feat: import Chinese-localized Buzz source snapshot

Signed-off-by: cls_宁波本机 <908705107@qq.com>

migrations/0001_initial_schema.sql

@@ -0,0 +1,636 @@
+-- Buzz initial Postgres schema — multi-tenant.
+--
+-- Source of truth for fresh database setup. This is a clean, from-scratch
+-- schema in which `community_id` is a first-class, server-resolved key on
+-- every tenant-scoped row. It is NOT additive over the single-community
+-- schema; the rewrite replaces it. Existing single-community deployments
+-- migrate via the documented backfill migration (0002), which assigns all
+-- pre-existing rows to one default community.
+--
+-- The governing contract is docs/multi-tenant-conformance.md. Every table
+-- below cites the conformance surface it implements. The invariant behind the
+-- whole schema (conformance "row zero"): a request's community is resolved
+-- from the connection host by the server, never supplied by the client, and
+-- every scoped row carries that immutable `community_id`.
+--
+-- Migration-lint obligations enforced by the Lane 0 lint harness:
+--   1. Every tenant-scoped table has `community_id NOT NULL`.
+--   2. No UNIQUE / PRIMARY KEY / FK on a scoped table is observable across
+--      communities: each leads with `community_id` (or, for child rows whose
+--      parent already pins the community, joins carry the community tuple).
+--   3. `channels.community_id` is immutable (trigger below; no UPDATE path).
+--   4. Operator-global tables are named in the explicit allowlist, not implied.
+
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+-- ── Custom types ──────────────────────────────────────────────────────────────
+
+CREATE TYPE channel_type AS ENUM ('stream', 'forum', 'dm', 'workflow');
+CREATE TYPE channel_visibility AS ENUM ('open', 'private');
+CREATE TYPE member_role AS ENUM ('owner', 'admin', 'member', 'guest', 'bot');
+CREATE TYPE workflow_status AS ENUM ('active', 'disabled', 'archived');
+CREATE TYPE run_status AS ENUM ('pending', 'running', 'waiting_approval', 'completed', 'failed', 'cancelled');
+CREATE TYPE approval_status AS ENUM ('pending', 'granted', 'denied', 'expired');
+CREATE TYPE delivery_method AS ENUM ('webhook', 'websocket');
+CREATE TYPE subscription_status AS ENUM ('active', 'paused', 'deleted');
+CREATE TYPE pause_reason AS ENUM ('user', 'system', 'rate_limit');
+CREATE TYPE channel_add_policy AS ENUM ('anyone', 'owner_only', 'nobody');
+
+-- ── Communities ───────────────────────────────────────────────────────────────
+-- Conformance: row zero (host binding). The host map. `resolve_host(host)`
+-- reads exactly one row here to mint the request's TenantContext. This table
+-- is OPERATOR-GLOBAL: it is the registry of tenants, not itself tenant-scoped,
+-- so it carries no `community_id` of its own (its `id` IS the community key).
+-- Listed in the lint allowlist as operator-global.
+--
+-- Host normalization (Lane 0 contract): `host` is stored already-normalized —
+-- ASCII-lowercased, trailing dot stripped, default port omitted. The UNIQUE is
+-- on `lower(host)` belt-and-suspenders so `Relay.Example` and `relay.example`
+-- can never become two tenants even if a writer forgets to normalize.
+-- `resolve_host()` (buzz-core) applies the identical normalization before
+-- lookup, so resolution and storage agree by construction.
+
+CREATE TABLE communities (
+    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    host            VARCHAR(255) NOT NULL,
+    signing_key     BYTEA,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT chk_communities_id_not_nil CHECK (id <> '00000000-0000-0000-0000-000000000000'::uuid)
+);
+
+CREATE UNIQUE INDEX idx_communities_host ON communities (lower(host));
+
+-- ── Channels ──────────────────────────────────────────────────────────────────
+-- Conformance: "Channels and channel membership". `community_id` immutable.
+-- Channel UUIDs stay valid wire identifiers, but they are NOT globally unique:
+-- the PK is `(community_id, id)`, so the same UUID may legitimately exist in two
+-- communities (conformance lists "same channel UUID collision in two
+-- communities" as a required isolation test). Handlers always carry `ctx`, so
+-- `(ctx.community, h)` names exactly one channel; a client-supplied `h` can
+-- never reach another community's channel.
