
+  IF jsonb_typeof(p_proposal) IS DISTINCT FROM 'object' THEN RAISE EXCEPTION 'invalid proposal' USING ERRCODE='22023'; END IF;
+  IF p_caller_kind='team-member' THEN
+    SELECT member_id INTO v_member FROM semicolony.team_members WHERE domain=p_caller_member AND status='active';
+    IF v_member IS NULL THEN RAISE EXCEPTION 'invalid candidate caller' USING ERRCODE='AI001'; END IF;
+  ELSIF p_caller_kind='agent' THEN
+    IF NOT EXISTS(SELECT 1 FROM semicolony.bot_status WHERE bot_id=p_caller_agent AND status IS DISTINCT FROM 'retired') THEN RAISE EXCEPTION 'invalid candidate caller' USING ERRCODE='AI001'; END IF;
+  ELSIF p_caller_kind IS DISTINCT FROM 'system' OR p_meeting_id IS NULL THEN
+    RAISE EXCEPTION 'invalid candidate caller' USING ERRCODE='AI001';
+  END IF;
+  INSERT INTO semicolony.action_item_candidates(source_kind,source_ref,source_identity,proposal,reasons,meeting_id,assignee_member_id,sponsor_member_id,created_by_member_id,created_by_agent_id)
+  VALUES(p_source_kind,p_source_ref,p_source_identity,p_proposal,semicolony.action_candidate_reasons(p_proposal),p_meeting_id,(SELECT member_id FROM semicolony.team_members WHERE domain=p_proposal->>'assignee_member'),(SELECT member_id FROM semicolony.team_members WHERE domain=p_proposal->>'sponsor_member'),v_member,CASE WHEN p_caller_kind='agent' THEN p_caller_agent END)
+  ON CONFLICT(source_kind,source_ref,source_identity) DO NOTHING RETURNING candidate_id INTO v_id;
+  IF v_id IS NULL THEN SELECT candidate_id INTO v_id FROM semicolony.action_item_candidates WHERE source_kind=p_source_kind AND source_ref=p_source_ref AND source_identity=p_source_identity; END IF;
+  RETURN v_id;
+END $$;
+
+CREATE FUNCTION semicolony.resolve_action_candidate(p_candidate_id uuid,p_decision text,
+ p_expected_version bigint,p_fields jsonb,p_note text,p_caller_kind text,p_caller_member text,p_caller_agent text)
+RETURNS uuid LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $$
+DECLARE c semicolony.action_item_candidates%ROWTYPE; p jsonb; a uuid; m uuid; sponsor uuid; k text; contact uuid;
+BEGIN
+ SELECT * INTO c FROM semicolony.action_item_candidates WHERE candidate_id=p_candidate_id FOR UPDATE;
+ IF NOT FOUND OR (p_caller_kind IS DISTINCT FROM 'system' AND NOT semicolony.action_candidate_worker_visible(p_candidate_id)) THEN RAISE EXCEPTION 'candidate_not_found' USING ERRCODE='AI002'; END IF;
+ SELECT member_id INTO m FROM semicolony.team_members WHERE domain=p_caller_member AND status='active';
+ -- Review belongs to a submitting human, proposed assignee/sponsor, or submitting/assigned agent.
+ IF NOT coalesce((p_caller_kind='system' AND c.meeting_id IS NOT NULL) OR (p_caller_kind='team-member' AND m IS NOT NULL AND
+     (c.created_by_member_id=m OR c.proposal->>'assignee_member'=p_caller_member OR c.proposal->>'sponsor_member'=p_caller_member OR
+      (c.created_by_member_id IS NULL AND c.created_by_agent_id IS NULL))) OR
+   (p_caller_kind='agent' AND p_caller_agent IS NOT NULL AND
+     (c.created_by_agent_id=p_caller_agent OR c.proposal->>'assignee_agent'=p_caller_agent)),false) THEN
+   RAISE EXCEPTION 'candidate_not_owned' USING ERRCODE='AI001'; END IF;
+ IF p_decision NOT IN ('accept','reject') OR p_decision IS NULL THEN RAISE EXCEPTION 'invalid decision' USING ERRCODE='22023'; END IF;
+ -- Retry of an already applied decision returns the original immutable result.
+ IF c.status <> 'pending' THEN
+   IF c.status = (CASE p_decision WHEN 'accept' THEN 'accepted' ELSE 'rejected' END) THEN RETURN c.action_item_id; END IF;
+   RAISE EXCEPTION 'candidate_already_resolved' USING ERRCODE='AI003';
+ END IF;
+ IF p_expected_version IS NOT NULL AND c.version<>p_expected_version THEN RAISE EXCEPTION 'version_conflict' USING ERRCODE='AI003'; END IF;
+ IF p_decision='reject' THEN
+   IF length(btrim(coalesce(p_note,'')))=0 THEN RAISE EXCEPTION 'rejection note required' USING ERRCODE='22023'; END IF;
+ ELSE
+   IF jsonb_typeof(p_fields) IS DISTINCT FROM 'object' OR NOT (p_fields ? 'project_domain' AND p_fields ? 'deadline') THEN RAISE EXCEPTION 'explicit project and deadline required' USING ERRCODE='22023'; END IF;
+   -- Assignee must be explicitly confirmed; a partial patch cannot inherit an old owner.
