Multi-tenant Buzz relay: community_id as a server-resolved key (comprehensive rewrite)

.github/workflows/ci.yml

@@ -305,7 +305,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
       - name: Start integration services
-        run: docker compose up -d postgres redis typesense minio minio-init
+        run: docker compose up -d postgres redis minio minio-init
       - name: Get pnpm store directory
         id: pnpm-cache
         run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
@@ -357,22 +357,43 @@ jobs:
           }
           wait_healthy "Postgres" "buzz-postgres"
           wait_healthy "Redis" "buzz-redis"
-          wait_healthy "Typesense" "buzz-typesense"
           wait_healthy "MinIO" "buzz-minio"
       - name: Download relay binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: desktop-e2e-relay
           path: target/ci
+      - name: Apply schema and seed deployment community
+        # MT: the relay resolves each request's tenant from the communities host
+        # map and fails closed on an unmapped host. The channel reconciler binds
+        # the deployment community ONCE at boot (outside its retry loop) and
+        # exits permanently on an unmapped host, so the 'localhost:3000'
+        # community MUST exist before the relay starts — the retry loop only
+        # handles late-seeded channels, not a late-seeded community. The relay
+        # migrates at boot via BUZZ_AUTO_MIGRATE, but that's too late for the
+        # pre-boot seed, so apply the schema here first (then drop AUTO_MIGRATE
+        # below). lower(host) is the unique index → ON CONFLICT target. psql
+        # isn't on PATH in hermit → exec into the buzz-postgres container.
+        env:
+          PGHOST: localhost
+          PGPORT: "5432"
+          PGUSER: buzz
+          PGPASSWORD: buzz_dev
+          PGDATABASE: buzz
+        run: |
+          ./bin/pgschema apply --file schema/schema.sql --auto-approve
+          docker exec -e PGPASSWORD=buzz_dev buzz-postgres \
+            psql -U buzz -d buzz -qtA -c "
+          INSERT INTO communities (id, host)
+          VALUES ('00000000-0000-4000-8000-00000000c0de', 'localhost:3000')
+          ON CONFLICT (lower(host)) DO NOTHING
+          ;"
       - name: Start relay
         run: |
           chmod +x ./target/ci/buzz-relay
           nohup env \
             DATABASE_URL=postgres://buzz:buzz_dev@localhost:5432/buzz \
-            BUZZ_AUTO_MIGRATE=true \
             REDIS_URL=redis://localhost:6379 \
-            TYPESENSE_URL=http://localhost:8108 \
-            TYPESENSE_API_KEY=buzz_dev_key \
             RELAY_URL=ws://localhost:3000 \
             BUZZ_BIND_ADDR=0.0.0.0:3000 \
             BUZZ_REQUIRE_AUTH_TOKEN=false \
@@ -448,7 +469,7 @@ jobs:
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
       - name: Start integration services
-        run: docker compose up -d postgres redis typesense minio minio-init
+        run: docker compose up -d postgres redis minio minio-init
       - name: Wait for integration services
         run: |
           wait_healthy() {
@@ -467,22 +488,43 @@ jobs:
           }
           wait_healthy "Postgres" "buzz-postgres"
           wait_healthy "Redis" "buzz-redis"
-          wait_healthy "Typesense" "buzz-typesense"
           wait_healthy "MinIO" "buzz-minio"
       - name: Download relay binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: desktop-e2e-relay
           path: target/ci
+      - name: Apply schema and seed deployment community
+        # MT: the relay resolves each request's tenant from the communities host
+        # map and fails closed on an unmapped host. The reminder scheduler binds
+        # the deployment community ONCE at boot and exits permanently on an
+        # unmapped host (no retry, unlike the channel reconciler), so the
+        # 'localhost:3000' community MUST exist before the relay starts — seeding
+        # after boot leaves the scheduler dead. The relay migrates at boot via
+        # BUZZ_AUTO_MIGRATE, but that's too late for the pre-boot seed, so apply
+        # the schema here first (then drop AUTO_MIGRATE below). lower(host) is the
+        # unique index → ON CONFLICT target. psql isn't on PATH in hermit → exec
+        # into the buzz-postgres container.
+        env:
+          PGHOST: localhost
+          PGPORT: "5432"
+          PGUSER: buzz
+          PGPASSWORD: buzz_dev
+          PGDATABASE: buzz
+        run: |
+          ./bin/pgschema apply --file schema/schema.sql --auto-approve
+          docker exec -e PGPASSWORD=buzz_dev buzz-postgres \
+            psql -U buzz -d buzz -qtA -c "
+          INSERT INTO communities (id, host)
+          VALUES ('00000000-0000-4000-8000-00000000c0de', 'localhost:3000')
+          ON CONFLICT (lower(host)) DO NOTHING
+          ;"
       - name: Start relay
         run: |
           chmod +x ./target/ci/buzz-relay
           nohup env \
             DATABASE_URL=postgres://buzz:buzz_dev@localhost:5432/buzz \
-            BUZZ_AUTO_MIGRATE=true \
             REDIS_URL=redis://localhost:6379 \
-            TYPESENSE_URL=http://localhost:8108 \
-            TYPESENSE_API_KEY=buzz_dev_key \
             RELAY_URL=ws://localhost:3000 \
             BUZZ_BIND_ADDR=0.0.0.0:3000 \
             BUZZ_REQUIRE_AUTH_TOKEN=false \

AGENTS.md

@@ -42,7 +42,7 @@ crates/
   buzz-db             # Postgres event store and data access layer
   buzz-auth           # Authentication and authorization
   buzz-pubsub         # Redis pub/sub fan-out, presence, typing indicators
-  buzz-search         # Typesense-backed full-text search
+  buzz-search         # Postgres FTS full-text search
   buzz-audit          # Hash-chain audit log
   buzz-media          # Blossom/S3 media storage
   # Agent surface
@@ -130,7 +130,7 @@ to be duplicated:
 
 - `POST /events` — submit any signed event (same path the WebSocket uses).
 - `POST /query` — Nostr REQ filters over HTTP. NIP-50 `search` filters
-  are routed to `buzz-search` (Typesense-backed) automatically.
+  are routed to `buzz-search` (Postgres FTS) automatically.
 - `POST /count` — Nostr COUNT filters over HTTP.
 