+
+CREATE TABLE channels (
+    id              UUID NOT NULL DEFAULT gen_random_uuid(),
+    community_id    UUID NOT NULL REFERENCES communities(id),
+    name            VARCHAR(255) NOT NULL,
+    channel_type    channel_type NOT NULL DEFAULT 'stream',
+    visibility      channel_visibility NOT NULL DEFAULT 'open',
+    description     TEXT,
+    canvas          TEXT,
+    created_by      BYTEA NOT NULL,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    archived_at     TIMESTAMPTZ,
+    deleted_at      TIMESTAMPTZ,
+    nip29_group_id  VARCHAR(255),
+    topic_required  BOOLEAN NOT NULL DEFAULT FALSE,
+    max_members     INT,
+    topic           TEXT,
+    topic_set_by    BYTEA,
+    topic_set_at    TIMESTAMPTZ,
+    purpose         TEXT,
+    purpose_set_by  BYTEA,
+    purpose_set_at  TIMESTAMPTZ,
+    participant_hash BYTEA,
+    ttl_seconds     INT,
+    ttl_deadline    TIMESTAMPTZ,
+    PRIMARY KEY (community_id, id),
+    CONSTRAINT chk_channels_id_not_nil CHECK (id <> '00000000-0000-0000-0000-000000000000'::uuid)
+);
+
+-- nip29 group id and DM participant hash are unique WITHIN a community, not globally.
+CREATE UNIQUE INDEX idx_channels_nip29_group ON channels (community_id, nip29_group_id)
+    WHERE nip29_group_id IS NOT NULL;
+CREATE UNIQUE INDEX idx_channels_dm_hash ON channels (community_id, participant_hash)
+    WHERE participant_hash IS NOT NULL;
+CREATE INDEX idx_channels_community_type ON channels (community_id, channel_type);
+CREATE INDEX idx_channels_community_visibility ON channels (community_id, visibility);
+CREATE INDEX idx_channels_created_by ON channels (community_id, created_by);
+CREATE INDEX idx_channels_ttl_expiry ON channels (ttl_deadline)
+    WHERE ttl_seconds IS NOT NULL AND archived_at IS NULL AND deleted_at IS NULL;
+
+-- channels.community_id is immutable: a channel can never be re-tenanted.
+-- (Conformance: "Migration lint forbids channel re-tenanting except through an
+-- explicitly modeled admission path." We have no such path, so: hard block.)
+CREATE FUNCTION channels_community_id_immutable() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id THEN
+        RAISE EXCEPTION 'channels.community_id is immutable (channel % cannot be re-tenanted)', OLD.id
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER trg_channels_community_id_immutable
+    BEFORE UPDATE ON channels
+    FOR EACH ROW EXECUTE FUNCTION channels_community_id_immutable();
+
+-- ── Channel members ───────────────────────────────────────────────────────────
+-- Conformance: "Channels and channel membership". PK leads with community_id.
+
+CREATE TABLE channel_members (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    channel_id  UUID NOT NULL,
+    pubkey      BYTEA NOT NULL,
+    role        member_role NOT NULL DEFAULT 'member',
+    joined_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    invited_by  BYTEA,
+    removed_at  TIMESTAMPTZ,
+    removed_by  BYTEA,
+    hidden_at   TIMESTAMPTZ,
+    PRIMARY KEY (community_id, channel_id, pubkey),
+    FOREIGN KEY (community_id, channel_id)
+        REFERENCES channels (community_id, id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_channel_members_pubkey ON channel_members (community_id, pubkey)
+    WHERE removed_at IS NULL;
+
+-- ── Users ─────────────────────────────────────────────────────────────────────
+-- Conformance: "Users, profiles, NIP-05, and user search". One profile per
+-- (community, pubkey): the same key reposts kind:0 in each community it joins.
