Multi-tenant Buzz relay: community_id as a server-resolved key (comprehensive rewrite)#1321

Draft

tlongwell-block wants to merge 101 commits into

mainfrom

rewrite/relay-mt-comprehensive

Commits on Jun 27, 2026

feat(core): TenantContext + CommunityId — the server-resolved tenant fence

tlongwell-block
and
Eva
committed
feat(lane0): community_id-native schema + host normalization

tlongwell-block
and
Eva
committed
feat(lane0): fold review round 2 — FTS column, drop stale migrations

tlongwell-block
and
Eva
committed
fix(db): scope relay rows by community

tlongwell-block
and
Mari
committed
fix(db): require community scope for row lookups

tlongwell-block
and
Mari
committed
fix(db): add tenant-safe query defaults and reaper host provenance

tlongwell-block
and
Mari
committed
feat(auth): community-scope RateLimiter pubkey quotas

tlongwell-block
and
Sami
committed
feat(auth): NIP-98 replay seen-set — shared, community-scoped, atomic

tlongwell-block
and
Sami
committed
hardening(auth): TTL ceiling, key-case invariant, structured error tracing

tlongwell-block
and
Sami
committed
fence(auth): host-binding side door + access-checker community fence

tlongwell-block
and
Sami
committed
feat(pubsub): scope redis topics by community

tlongwell-block
and
Max
committed
test(pubsub): pin tenant-scoped topic refcounts

tlongwell-block
and
Max
committed
rewrite(search): Postgres FTS, community-scoped, drop Typesense

tlongwell-block
and
Quinn
committed
rewrite(search): ChannelScope enum closes ChannelLessOnly fence hole

tlongwell-block
and
Quinn
committed
feat(audit): per-community hash chain on the frozen audit_log DDL

tlongwell-block
and
Dawn
committed
feat(audit): widen NewAuditEntry.community_id to CommunityId

tlongwell-block
and
Dawn (sprout agent)
committed
feat(relay): row-zero host-binding seam (HostResolver + fail-closed bind)

tlongwell-block
and
Eva
committed
feat(relay): huddle-audio-unavailable guardrail under horizontal scaling (§5b)

tlongwell-block
and
Eva
committed
test(conformance): multi-tenant A/B isolation harness skeleton

tlongwell-block
and
Eva
committed
feat(relay): RelayInfo::build static-input fence (conformance NIP-11 row)

tlongwell-block
and
Eva
committed
fix(db): scope archived identities by community

tlongwell-block
and
Mari
committed
feat(relay): wire relay + admin call sites to community-scoped v3 API

tlongwell-block
and
Eva
committed
fix(db): add communities to schema snapshot

tlongwell-block
and
Mari
committed
fix(relay-mt): clear clippy -D warnings introduced by tenant threading

tlongwell-block
and
Eva
committed
fix(db): reconcile schema snapshot with mt migration

tlongwell-block
and
Mari
committed
test(e2e): seed localhost:3000 community for multi-tenant e2e suites

tlongwell-block
and
Eva
committed
test(e2e): converge e2e host on localhost + seed before relay boot

tlongwell-block
and
Eva
committed
test(e2e): seed community before relay boot in desktop e2e integration

tlongwell-block
and
Eva
committed
fix(relay): preserve relay URL port for deployment binding
npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf
committed
fix(relay): use deployment tenant binding for startup membership
npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf
committed
fix(relay): bind fanout to receiver community

npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta
and
Tyler Longwell
committed
perf(relay): add bus scaling harness

npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta
and
Tyler Longwell
committed
fix(relay): fail closed on empty/whitespace host in bind_community

committed
fix(relay): scope DM command writes by community

npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf
authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
fix(relay): clear clippy on integrated multi-tenant stack