+   p := (c.proposal - ARRAY['assignee_member','assignee_agent','external_contact_id','external_contact','sponsor_member']) || p_fields;
+   IF semicolony.action_candidate_reasons(p) <> '[]'::jsonb THEN RAISE EXCEPTION 'candidate execution facts incomplete' USING ERRCODE='22023'; END IF;
+   k := CASE WHEN p->>'assignee_member' IS NOT NULL THEN 'team-member' WHEN p->>'assignee_agent' IS NOT NULL THEN 'agent' ELSE 'unassigned' END;
+   SELECT member_id INTO sponsor FROM semicolony.team_members WHERE domain=p->>'sponsor_member' AND status='active';
+   contact := (p->>'external_contact_id')::uuid;
+   IF contact IS NULL AND p->>'external_contact' IS NOT NULL THEN
+     INSERT INTO semicolony.action_external_contacts(display_name,source_ref,metadata) VALUES(p->>'external_contact','candidate:' || c.candidate_id::text,jsonb_build_object('classification',coalesce(p #> '{metadata,classification}','{}'::jsonb)))
+       ON CONFLICT(source_ref) DO UPDATE SET source_ref=EXCLUDED.source_ref RETURNING external_contact_id INTO contact;
+   END IF;
+   a := semicolony.create_action_item(p->>'description',p->>'project_domain',(p->>'deadline')::date,
+     k,p->>'assignee_member',p->>'assignee_agent',NULL,coalesce(p->>'priority','normal'),
+     c.source_kind,c.source_ref,p->>'related_url',p->>'external_contact',coalesce(p->'metadata','{}') || jsonb_build_object('candidate_id',c.candidate_id),
+     'system',NULL,NULL,NULL,NULL,NULL,NULL);
+   UPDATE semicolony.action_items SET external_contact_id=contact,
+     sponsor_member_id=sponsor,waiting_on_external=(contact IS NOT NULL),meeting_id=c.meeting_id WHERE action_item_id=a;
+   INSERT INTO semicolony.action_item_events(action_item_id,event_type,actor_kind,actor_member_id,actor_agent_id,payload)
+   VALUES(a,'noted',CASE p_caller_kind WHEN 'team-member' THEN 'human' WHEN 'agent' THEN 'agent' ELSE 'system' END,
+     m,CASE WHEN p_caller_kind='agent' THEN p_caller_agent END,
+     jsonb_build_object('candidate_id',c.candidate_id,'operation','candidate_accepted','note',p_note,'source_ref',c.source_ref));
+ END IF;
+ UPDATE semicolony.action_item_candidates SET status=CASE p_decision WHEN 'accept' THEN 'accepted' ELSE 'rejected' END,
+   action_item_id=a,resolution_note=p_note,resolved_by_member_id=m,
+   resolved_by_agent_id=CASE WHEN p_caller_kind='agent' THEN p_caller_agent END,version=version+1,updated_at=now() WHERE candidate_id=c.candidate_id;
+ RETURN a;
+END $$;
+
+CREATE FUNCTION semicolony.validate_action_patch(p jsonb) RETURNS void
+LANGUAGE plpgsql SET search_path=pg_catalog AS $$
+BEGIN
+ IF jsonb_typeof(p) IS DISTINCT FROM 'object' OR p='{}'::jsonb OR EXISTS(
+   SELECT 1 FROM jsonb_object_keys(p) k WHERE k NOT IN ('status','deadline','note','metadata','description','priority','waiting_on_external','next_follow_up_at','last_confirmed_at','dependency_ids')) THEN
+   RAISE EXCEPTION 'invalid action patch' USING ERRCODE='22023'; END IF;
+ IF (p ? 'metadata' AND jsonb_typeof(p->'metadata') IS DISTINCT FROM 'object') OR
+    (p ? 'waiting_on_external' AND jsonb_typeof(p->'waiting_on_external') IS DISTINCT FROM 'boolean') OR
+    (p ? 'dependency_ids' AND jsonb_typeof(p->'dependency_ids') IS DISTINCT FROM 'array') OR
+    (p ? 'description' AND (jsonb_typeof(p->'description') IS DISTINCT FROM 'string' OR length(btrim(p->>'description'))<5)) OR
+    (p ? 'status' AND coalesce(p->>'status','') NOT IN ('open','in_progress','blocked','done','cancelled')) OR
+    (p ? 'priority' AND coalesce(p->>'priority','') NOT IN ('low','normal','high','urgent')) OR
+    (p ? 'deadline' AND coalesce(p->>'deadline','') !~ '^\d{4}-\d{2}-\d{2}$') THEN
+   RAISE EXCEPTION 'invalid action patch value' USING ERRCODE='22023'; END IF;
+END $$;
+
+CREATE FUNCTION semicolony.edit_action_item(p_action_item_id uuid,p_caller_kind text,
+ p_caller_member text,p_caller_agent text,p_expected_version bigint,p_patch jsonb,p_delegation_token_hash text DEFAULT NULL)
+RETURNS uuid LANGUAGE plpgsql SECURITY DEFINER SET search_path=pg_catalog AS $$
+DECLARE a semicolony.action_items%ROWTYPE; m uuid; d semicolony.action_delegations%ROWTYPE; v_source text; dep uuid;
+BEGIN
+ PERFORM semicolony.validate_action_patch(p_patch);
+ -- Delegation lock first consistently, then action lock. Any later failure rolls consumption back.