+
+CREATE TABLE users (
+    community_id        UUID NOT NULL REFERENCES communities(id),
+    pubkey              BYTEA NOT NULL,
+    nip05_handle        VARCHAR(255),
+    display_name        VARCHAR(255),
+    avatar_url          TEXT,
+    about               TEXT,
+    agent_type          VARCHAR(255),
+    capabilities        JSONB,
+    okta_user_id        VARCHAR(255),
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    deactivated_at      TIMESTAMPTZ,
+    metadata_event_id   BYTEA,
+    agent_owner_pubkey  BYTEA,
+    channel_add_policy  channel_add_policy NOT NULL DEFAULT 'anyone',
+    PRIMARY KEY (community_id, pubkey),
+    CONSTRAINT chk_users_pubkey_len CHECK (LENGTH(pubkey) = 32),
+    -- agent owner is a user in the SAME community.
+    FOREIGN KEY (community_id, agent_owner_pubkey)
+        REFERENCES users (community_id, pubkey) ON DELETE SET NULL
+);
+
+-- NIP-05 handle and Okta id unique within a community, not globally.
+CREATE UNIQUE INDEX idx_users_nip05 ON users (community_id, lower(nip05_handle))
+    WHERE nip05_handle IS NOT NULL;
+CREATE UNIQUE INDEX idx_users_okta ON users (community_id, okta_user_id)
+    WHERE okta_user_id IS NOT NULL;
+
+-- ── Events (partitioned by month on created_at) ──────────────────────────────
+-- Conformance: "Channel-less global events and DMs". `community_id` leads the
+-- PK and every hot-path index. Partition stays BY RANGE (created_at) — the
+-- monthly partition manager is unchanged (Max's call, plan §5/Lane0 contract).
+-- Cross-community dedup: same signed event may exist in two communities;
+-- (community_id, created_at, id) dedupes within one, allows across.
+
+CREATE TABLE events (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    id          BYTEA NOT NULL,
+    pubkey      BYTEA NOT NULL,
+    created_at  TIMESTAMPTZ NOT NULL,
+    kind        INT NOT NULL,
+    tags        JSONB NOT NULL,
+    content     TEXT NOT NULL,
+    -- Full-text search vector (Typesense → Postgres FTS). Generated/STORED so
+    -- it is a single source of truth — no sidecar indexer to keep coherent
+    -- (Quinn option A, Lane-0 call). 'simple' config = no stemming/stopwords,
+    -- matching the existing substring-ish search semantics; the search lane can
+    -- revisit the config behind evidence. Tenant scoping is by the
+    -- community-leading btree filters BitmapAnd-ed with the GIN probe, so the
+    -- GIN index itself stays the minimal `GIN (search_tsv)` (Max's caveat:
+    -- avoid btree_gin unless EXPLAIN proves it buys something).
+    --
+    -- Privacy kind exclusions (parity with the pre-rewrite Typesense feed —
+    -- old relay's `handlers/event.rs:287-290` skip set):
+    --   1059   = KIND_GIFT_WRAP        (NIP-17 ciphertext)
+    --   30300  = KIND_EVENT_REMINDER   (AUTHOR_ONLY_KINDS — defense in depth)
+    --   30622  = KIND_DM_VISIBILITY    (per-viewer private hide state)
+    --   44100  = KIND_MEMBER_ADDED_NOTIFICATION  (p-gated membership notice)
+    --   44101  = KIND_MEMBER_REMOVED_NOTIFICATION (p-gated membership notice)
+    -- NULL tsvector never matches `@@`, so excluded rows are storage-level
+    -- unsearchable. Constants kept in `buzz_core::kind` (KIND_GIFT_WRAP,
+    -- KIND_EVENT_REMINDER, KIND_DM_VISIBILITY,
+    -- KIND_MEMBER_ADDED_NOTIFICATION, KIND_MEMBER_REMOVED_NOTIFICATION); inlined
+    -- here because a sqlx
+    -- migration is frozen SQL and cannot import the Rust constant. If a new
+    -- privacy-sensitive kind is added there, update this list and add a
+    -- regression test in `buzz-search/tests/fts_integration.rs`.
