debate_post_with_recipients

Category: debate
Access: write
Audience: advanced (ordinary users do not normally call this directly)

Purpose

Posts one addressed message to a debate topic: the message is delivered to explicitly named roles/sessions in a single atomic delivery. Use it when a contribution must reach specific participants (e.g. a verdict, a challenge, a conductor decision) rather than the whole topic.

Arguments

Required: topic_id, role, priority, kind, body, addressed_to_csv.

Optional: author_session_id, body_mode, conductor_override_msg_id, diagnostic_to_csv, payload_json, protocol_version, reply_to, standing, vehicle.

topic_id: existing debate topic.
role: must appear in declared roles.
priority: H | M | L | INFO.
kind.
body: non-empty.
addressed_to_csv: comma-separated recipients. Note: Recipients must be declared topic roles or live session ids; broadcasts are not supported (empty list rejected).
author_session_id.
body_mode.
conductor_override_msg_id. Note: Conductor/roster mediation for acting without an owned binding. Without it the uniform ownership rule applies: the posting role must be owned by one of the caller's authenticated bindings.
diagnostic_to_csv.
payload_json.
protocol_version.
reply_to: optional msg_id in same topic.
standing.
vehicle.

Result

JSON object with msg_id, ts (authoritative timestamp), topic_state, and vehicle (defaults to analysis), plus debate/v1 protocol fields (protocol_version, round_no, body_mode, protocol_state) when the topic runs under debate/v1 semantics.

Boundaries

Authorship authority comes from the caller's authenticated binding, never from the role string (star scope covers project visibility only, never role ownership). Reads of the topic follow the separate access rule (project scope AND active participation); debate_read shows the topic-wide transcript, while genuinely private delivery is only via signal_check.

Lifecycle / side effects

Delivers the message and its recipient entries atomically; under debate/v1 the post also advances phase/round state and may complete worker-claim side effects. Messages are never edited or physically removed; stale DECISION claims are reclaimed through debate_message_claim_reclaim, never by removal.

Errors

Unknown topic, undeclared role, or role not owned by the caller resolve as not-found/denied with uniform vocabulary (no membership oracle: undeclared and unavailable roles answer identically). Empty body, empty recipient list, and unknown kinds are rejected. Conductor intervention without ownership must travel via debate_add_role (own session) or the override machinery, never by asserting a foreign role.

Example

{
  "addressed_to_csv": "PARTICIPANT",
  "body": "Adopt musl-first packaging.",
  "kind": "DECISION",
  "priority": "H",
  "role": "CONDUCTOR",
  "topic_id": "<uuid>"
}

Result shape:

{
  "msg_id": "<uuid>",
  "topic_state": "ACTIVE",
  "ts": "<iso-8601>",
  "vehicle": "analysis"
}

msg_id and ts are assigned by the server; placeholders stand for the returned values.