+ IF p_delegation_token_hash IS NOT NULL THEN
+   SELECT * INTO d FROM semicolony.action_delegations WHERE token_hash=p_delegation_token_hash FOR UPDATE;
+   IF NOT FOUND OR p_caller_kind IS DISTINCT FROM 'agent' OR d.allowed_actor_id IS DISTINCT FROM p_caller_agent
+      OR d.action_item_id IS DISTINCT FROM p_action_item_id OR d.expected_version IS DISTINCT FROM p_expected_version
+      OR d.patch IS DISTINCT FROM p_patch OR d.expires_at<=clock_timestamp() OR d.consumed_at IS NOT NULL THEN
+     RAISE EXCEPTION 'invalid_delegation' USING ERRCODE='AI004'; END IF;
+   m := d.requester_member_id; v_source := d.source_ref;
+ ELSE
+   SELECT member_id INTO m FROM semicolony.team_members WHERE domain=p_caller_member AND status='active';
+ END IF;
+ IF p_patch ? 'dependency_ids' THEN PERFORM pg_advisory_xact_lock(hashtextextended('action-dependencies',0)); END IF;
+ SELECT * INTO a FROM semicolony.action_items WHERE action_item_id=p_action_item_id FOR UPDATE;
+ IF NOT FOUND OR NOT semicolony.action_item_worker_visible(p_action_item_id) THEN RAISE EXCEPTION 'action_item_not_found' USING ERRCODE='AI002'; END IF;
+ IF NOT coalesce(((p_caller_kind='team-member' OR d.delegation_id IS NOT NULL) AND m IS NOT NULL AND
+   (a.assignee_member_id=m OR a.sponsor_member_id=m)) OR
+   (d.delegation_id IS NULL AND p_caller_kind='agent' AND p_caller_agent IS NOT NULL AND a.assignee_agent_id=p_caller_agent),false) THEN
+   RAISE EXCEPTION 'action_item_not_owned' USING ERRCODE='AI001'; END IF;
+ IF d.delegation_id IS NOT NULL AND NOT EXISTS(SELECT 1 FROM semicolony.team_members WHERE member_id=m AND status='active') THEN RAISE EXCEPTION 'invalid_delegation' USING ERRCODE='AI004'; END IF;
+ IF p_caller_kind='agent' AND NOT EXISTS(SELECT 1 FROM semicolony.bot_status WHERE bot_id=p_caller_agent AND status IS DISTINCT FROM 'retired') THEN RAISE EXCEPTION 'action_item_not_owned' USING ERRCODE='AI001'; END IF;
+ IF p_expected_version IS NOT NULL AND a.version<>p_expected_version THEN RAISE EXCEPTION 'version_conflict' USING ERRCODE='AI003'; END IF;
+ IF p_patch ? 'dependency_ids' THEN
+   -- Serialize graph mutations to prevent concurrent edge insertions forming a cycle.
+   DELETE FROM semicolony.action_item_dependencies WHERE action_item_id=p_action_item_id;
+   FOR dep IN SELECT value::uuid FROM jsonb_array_elements_text(p_patch->'dependency_ids') LOOP
+     IF NOT semicolony.action_item_worker_visible(dep) THEN RAISE EXCEPTION 'dependency_not_found' USING ERRCODE='AI002'; END IF;
+     IF dep=p_action_item_id OR EXISTS(WITH RECURSIVE chain(id) AS (
+       SELECT dep UNION SELECT e.depends_on_action_item_id FROM semicolony.action_item_dependencies e JOIN chain c ON e.action_item_id=c.id
+     ) SELECT 1 FROM chain WHERE id=p_action_item_id) THEN RAISE EXCEPTION 'dependency_cycle' USING ERRCODE='22023'; END IF;
+     INSERT INTO semicolony.action_item_dependencies VALUES(p_action_item_id,dep,now()) ON CONFLICT DO NOTHING;
+   END LOOP;
+ END IF;
+ UPDATE semicolony.action_items SET
+   description=coalesce(p_patch->>'description',description),priority=coalesce(p_patch->>'priority',priority),
+   status=coalesce(p_patch->>'status',status),deadline=coalesce((p_patch->>'deadline')::date,deadline),
+   completed_at=CASE WHEN p_patch->>'status'='done' AND status<>'done' THEN now()
+     WHEN p_patch ? 'status' AND p_patch->>'status'<>'done' THEN NULL ELSE completed_at END,
+   metadata=CASE WHEN p_patch ? 'metadata' THEN metadata || (p_patch->'metadata') ELSE metadata END,
+   waiting_on_external=coalesce((p_patch->>'waiting_on_external')::boolean,waiting_on_external),
+   next_follow_up_at=CASE WHEN p_patch ? 'next_follow_up_at' THEN (p_patch->>'next_follow_up_at')::timestamptz ELSE next_follow_up_at END,
+   last_confirmed_at=CASE WHEN p_patch ? 'last_confirmed_at' THEN (p_patch->>'last_confirmed_at')::timestamptz ELSE last_confirmed_at END
+ WHERE action_item_id=p_action_item_id;
+ INSERT INTO semicolony.action_item_events(action_item_id,event_type,actor_kind,actor_member_id,actor_agent_id,payload)
+ VALUES(p_action_item_id,CASE WHEN p_patch->>'status'='done' THEN 'closed' WHEN p_patch ? 'status' THEN 'status_changed' WHEN p_patch ? 'deadline' THEN 'deadline_changed' ELSE 'noted' END,
+   CASE WHEN p_caller_kind='agent' THEN 'agent' ELSE 'human' END,m,CASE WHEN p_caller_kind='agent' THEN p_caller_agent END,
+   jsonb_build_object('patch',p_patch,'previous_version',a.version,'version',a.version+1,'delegation_id',d.delegation_id,'source_ref',v_source));
+ IF d.delegation_id IS NOT NULL THEN
+   IF d.expires_at<=clock_timestamp() THEN RAISE EXCEPTION 'invalid_delegation' USING ERRCODE='AI004'; END IF;
+   UPDATE semicolony.action_delegations SET consumed_at=clock_timestamp() WHERE delegation_id=d.delegation_id;
+ END IF;
+ RETURN p_action_item_id;
+END $$;
+
+-- Legacy worker callers keep their positional signature and absence semantics.