+    search_tsv  TSVECTOR GENERATED ALWAYS AS (
+        CASE WHEN kind IN (1059, 30300, 30622, 44100, 44101) THEN NULL::tsvector
+             ELSE to_tsvector('simple', content)
+        END
+    ) STORED,
+    sig         BYTEA NOT NULL,
+    received_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    channel_id  UUID,
+    deleted_at  TIMESTAMPTZ,
+    d_tag       TEXT,
+    not_before  BIGINT,
+    delivered_at BIGINT,
+    PRIMARY KEY (community_id, created_at, id)
+) PARTITION BY RANGE (created_at);
+
+CREATE TABLE events_p_past PARTITION OF events
+    FOR VALUES FROM (MINVALUE) TO ('2026-01-01');
+CREATE TABLE events_p2026_01 PARTITION OF events
+    FOR VALUES FROM ('2026-01-01') TO ('2026-02-01');
+CREATE TABLE events_p2026_02 PARTITION OF events
+    FOR VALUES FROM ('2026-02-01') TO ('2026-03-01');
+CREATE TABLE events_p2026_03 PARTITION OF events
+    FOR VALUES FROM ('2026-03-01') TO ('2026-04-01');
+CREATE TABLE events_p2026_04 PARTITION OF events
+    FOR VALUES FROM ('2026-04-01') TO ('2026-05-01');
+CREATE TABLE events_p2026_05 PARTITION OF events
+    FOR VALUES FROM ('2026-05-01') TO ('2026-06-01');
+CREATE TABLE events_p2026_06 PARTITION OF events
+    FOR VALUES FROM ('2026-06-01') TO ('2026-07-01');
+CREATE TABLE events_p_future PARTITION OF events
+    FOR VALUES FROM ('2026-07-01') TO (MAXVALUE);
+
+-- Direct id lookup: the PK can't serve `WHERE id=$1` because created_at sits
+-- between community_id and id. This index makes the scoped form
+-- `WHERE community_id=$ AND id=$` index-served, not a partition scan.
+CREATE INDEX idx_events_community_id ON events (community_id, id, created_at DESC);
+-- Hot-path indexes, all community-leading.
+CREATE INDEX idx_events_community_channel_created
+    ON events (community_id, channel_id, created_at DESC, id);
+CREATE INDEX idx_events_community_pubkey_kind_created
+    ON events (community_id, pubkey, kind, created_at DESC, id);
+CREATE INDEX idx_events_community_kind_created
+    ON events (community_id, kind, created_at DESC, id);
+CREATE INDEX idx_events_community_deleted ON events (community_id, deleted_at);
+-- Addressable (replaceable) and NIP-33 parameterized lookups.
+CREATE INDEX idx_events_addressable
+    ON events (community_id, kind, pubkey, channel_id, deleted_at);
+CREATE INDEX idx_events_parameterized
+    ON events (community_id, kind, pubkey, d_tag, created_at DESC, id)
+    WHERE d_tag IS NOT NULL AND deleted_at IS NULL;
+CREATE INDEX idx_events_not_before ON events (community_id, not_before)
+    WHERE not_before IS NOT NULL AND deleted_at IS NULL AND delivered_at IS NULL;
+-- Full-text search. Minimal GIN over the generated tsvector; community scoping
+-- is supplied by the community-leading btree filters above (BitmapAnd), so this
+-- stays a single-column GIN. The search lane confirms the final spelling with
+-- EXPLAIN before its work lands (Quinn option A; Max's index-spelling caveat).
+CREATE INDEX idx_events_search_tsv ON events USING GIN (search_tsv);
+
+-- ── Event mentions ────────────────────────────────────────────────────────────
+-- Conformance: "Channel-less global events and DMs" (#p fan-out). The join to
+-- events MUST carry the community tuple (e.community_id = m.community_id AND
+-- e.id = m.event_id) — bare e.id = m.event_id would leak cross-community
+-- mentions (Max, verified at event.rs:222).
+
+CREATE TABLE event_mentions (
+    community_id        UUID NOT NULL REFERENCES communities(id),
+    pubkey_hex          VARCHAR(64) NOT NULL,
+    event_id            BYTEA NOT NULL,
+    event_created_at    TIMESTAMPTZ NOT NULL,
+    channel_id          UUID,
+    event_kind          INT,
+    PRIMARY KEY (community_id, pubkey_hex, event_id)
+);
+
+CREATE INDEX idx_event_mentions_pubkey_created
+    ON event_mentions (community_id, pubkey_hex, event_created_at DESC);
+CREATE INDEX idx_event_mentions_pubkey_kind_created
+    ON event_mentions (community_id, pubkey_hex, event_kind, event_created_at DESC);
+
+-- ── Subscriptions ─────────────────────────────────────────────────────────────
+-- Conformance: "Mesh, agents, ACP/MCP, and CLI" (persisted subscriptions).