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
feat(conformance): runtime trace schema + independent replay checker

npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm
and
Tyler Longwell
committed
feat(relay): wire conformance emitter into ingest seam

npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm
and
Tyler Longwell
committed
test(relay): EmitGuard coverage-breach self-test

npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm
and
Tyler Longwell
committed
feat(relay): emit AuthCheck on REQ membership decision

npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm
and
Tyler Longwell
committed
feat(relay): emit read-row trace steps with (B) projection

npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm
and
Tyler Longwell
committed
fix(relay): share NIP-98 replay guard via Redis

authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
test(buzz-db): pin communities_of_channels missing-channel-absent contract

authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
test(relay): red-team Attack 3 — same-pod regression + fail-closed proof

authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
fix(search): restore privacy kind exclusions at the FTS storage layer

npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm
and
Tyler Longwell
committed
relay/auth: NIP-98 u-URL host is per-tenant, not config-global

npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc
and
Tyler Longwell
committed
Measure relay bus scaling with Redis

npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta
and
Tyler Longwell
committed
buzz-db: scope api_tokens lookups to community_id (Gap 2 / row 44)

authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
test(conformance): nip11_relay_info — NIP-11 is host-agnostic, not a community-enumeration oracle

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
buzz-relay: bind NIP-42 AUTH `relay` tag to per-tenant host (row 44 sibling)

authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
test(conformance): audit_log isolation — doc-only row + integrated relay test + error sanitization

tlongwell-block
and
Dawn
committed
test(conformance): fill row_zero_host_binding (unmapped fail-closed + #h override-reject)

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
test(conformance): fill search_fts row — two-host NIP-50 isolation + delete

authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
test(conformance): fill users_profiles_nip05 row — kind:0 + NIP-05 lookup per-community

npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm
and
Tyler Longwell
committed
test(conformance): fill channels_membership row — same channel UUID coexists in two communities

npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm
and
Tyler Longwell
committed
test(conformance): fill api_tokens_nip98_replay row — doc-only api_token half + wire-driven NIP-98 replay half

npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc
and
Tyler Longwell
committed
test: cover pubsub presence typing isolation

authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
fix(relay): scope media and git substrate by tenant

authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
test(conformance): document status-code-as-layer-discriminator on nip98_replay assertion

authored and
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
committed
refactor(relay): drop dead Typesense config + correct stale search comments

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
chore(chart): remove the eval-only Typesense subsystem from the Helm chart

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
chore(compose,scripts): drop Typesense from local dev/test stacks

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
docs: rename Typesense references to Postgres FTS

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
docs: update multi-tenant spec search obligation to Postgres FTS

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
ci: drop Typesense from the integration-test workflow

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
fix(relay): scope local-echo dedup by community

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
fix(relay): claim reminders before publishing

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
fix(relay): scope relay membership to its community

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
fix(db): scope reminder claim/release to their community

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
fix(admin): derive admin tenant host via shared relay_url_authority

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
fix(workflow): scope workflow execution and approvals to their community

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
fix(workflow): wire community-scoped durable claim into scheduler

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
fix(workflow): add scheduled_workflow_fires.workflow_run_id for the attach audit link

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
fix(workflow): seed interval cold-start anchor so new schedules fire

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
style(workflow): rustfmt the multi-tenant fix set

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
test(conformance): wire-live workflow trigger community-confinement row

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
relay: complete multi-tenant scoping for reactions, allowlist, git names, and seed/partition fixes

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
Remove unused NIP-28 proxy
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
Repair CI schema partition setup
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed

Commits on Jun 28, 2026

Handle delivery log partition identities
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
Fix desktop bottom scroll pin settling
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
ci: retrigger checks after scroll-pin fix
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
Merge origin/main into relay rewrite branch
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
Fix virtualized bottom target after history prepend
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
Preserve local relay host for desktop HTTP calls
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
Pin desktop localhost HTTP resolution
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
Trim desktop localhost resolver comment
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
fix(buzz-db): index-match lookup_community_by_host on lower(host)

committed
ci: run the multi-tenant conformance gate in the unit-test job

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed
test(buzz-conformance): property/fuzz traces for the replay checker

committed
fix(relay): scope feed queries by community
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
test(relay): track feed conformance lane
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
fix(search): harden FTS query inputs
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
test(search): track author-only FTS skip drift
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
fix(search): exclude p-gated membership notices from FTS
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
fix(search): use clamp for page bounds
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
test(search): track p-gated FTS skip drift
npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc
committed
feat(search): restore topbar prefix matching
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
fix(dev): seed local community hosts
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
fix(dev): include loopback host aliases
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
fix(dev): fail fast on occupied relay ports
npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
committed
migrations: add 0002 single-community -> multi-tenant cutover backfill

npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
and
Tyler Longwell
committed

Uh oh!

Commits

Commits on Jun 27, 2026

Commits on Jun 28, 2026