+CREATE OR REPLACE FUNCTION semicolony.update_action_item(p_action_item_id uuid,p_caller_kind text,p_caller_member text,p_caller_agent text,p_status text,p_deadline date,p_note text,p_metadata jsonb)
+RETURNS uuid LANGUAGE plpgsql SECURITY DEFINER SET search_path=pg_catalog AS $$
+BEGIN RETURN semicolony.edit_action_item(p_action_item_id,p_caller_kind,p_caller_member,p_caller_agent,NULL,
+ coalesce((SELECT jsonb_object_agg(key,value) FROM jsonb_each(jsonb_build_object('status',p_status,'deadline',p_deadline,'note',p_note,'metadata',p_metadata)) WHERE value<>'null'::jsonb),'{}'::jsonb) || CASE WHEN p_status IS NULL AND p_deadline IS NULL AND p_note IS NULL AND p_metadata IS NULL THEN '{"note":null}'::jsonb ELSE '{}'::jsonb END,NULL); END $$;
+
+CREATE FUNCTION semicolony.action_slack_member(p_slack_user_id text) RETURNS text
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path=pg_catalog AS $$
+DECLARE d text;
+BEGIN
+ IF (SELECT count(*) FROM semicolony.team_members WHERE slack_user_id=p_slack_user_id AND status='active')<>1 THEN RAISE EXCEPTION 'slack_member_not_found' USING ERRCODE='AI001'; END IF;
+ SELECT domain INTO d FROM semicolony.team_members WHERE slack_user_id=p_slack_user_id AND status='active'; RETURN d;
+END $$;
+CREATE FUNCTION semicolony.issue_action_delegation(p_requester_slack_user_id text,p_actor_id text,
+ p_action_item_id uuid,p_expected_version bigint,p_patch jsonb,p_source_ref text,p_token_hash text,p_expires_at timestamptz)
+RETURNS uuid LANGUAGE plpgsql SECURITY DEFINER SET search_path=pg_catalog AS $$
+DECLARE m uuid; a semicolony.action_items%ROWTYPE; id uuid;
+BEGIN
+ PERFORM semicolony.validate_action_patch(p_patch);
+ SELECT member_id INTO m FROM semicolony.team_members WHERE domain=semicolony.action_slack_member(p_requester_slack_user_id);
+ SELECT * INTO a FROM semicolony.action_items WHERE action_item_id=p_action_item_id FOR UPDATE;
+ IF NOT FOUND OR NOT semicolony.action_item_worker_visible(p_action_item_id) THEN RAISE EXCEPTION 'action_item_not_found' USING ERRCODE='AI002'; END IF;
+ IF NOT coalesce(a.assignee_member_id=m OR a.sponsor_member_id=m,false) THEN RAISE EXCEPTION 'action_item_not_owned' USING ERRCODE='AI001'; END IF;
+ IF p_expected_version IS NULL OR a.version<>p_expected_version THEN RAISE EXCEPTION 'version_conflict' USING ERRCODE='AI003'; END IF;
+ IF p_expires_at IS NULL OR p_expires_at<=clock_timestamp() OR p_expires_at>clock_timestamp()+interval '15 minutes'
+   OR NOT EXISTS(SELECT 1 FROM semicolony.bot_status WHERE bot_id=p_actor_id AND status IS DISTINCT FROM 'retired') THEN RAISE EXCEPTION 'invalid_delegation' USING ERRCODE='AI004'; END IF;
+ INSERT INTO semicolony.action_delegations(token_hash,allowed_actor_id,requester_member_id,action_item_id,expected_version,patch,source_ref,expires_at)
+ VALUES(p_token_hash,p_actor_id,m,p_action_item_id,p_expected_version,p_patch,p_source_ref,p_expires_at) RETURNING delegation_id INTO id;
+ RETURN id;
+END $$;
+CREATE FUNCTION semicolony.apply_slack_action_update(p_requester_slack_user_id text,p_action_item_id uuid,
+ p_expected_version bigint,p_patch jsonb,p_source_ref text) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER SET search_path=pg_catalog AS $$
+DECLARE id uuid;
+BEGIN
+ IF p_expected_version IS NULL OR length(btrim(coalesce(p_source_ref,'')))=0 THEN RAISE EXCEPTION 'version and Slack source required' USING ERRCODE='22023'; END IF;
+ id:=semicolony.edit_action_item(p_action_item_id,'team-member',semicolony.action_slack_member(p_requester_slack_user_id),NULL,p_expected_version,p_patch);
+ INSERT INTO semicolony.action_item_events(action_item_id,event_type,actor_kind,actor_member_id,payload)
+ SELECT id,'noted','human',member_id,jsonb_build_object('source_ref',p_source_ref,'source_kind','slack') FROM semicolony.team_members WHERE domain=semicolony.action_slack_member(p_requester_slack_user_id);
+ RETURN id;
+END $$;
+
+-- Preserve migration 225 meeting identity and KB/provenance behavior. Each item
+-- has its own admission savepoint; a malformed sibling becomes a durable candidate.