+
+CREATE TABLE subscriptions (
+    community_id        UUID NOT NULL REFERENCES communities(id),
+    id                  VARCHAR(255) NOT NULL,
+    owner_pubkey        BYTEA NOT NULL,
+    filter_kinds        JSONB,
+    filter_authors      JSONB,
+    filter_channel_ids  JSONB,
+    filter_since        TIMESTAMPTZ,
+    filter_until        TIMESTAMPTZ,
+    delivery_method     delivery_method NOT NULL DEFAULT 'webhook',
+    delivery_url        TEXT,
+    status              subscription_status NOT NULL DEFAULT 'active',
+    pause_reason        pause_reason,
+    delivered_count     BIGINT NOT NULL DEFAULT 0,
+    error_count         BIGINT NOT NULL DEFAULT 0,
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (community_id, id),
+    FOREIGN KEY (community_id, owner_pubkey) REFERENCES users (community_id, pubkey)
+);
+
+-- ── Delivery log (partitioned by month on delivered_at) ──────────────────────
+-- Conformance: subscription delivery audit. community_id carried for tenant
+-- attribution; child of subscriptions.
+
+CREATE TABLE delivery_log (
+    community_id    UUID NOT NULL REFERENCES communities(id),
+    id              BIGINT GENERATED ALWAYS AS IDENTITY,
+    subscription_id VARCHAR(255),
+    event_id        BYTEA,
+    method          delivery_method,
+    delivered_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    success         BOOLEAN,
+    http_status     INT,
+    error_message   TEXT,
+    attempt_number  INT DEFAULT 1,
+    PRIMARY KEY (delivered_at, id)
+) PARTITION BY RANGE (delivered_at);
+
+CREATE TABLE delivery_log_p_past PARTITION OF delivery_log
+    FOR VALUES FROM (MINVALUE) TO ('2026-03-01');
+CREATE TABLE delivery_log_p2026_03 PARTITION OF delivery_log
+    FOR VALUES FROM ('2026-03-01') TO ('2026-04-01');
+CREATE TABLE delivery_log_p2026_04 PARTITION OF delivery_log
+    FOR VALUES FROM ('2026-04-01') TO ('2026-05-01');
+CREATE TABLE delivery_log_p2026_05 PARTITION OF delivery_log
+    FOR VALUES FROM ('2026-05-01') TO ('2026-06-01');
+CREATE TABLE delivery_log_p2026_06 PARTITION OF delivery_log
+    FOR VALUES FROM ('2026-06-01') TO ('2026-07-01');
+CREATE TABLE delivery_log_p_future PARTITION OF delivery_log
+    FOR VALUES FROM ('2026-07-01') TO (MAXVALUE);
+
+CREATE INDEX idx_delivery_log_community_sub ON delivery_log (community_id, subscription_id);
+
+-- ── Workflows ─────────────────────────────────────────────────────────────────
+-- Conformance: "Workflows, runs, approvals, webhooks, schedules". Definition's
+-- community fixed at create from req.community; runs/approvals inherit it.
+
+CREATE TABLE workflows (
+    community_id    UUID NOT NULL REFERENCES communities(id),
+    id              UUID NOT NULL DEFAULT gen_random_uuid(),
+    name            VARCHAR(255) NOT NULL,
+    owner_pubkey    BYTEA NOT NULL,
+    channel_id      UUID,
+    definition      JSONB NOT NULL,
+    definition_hash BYTEA NOT NULL,
+    status          workflow_status NOT NULL DEFAULT 'active',
+    enabled         BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (community_id, id),
+    FOREIGN KEY (community_id, owner_pubkey) REFERENCES users (community_id, pubkey),
+    FOREIGN KEY (community_id, channel_id) REFERENCES channels (community_id, id)
+);
+
+CREATE INDEX idx_workflows_channel_active ON workflows (community_id, channel_id, status, enabled);
+-- Scheduler scans enabled schedule workflows; community_id returned per row so
+-- side effects run under the owning tenant's context (Lane0 contract §4a.5).