+CREATE OR REPLACE FUNCTION semicolony.record_meeting(
+  p_title text,
+  p_meeting_date date,
+  p_meeting_type text,
+  p_adhoc_subtype text,
+  p_visibility text,
+  p_target_domain text,
+  p_attendees jsonb,
+  p_record_body text,
+  p_transcript text,
+  p_action_items jsonb,
+  p_record_source text,
+  p_worker_id text,
+  p_device_id text,
+  p_discussion_url text DEFAULT NULL,
+  p_discussion_number integer DEFAULT NULL
+)
+RETURNS TABLE(meeting_id uuid, kb_id bigint, action_item_ids uuid[], duplicate boolean)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_meeting_id uuid;
+  v_kb_id bigint;
+  v_existing uuid;
+  v_norm text;
+  v_sensitivity text;
+  v_sub_key text;
+  v_item jsonb;
+  v_item_id uuid;
+  v_preserved jsonb;
+  v_description text;
+  v_priority text;
+  v_project text;
+  v_candidate text;
+  v_assignee_kind text;
+  v_assignee_member text;
+  v_assignee_agent text;
+  v_external_contact text;
+  v_deadline date;
+  v_proposal jsonb;
+  v_reasons jsonb;
+  v_candidate_id uuid;
+  v_identity text;
+  v_candidate_ids uuid[] := '{}';
+  v_existing_candidate semicolony.action_item_candidates%ROWTYPE;
+BEGIN
+  IF p_title IS NULL OR length(btrim(p_title)) < 3 THEN
+    RAISE EXCEPTION 'title must be at least 3 characters';
+  END IF;
+  IF p_meeting_date IS NULL THEN
+    RAISE EXCEPTION 'meeting_date is required';
+  END IF;
+  IF p_visibility IS NULL OR p_visibility NOT IN ('team', 'restricted') THEN
+    RAISE EXCEPTION 'visibility must be team or restricted, got %', p_visibility;
+  END IF;
+  IF p_record_source IS NULL
+     OR p_record_source NOT IN ('slack-worker', 'operator', 'backfill-discussion') THEN
+    RAISE EXCEPTION 'invalid record_source %', p_record_source;
+  END IF;
+  IF p_record_body IS NULL OR length(btrim(p_record_body)) = 0 THEN
+    RAISE EXCEPTION 'record_body is required';
+  END IF;
+
+  v_norm := lower(regexp_replace(btrim(p_title), '\s+', ' ', 'g'));
+  v_sensitivity := CASE WHEN p_visibility = 'restricted' THEN 'restricted' ELSE 'internal' END;
+
+  -- Serialize all writers for one normalized meeting, including first insert.
+  PERFORM pg_advisory_xact_lock(hashtextextended(
+    'meeting:' || p_meeting_date::text || ':' || v_norm, 0));
+
+  SELECT m.meeting_id INTO v_existing
+    FROM semicolony.meetings m
+   WHERE m.meeting_date = p_meeting_date
+     AND lower(regexp_replace(m.title, '\s+', ' ', 'g')) = v_norm;
+
+  -- Discussion provenance from 202_meeting_record_discussion_provenance,
+  -- unchanged: COALESCE on update so a re-record that omits the link does not
+  -- erase one an earlier submission established, and both columns written on
+  -- insert.
+  IF v_existing IS NOT NULL THEN
+    UPDATE semicolony.meetings m
+       SET record_body = COALESCE(p_record_body, m.record_body),
+           mapped_transcript = COALESCE(p_transcript, m.mapped_transcript),
+           visibility = p_visibility,
+           record_source = p_record_source,
+           target_domain = COALESCE(p_target_domain, m.target_domain),
+           attendees = COALESCE(p_attendees, m.attendees),
+           discussion_url = COALESCE(p_discussion_url, m.discussion_url),
+           discussion_number = COALESCE(p_discussion_number, m.discussion_number),
+           updated_at = now()
+     WHERE m.meeting_id = v_existing;
+    v_meeting_id := v_existing;
+  ELSE
+    INSERT INTO semicolony.meetings (
+      meeting_id, title, meeting_type, adhoc_subtype, meeting_date, attendees,
+      visibility, record_body, mapped_transcript, record_source, target_domain,
+      transcription_status, speaker_map, discussion_url, discussion_number,
+      created_at, updated_at
+    ) VALUES (
+      gen_random_uuid(), btrim(p_title), p_meeting_type, p_adhoc_subtype, p_meeting_date,
+      COALESCE(p_attendees, '[]'::jsonb), p_visibility, p_record_body,
+      p_transcript, p_record_source, p_target_domain,
+      'completed', '{}'::jsonb, p_discussion_url, p_discussion_number, now(), now()
+    ) RETURNING meetings.meeting_id INTO v_meeting_id;
+  END IF;
+
+  v_sub_key := to_char(p_meeting_date, 'YYYY-MM-DD') || '-' || left(v_norm, 60);
+
+  INSERT INTO semicolony.knowledge_base (
+    domain, key, sub_key, content, metadata, created_by, created_at, updated_at
+  ) VALUES (
+    COALESCE(p_target_domain, 'semicolon'),
+    'meeting',
+    v_sub_key,
+    p_record_body,
+    jsonb_build_object(
+      'classification', jsonb_build_object('sensitivity', v_sensitivity),
+      'meeting_id', v_meeting_id,
+      'meeting_date', to_char(p_meeting_date, 'YYYY-MM-DD'),
+      'record_source', p_record_source
+    ),
+    COALESCE(p_worker_id, 'meeting-worker'),
+    now(), now()
+  )
+  ON CONFLICT (domain, key, sub_key) DO UPDATE
+    SET content = EXCLUDED.content,
+        metadata = semicolony.knowledge_base.metadata || EXCLUDED.metadata,
+        updated_at = now()
+  RETURNING semicolony.knowledge_base.kb_id INTO v_kb_id;
+
+
+  v_preserved := '[]';
+  IF jsonb_typeof(p_action_items)='array' THEN
+    FOR v_item IN SELECT value FROM jsonb_array_elements(p_action_items) LOOP
+      v_description := CASE WHEN jsonb_typeof(v_item->'description')='string' THEN btrim(v_item->>'description') ELSE '' END;
+      v_identity := coalesce(nullif(v_item->>'source_identity',''),encode(sha256(convert_to(
+        CASE WHEN v_description<>'' THEN lower(regexp_replace(v_description,'\s+',' ','g')) ELSE v_item::text END,'UTF8')),'hex'));
+      v_item_id := NULL;
+      SELECT a.action_item_id INTO v_item_id FROM semicolony.action_items a
+        WHERE a.meeting_id=v_meeting_id AND lower(regexp_replace(btrim(a.description),'\s+',' ','g'))=
+          lower(regexp_replace(v_description,'\s+',' ','g')) ORDER BY a.created_at,a.action_item_id LIMIT 1;
+      IF v_item_id IS NOT NULL THEN
+        v_preserved := v_preserved || jsonb_build_array(jsonb_build_object('action_item_id',v_item_id,'submitted',v_item,'reason','existing_followup_preserved'));
+        CONTINUE;
+      END IF;
+      v_project := coalesce(nullif(v_item->>'project_domain',''),nullif(v_item->>'target',''),nullif(p_target_domain,''));
+      v_assignee_member := nullif(v_item->>'assignee_member','');
+      v_assignee_agent := nullif(v_item->>'assignee_agent','');
+      v_candidate := coalesce(nullif(v_item->>'assignee',''),nullif(v_item->>'owner',''));
+      IF v_assignee_member IS NULL AND v_assignee_agent IS NULL AND v_candidate IS NOT NULL THEN
+        IF EXISTS(SELECT 1 FROM semicolony.team_members WHERE domain=v_candidate AND status='active') THEN v_assignee_member:=v_candidate;
+        ELSIF EXISTS(SELECT 1 FROM semicolony.bot_status WHERE bot_id=v_candidate AND status IS DISTINCT FROM 'retired') THEN v_assignee_agent:=v_candidate;
+        END IF;
+      END IF;
+      v_proposal := jsonb_strip_nulls(jsonb_build_object('description',v_item->'description','project_domain',v_project,
+        'deadline',v_item->>'deadline','assignee_member',v_assignee_member,'assignee_agent',v_assignee_agent,
+        'external_contact_id',v_item->>'external_contact_id','sponsor_member',v_item->>'sponsor_member',
+        'external_contact',CASE WHEN v_assignee_member IS NULL AND v_assignee_agent IS NULL THEN coalesce(nullif(v_item->>'external_contact',''),v_candidate) ELSE v_item->>'external_contact' END,
+        'priority',coalesce(v_item->>'priority','normal'),'metadata',jsonb_build_object('meeting_id',v_meeting_id,'classification',jsonb_build_object('sensitivity',v_sensitivity),'raw_item',v_item)));
+      v_candidate_id:=semicolony.create_action_candidate(v_proposal,'meeting',v_meeting_id::text,v_identity,'system',NULL,NULL,v_meeting_id);
+      v_candidate_ids:=array_append(v_candidate_ids,v_candidate_id);
+      SELECT * INTO v_existing_candidate FROM semicolony.action_item_candidates WHERE candidate_id=v_candidate_id;
+      IF v_existing_candidate.status<>'pending' OR v_existing_candidate.proposal IS DISTINCT FROM v_proposal THEN CONTINUE; END IF;
+      v_reasons:=semicolony.action_candidate_reasons(v_proposal);
+      IF v_reasons='[]'::jsonb THEN
+        BEGIN
+          PERFORM semicolony.resolve_action_candidate(v_candidate_id,'accept',v_existing_candidate.version,v_proposal,
+            'Complete explicit meeting commitment','system',NULL,NULL);
+        EXCEPTION WHEN OTHERS THEN
+          -- Retain only SQLSTATE, never a raw database error/credential string.