+CREATE INDEX idx_workflows_enabled ON workflows (enabled, status) WHERE enabled;
+
+-- ── Workflow runs ─────────────────────────────────────────────────────────────
+
+CREATE TABLE workflow_runs (
+    community_id        UUID NOT NULL REFERENCES communities(id),
+    id                  UUID NOT NULL DEFAULT gen_random_uuid(),
+    workflow_id         UUID NOT NULL,
+    status              run_status NOT NULL DEFAULT 'pending',
+    trigger_event_id    BYTEA,
+    current_step        INT NOT NULL DEFAULT 0,
+    execution_trace     JSONB NOT NULL DEFAULT '[]',
+    trigger_context     JSONB,
+    started_at          TIMESTAMPTZ,
+    completed_at        TIMESTAMPTZ,
+    error_message       TEXT,
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (community_id, id),
+    FOREIGN KEY (community_id, workflow_id)
+        REFERENCES workflows (community_id, id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_workflow_runs_workflow ON workflow_runs (community_id, workflow_id);
+CREATE INDEX idx_workflow_runs_status ON workflow_runs (community_id, status);
+
+-- ── Workflow approvals ────────────────────────────────────────────────────────
+-- token-hash lookup scoped: approval token grants cannot act on another
+-- community's same hash (conformance).
+
+CREATE TABLE workflow_approvals (
+    community_id    UUID NOT NULL REFERENCES communities(id),
+    token           BYTEA NOT NULL,
+    workflow_id     UUID NOT NULL,
+    run_id          UUID NOT NULL,
+    step_id         VARCHAR(64) NOT NULL,
+    step_index      INT NOT NULL,
+    approver_spec   TEXT NOT NULL,
+    status          approval_status NOT NULL DEFAULT 'pending',
+    approver_pubkey BYTEA,
+    note            TEXT,
+    granted_at      TIMESTAMPTZ,
+    denied_at       TIMESTAMPTZ,
+    expires_at      TIMESTAMPTZ NOT NULL,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (community_id, token),
+    FOREIGN KEY (community_id, workflow_id)
+        REFERENCES workflows (community_id, id) ON DELETE CASCADE,
+    FOREIGN KEY (community_id, run_id)
+        REFERENCES workflow_runs (community_id, id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_workflow_approvals_workflow ON workflow_approvals (community_id, workflow_id);
+CREATE INDEX idx_workflow_approvals_run ON workflow_approvals (community_id, run_id);
+CREATE INDEX idx_workflow_approvals_status ON workflow_approvals (community_id, status);
+
+-- ── Scheduled workflow fires (cron claim) ─────────────────────────────────────
+-- Plan §5: the at-most-once cron fire claim. UNIQUE (community_id, workflow_id,
+-- scheduled_for) — only the pod that wins the claim insert creates the run.
+-- Restart-safe (DB-durable). community is server provenance: the scheduler passes
+-- workflow.community_id from list_all_enabled_workflows(), never a client input.
+-- workflow_id is NOT globally unique under the (community_id, id) workflow key, so
+-- the claim binds both community and id explicitly rather than resolving from id.
+-- workflow_run_id links the won claim to the run it created (audit; NULL until the
+-- post-insert attach, and stays NULL if run creation failed after a won claim).
+-- The FK to workflow_runs uses NO ACTION (not SET NULL): community_id is shared
+-- with the claim PK and is NOT NULL, so SET NULL is unimplementable here; a future
+-- delete of a still-linked run is blocked rather than orphaning the at-most-once
+-- claim row. workflow_runs are not pruned today, so this is a guardrail, not a path.
+
+CREATE TABLE scheduled_workflow_fires (
+    community_id    UUID NOT NULL REFERENCES communities(id),
+    workflow_id     UUID NOT NULL,
+    scheduled_for   TIMESTAMPTZ NOT NULL,
+    claimed_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    workflow_run_id UUID,
+    PRIMARY KEY (community_id, workflow_id, scheduled_for),
+    FOREIGN KEY (community_id, workflow_id)
+        REFERENCES workflows (community_id, id) ON DELETE CASCADE,
+    FOREIGN KEY (community_id, workflow_run_id)
+        REFERENCES workflow_runs (community_id, id) ON DELETE NO ACTION
+);
+
+-- The interval anchor reads MAX(scheduled_for) per workflow; the janitor prunes
+-- by claimed_at globally (operator concern). See plan §5 retention coupling.
+CREATE INDEX idx_scheduled_fires_claimed_at ON scheduled_workflow_fires (claimed_at);
+
+-- ── API tokens ────────────────────────────────────────────────────────────────
+-- Conformance: "API tokens and NIP-98 replay". token_hash uniqueness scoped to
+-- (community_id, token_hash); channel claims reference channels in same community.
+
+CREATE TABLE api_tokens (
+    community_id        UUID NOT NULL REFERENCES communities(id),
+    id                  UUID NOT NULL DEFAULT gen_random_uuid(),
+    token_hash          BYTEA NOT NULL,
+    owner_pubkey        BYTEA NOT NULL,
+    name                VARCHAR(255) NOT NULL,
+    scopes              JSONB NOT NULL,
+    channel_ids         JSONB,
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at          TIMESTAMPTZ,
+    last_used_at        TIMESTAMPTZ,
+    revoked_at          TIMESTAMPTZ,
+    revoked_by          BYTEA,
+    created_by_self_mint BOOLEAN NOT NULL DEFAULT FALSE,
+    PRIMARY KEY (community_id, id),
+    FOREIGN KEY (community_id, owner_pubkey) REFERENCES users (community_id, pubkey),
+    CONSTRAINT chk_api_tokens_hash_len CHECK (LENGTH(token_hash) = 32)
+);
+
+CREATE UNIQUE INDEX idx_api_tokens_hash ON api_tokens (community_id, token_hash);
+
+-- ── Rate limit violations ─────────────────────────────────────────────────────
+-- OPERATOR-GLOBAL: a deployment-health / abuse table, never tenant-observable.
+-- Listed in the lint allowlist. Carries community_id as an attribution label
+-- only (nullable, no uniqueness over it).
+
+CREATE TABLE rate_limit_violations (
+    id              BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    community_id    UUID,
+    pubkey          BYTEA,
+    violation_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    limit_type      VARCHAR(64),
+    limit_value     INT,
+    actual_value    INT,
+    action_taken    VARCHAR(64)
+);
+
+-- ── Thread metadata ───────────────────────────────────────────────────────────
+-- Conformance: thread lookups filter by community before event matching.
+
+CREATE TABLE thread_metadata (
+    community_id            UUID NOT NULL REFERENCES communities(id),
+    event_created_at        TIMESTAMPTZ NOT NULL,
+    event_id                BYTEA NOT NULL,
+    channel_id              UUID NOT NULL,
+    parent_event_id         BYTEA,
+    parent_event_created_at TIMESTAMPTZ,
+    root_event_id           BYTEA,
+    root_event_created_at   TIMESTAMPTZ,
+    depth                   INT NOT NULL DEFAULT 0,
+    reply_count             INT NOT NULL DEFAULT 0,
+    descendant_count        INT NOT NULL DEFAULT 0,
+    last_reply_at           TIMESTAMPTZ,
+    broadcast               BOOLEAN NOT NULL DEFAULT FALSE,
+    PRIMARY KEY (community_id, event_created_at, event_id),
+    FOREIGN KEY (community_id, channel_id) REFERENCES channels (community_id, id)
+);
+
+CREATE INDEX idx_thread_metadata_parent ON thread_metadata (community_id, parent_event_id);
+CREATE INDEX idx_thread_metadata_root ON thread_metadata (community_id, root_event_id);
+CREATE INDEX idx_thread_metadata_channel_depth
+    ON thread_metadata (community_id, channel_id, depth, event_created_at);
+CREATE INDEX idx_thread_metadata_event_id ON thread_metadata (community_id, event_id);
+
+-- ── Reactions ─────────────────────────────────────────────────────────────────
+-- Conformance: reactions filter by community before event/pubkey matching.