+          UPDATE semicolony.action_item_candidates SET reasons=jsonb_build_array('admission_failed',SQLSTATE) WHERE candidate_id=v_candidate_id;
+        END;
+      END IF;
+    END LOOP;
+    UPDATE semicolony.meetings SET metadata=coalesce(metadata,'{}') || jsonb_build_object('meeting_import',
+      jsonb_build_object('candidate_ids',to_jsonb(v_candidate_ids),'preserved_action_items',v_preserved,
+        'preserved_count',jsonb_array_length(v_preserved),'submitted_count',jsonb_array_length(p_action_items),'recorded_at',now()))
+      WHERE meetings.meeting_id=v_meeting_id;
+  END IF;
+  RETURN QUERY SELECT v_meeting_id,v_kb_id,
+    ARRAY(SELECT a.action_item_id FROM semicolony.action_items a WHERE a.meeting_id=v_meeting_id ORDER BY a.created_at,a.action_item_id),
+    v_existing IS NOT NULL;
+END;
+$function$;
+
+-- Gateway cannot mint delegation. The hive service cannot call a generic editor.
+DO $$ BEGIN
+ IF NOT EXISTS(SELECT 1 FROM pg_roles WHERE rolname='semo_ops_action_loop') THEN
+   CREATE ROLE semo_ops_action_loop NOLOGIN NOINHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
+ END IF;
+END $$;
+-- The runner retargets qualified identifiers, not bare GRANT schema names.
+-- Resolve the namespace through the retargeted ledger relation itself.
+DO $$ DECLARE target_schema text;
+BEGIN
+ SELECT n.nspname INTO target_schema FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid=c.relnamespace
+   WHERE c.oid='semicolony.action_items'::regclass;
+ EXECUTE format('GRANT USAGE ON SCHEMA %I TO semo_ops_action_loop',target_schema);
+END $$;
+GRANT SELECT ON semicolony.action_items,semicolony.action_item_events,semicolony.team_members,
+ semicolony.meetings,semicolony.action_item_candidates,semicolony.action_external_contacts,
+ semicolony.action_item_dependencies TO semo_ops_action_loop;
+GRANT SELECT ON semicolony.action_item_candidates,semicolony.action_external_contacts,semicolony.action_item_dependencies TO sc_app;
+GRANT ALL ON semicolony.action_item_candidates,semicolony.action_external_contacts,semicolony.action_item_dependencies,semicolony.action_delegations TO app;
+DO $$ BEGIN
+ IF EXISTS(SELECT 1 FROM pg_roles WHERE rolname='sc_fleet_board') THEN
+  GRANT SELECT ON semicolony.action_item_candidates,semicolony.action_external_contacts,semicolony.action_item_dependencies TO sc_fleet_board;
+ END IF;
+END $$;
+REVOKE ALL ON FUNCTION semicolony.bump_action_item_version(),semicolony.action_candidate_reasons(jsonb),
+ semicolony.validate_action_patch(jsonb),semicolony.action_slack_member(text),
+ semicolony.create_action_candidate(jsonb,text,text,text,text,text,text,uuid),
+ semicolony.resolve_action_candidate(uuid,text,bigint,jsonb,text,text,text,text),
+ semicolony.edit_action_item(uuid,text,text,text,bigint,jsonb,text),
+ semicolony.issue_action_delegation(text,text,uuid,bigint,jsonb,text,text,timestamptz),
+ semicolony.apply_slack_action_update(text,uuid,bigint,jsonb,text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION semicolony.create_action_candidate(jsonb,text,text,text,text,text,text,uuid),
+ semicolony.resolve_action_candidate(uuid,text,bigint,jsonb,text,text,text,text),
+ semicolony.edit_action_item(uuid,text,text,text,bigint,jsonb,text) TO sc_app,app;
+GRANT EXECUTE ON FUNCTION semicolony.issue_action_delegation(text,text,uuid,bigint,jsonb,text,text,timestamptz),
+ semicolony.apply_slack_action_update(text,uuid,bigint,jsonb,text) TO semo_ops_action_loop,app;
+
+CREATE FUNCTION semicolony.create_action_item_v2(
+  p_description        text,
+  p_project_domain     text,
+  p_deadline           date,
+  p_assignee_kind      text,
+  p_assignee_member    text,
+  p_assignee_agent     text,
+  p_assignee_device    text,
+  p_priority           text,
+  p_source_kind        text,
+  p_source_ref         text,
+  p_related_url        text,
+  p_external_contact   text,
+  p_metadata           jsonb,
+  p_origin_surface     text,
+  p_origin_actor_kind  text,
+  p_origin_member      text,
+  p_origin_agent       text,
+  p_origin_device      text,
+  p_origin_harness     text,
+  p_origin_session_key text,
+  p_external_contact_id uuid,
+  p_sponsor_member text
+) RETURNS uuid LANGUAGE plpgsql SECURITY DEFINER SET search_path=pg_catalog AS $$
+DECLARE id uuid; sponsor uuid; contact uuid := p_external_contact_id;
+BEGIN
+ IF contact IS NOT NULL AND NOT semicolony.action_contact_worker_visible(contact::text) THEN RAISE EXCEPTION 'external_contact_not_found' USING ERRCODE='AI002'; END IF;
+ IF p_sponsor_member IS NOT NULL THEN
+   SELECT member_id INTO sponsor FROM semicolony.team_members WHERE domain=p_sponsor_member AND status='active';
+   IF sponsor IS NULL THEN RAISE EXCEPTION 'unknown or inactive sponsor' USING ERRCODE='22023'; END IF;
+ END IF;
+ IF p_external_contact_id IS NOT NULL AND (sponsor IS NULL OR p_assignee_kind<>'unassigned') THEN RAISE EXCEPTION 'external work requires internal sponsor' USING ERRCODE='22023'; END IF;
+ IF contact IS NULL AND p_external_contact IS NOT NULL AND sponsor IS NOT NULL THEN
+   INSERT INTO semicolony.action_external_contacts(display_name,metadata) VALUES(p_external_contact,jsonb_build_object('classification',coalesce(p_metadata->'classification','{}'::jsonb))) RETURNING external_contact_id INTO contact;
+ END IF;
+ IF contact IS NOT NULL AND (sponsor IS NULL OR p_assignee_kind<>'unassigned') THEN RAISE EXCEPTION 'external work requires internal sponsor' USING ERRCODE='22023'; END IF;
+ id:=semicolony.create_action_item(p_description,p_project_domain,p_deadline,p_assignee_kind,p_assignee_member,p_assignee_agent,p_assignee_device,p_priority,p_source_kind,p_source_ref,p_related_url,p_external_contact,p_metadata,p_origin_surface,p_origin_actor_kind,p_origin_member,p_origin_agent,p_origin_device,p_origin_harness,p_origin_session_key);
+ UPDATE semicolony.action_items SET external_contact_id=contact,sponsor_member_id=sponsor,
+   waiting_on_external=(contact IS NOT NULL) WHERE action_item_id=id;
+ RETURN id;
+END $$;
+REVOKE ALL ON FUNCTION semicolony.create_action_item_v2(text,text,date,text,text,text,text,text,text,text,text,text,jsonb,text,text,text,text,text,text,text,uuid,text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION semicolony.create_action_item_v2(text,text,date,text,text,text,text,text,text,text,text,text,jsonb,text,text,text,text,text,text,text,uuid,text) TO sc_app,app;
+
+-- Authenticated Slack confirmation uses the same candidate owner boundary.
+CREATE FUNCTION semicolony.apply_slack_candidate_resolution(p_requester_slack_user_id text,p_candidate_id uuid,
+ p_decision text,p_expected_version bigint,p_fields jsonb,p_note text,p_source_ref text) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER SET search_path=pg_catalog AS $$
+DECLARE id uuid;
+BEGIN
+ IF p_expected_version IS NULL OR length(btrim(coalesce(p_source_ref,'')))=0 THEN RAISE EXCEPTION 'version and Slack source required' USING ERRCODE='22023'; END IF;
+ id:=semicolony.resolve_action_candidate(p_candidate_id,p_decision,p_expected_version,p_fields,p_note,
+   'team-member',semicolony.action_slack_member(p_requester_slack_user_id),NULL);
+ UPDATE semicolony.action_item_candidates SET resolution_source_ref=coalesce(resolution_source_ref,p_source_ref) WHERE candidate_id=p_candidate_id;
+ RETURN id;
+END $$;
+REVOKE ALL ON FUNCTION semicolony.apply_slack_candidate_resolution(text,uuid,text,bigint,jsonb,text,text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION semicolony.apply_slack_candidate_resolution(text,uuid,text,bigint,jsonb,text,text) TO semo_ops_action_loop,app;
+
+REVOKE ALL ON FUNCTION semicolony.action_item_worker_visible(uuid),semicolony.action_candidate_worker_visible(uuid),semicolony.action_contact_worker_visible(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION semicolony.action_item_worker_visible(uuid),semicolony.action_candidate_worker_visible(uuid),semicolony.action_contact_worker_visible(text) TO sc_app,app,semo_ops_action_loop;
+DO $$ BEGIN IF EXISTS(SELECT 1 FROM pg_roles WHERE rolname='sc_fleet_board') THEN
+ GRANT EXECUTE ON FUNCTION semicolony.action_item_worker_visible(uuid),semicolony.action_candidate_worker_visible(uuid),semicolony.action_contact_worker_visible(text) TO sc_fleet_board;
+END IF; END $$;