+
+CREATE TABLE reactions (
+    community_id        UUID NOT NULL REFERENCES communities(id),
+    event_created_at    TIMESTAMPTZ NOT NULL,
+    event_id            BYTEA NOT NULL,
+    pubkey              BYTEA NOT NULL,
+    emoji               VARCHAR(64) NOT NULL,
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    removed_at          TIMESTAMPTZ,
+    reaction_event_id   BYTEA,
+    PRIMARY KEY (community_id, event_created_at, event_id, pubkey, emoji)
+);
+
+CREATE INDEX idx_reactions_event ON reactions (community_id, event_id, event_created_at);
+CREATE INDEX idx_reactions_pubkey ON reactions (community_id, pubkey);
+-- A reaction's source event id is unique within a community.
+CREATE UNIQUE INDEX idx_reactions_source_event ON reactions (community_id, reaction_event_id)
+    WHERE reaction_event_id IS NOT NULL;
+
+-- ── Pubkey allowlist ──────────────────────────────────────────────────────────
+-- Conformance: "Relay membership, pubkey allowlist, archived identities".
+-- PK becomes (community_id, pubkey).
+
+CREATE TABLE pubkey_allowlist (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    pubkey      BYTEA NOT NULL,
+    added_by    BYTEA,
+    added_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    note        TEXT,
+    PRIMARY KEY (community_id, pubkey)
+);
+
+-- ── Relay members (NIP-43) ────────────────────────────────────────────────────
+-- Conformance: membership gate, community-scoped. pubkey stored as hex TEXT
+-- (unchanged wire form). PK (community_id, pubkey).
+
+CREATE TABLE relay_members (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    pubkey      TEXT NOT NULL,
+    role        TEXT NOT NULL CHECK (role IN ('owner', 'admin', 'member')),
+    added_by    TEXT,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (community_id, pubkey)
+);
+
+CREATE INDEX idx_relay_members_role ON relay_members (community_id, role);
+
+-- ── Archived identities (NIP-IA) ──────────────────────────────────────────────
+-- Conformance: archive cannot hide a key in another community. PK scoped.
+
+CREATE TABLE archived_identities (
+    community_id      UUID NOT NULL REFERENCES communities(id),
+    pubkey            TEXT NOT NULL,
+    consent_path      TEXT NOT NULL CHECK (consent_path IN ('self', 'owner', 'admin')),
+    actor             TEXT NOT NULL,
+    reason            TEXT,
+    replaced_by       TEXT,
+    request_event_id  TEXT NOT NULL,
+    archived_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (community_id, pubkey)
+);
+
+-- ── Audit log ─────────────────────────────────────────────────────────────────
+-- Conformance: "Audit log and observability". Per-community hash chain:
+-- uniqueness (community_id, seq) and (community_id, hash). One chain per tenant.
+-- (Lane Audit/Dawn builds the chain logic; Lane 0 fixes the scoped schema.)
+
+CREATE TABLE audit_log (
+    community_id    UUID NOT NULL REFERENCES communities(id),
+    seq             BIGINT NOT NULL,
+    hash            BYTEA NOT NULL,
+    prev_hash       BYTEA,
+    action          VARCHAR(64) NOT NULL,
+    actor_pubkey    BYTEA,
+    object_id       TEXT,
+    detail          JSONB,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (community_id, seq)
+);
+
+CREATE UNIQUE INDEX idx_audit_log_hash ON audit_log (community_id, hash);
+
+-- ── Lint allowlist registry ───────────────────────────────────────────────────
+-- The explicit registry of tables that are deliberately operator-global (NOT
+-- tenant-scoped). The migration-lint harness reads this: any table NOT listed
+-- here MUST carry a NOT NULL community_id and lead its uniques with it. Making
+-- the allowlist a DB table (not a hard-coded list in the linter) keeps the
+-- registry next to the schema it governs and reviewable in one migration diff.
+
+CREATE TABLE _operator_global_tables (
+    table_name  TEXT PRIMARY KEY,
+    reason      TEXT NOT NULL
+);
+
+INSERT INTO _operator_global_tables (table_name, reason) VALUES
+    ('communities',           'the tenant registry itself; id IS the community key'),
+    ('rate_limit_violations', 'deployment abuse/health; never tenant-observable; community_id is an attribution label only'),
+    ('_operator_global_tables', 'the registry table itself');