 If you find yourself reaching for a new REST endpoint, first check whether

ARCHITECTURE.md

@@ -64,8 +64,8 @@ Buzz is a Rust monorepo, licensed Apache 2.0 under Block, Inc.
      (multi-node fan-out wired; local-echo dedup via AppState.local_event_ids).
 
      ┌──────────────┐
-     │  Typesense   │  ← buzz-search (bounded worker queue)
-     │ (full-text   │
+     │  Postgres    │  ← buzz-search (FTS over the search_tsv
+     │ (full-text   │     generated column + GIN index)
      │   search)    │
      └──────────────┘
 ```
@@ -80,7 +80,7 @@ buzz-core    (zero I/O — types, verification, filter matching, kind registry)
     ├── buzz-db          (Postgres: events, channels, tokens, workflows, audit)
     ├── buzz-auth        (NIP-42, NIP-98, API tokens, scopes, rate limiting)
     ├── buzz-pubsub      (Redis pub/sub, presence, typing indicators)
-    ├── buzz-search      (Typesense: index, query, delete)
+    ├── buzz-search      (Postgres FTS: query, delete)
     ├── buzz-audit       (hash-chain tamper-evident log)
     └── buzz-workflow    (YAML-as-code automation engine)
          │
@@ -462,21 +462,32 @@ EXPIRE buzz:typing:{channel_id} 60
 
 ---
 
-### buzz-search — Typesense Integration
+### buzz-search — Postgres FTS Integration
 
-Full-text search via Typesense. All HTTP calls use `reqwest` with `X-TYPESENSE-API-KEY`. In multi-community mode, indexed documents and every query filter include `community_id`; the shared Typesense collection is infrastructure, not a cross-community result space.
-
-**Collection schema (7 fields):** `id`, `content`, `kind` (int32), `pubkey` (facet), `channel_id` (facet, optional), `created_at` (int64, default sort), `tags_flat` (string[]).
+Full-text search via Postgres FTS. Events are searchable through the
+`events.search_tsv` generated `tsvector` column (populated on insert, indexed
+by a GIN index) — there is no separate search service or out-of-band indexer.
+Privacy-sensitive kinds are excluded at the storage level (the `search_tsv`
+`CASE WHEN kind IN (...)` yields `NULL`, which never matches `@@`). In
+multi-community mode every query filter includes `community_id`, so the shared
+`events` table is infrastructure, not a cross-community result space; the relay
+re-authorizes every candidate hit before returning it.
 
 **Key behaviors:**
-- `ensure_collection()` is idempotent: handles 409 race condition (another process created it between check and create).
-- Tag flattening uses `\x1f` (ASCII unit separator) to avoid ambiguity with tag values containing colons (e.g., URLs in `r` tags).
-- Upsert indexing: `POST /documents?action=upsert` (single), `POST /documents/import?action=upsert` (batch JSONL).
-- `delete_event()` validates event ID (64-char hex) before constructing the URL — prevents path injection.
-- `delete_event()` is idempotent: 404 treated as success.
-- Permission filtering is **caller's responsibility** — `buzz-search` provides the `filter_by` mechanism but does not enforce access policy.
-
-**Does NOT:** enforce channel membership or access control. Does NOT store events in Postgres.
+- `SearchService::new(pool)` wraps a `PgPool`; `search(&SearchQuery)` runs a
+  parameterized FTS query against the `events.search_tsv` GIN index and returns
+  `SearchResult` (candidate `SearchHit`s).
+- `ChannelScope` makes the channel constraint explicit (`Any` /
+  `ChannelLessOnly` / `Channels` / `ChannelsOrChannelLess`), closing the
+  ambiguity the old `Option<Vec<Uuid>> + bool` matrix could not express.
+- Every query carries `community_id`; the FTS predicate is BitmapAnd-ed with
+  the community-leading btree filters so a query never crosses tenants.
+- Permission filtering is **caller's responsibility** — `buzz-search` returns
+  candidate hits; the relay re-authorizes each one (channel membership, `#p`,
+  owner gates) before delivering it.
+
+**Does NOT:** enforce channel membership or access control. Does NOT write
+events (indexing is the `search_tsv` generated column on the `events` insert).
 
 ---
 
@@ -652,7 +663,7 @@ pub enum AuthState { Pending { challenge: String }, Authenticated(AuthContext),
 | GET | `/api/channels/{channel_id}/messages` | List channel messages |
 | GET | `/api/channels/{channel_id}/threads/{event_id}` | Get message thread |
 | GET/POST | `/api/channels/{channel_id}/workflows` | List/create channel workflows |
-| GET | `/api/search` | Full-text search via Typesense |
+| GET | `/api/search` | Full-text search via Postgres FTS |
 | GET | `/api/agents` | List agent accounts |
 | GET/PUT | `/api/presence` | Presence status (bulk) / set presence |
 | GET | `/api/feed` | Personalized feed (mentions/needs-action/activity) |
@@ -831,9 +842,8 @@ Docker Compose provides the full local development stack. All services include h
 
 | Service | Image | Port | Purpose |
 |---------|-------|------|---------|
-| Postgres | `postgres:17-alpine` | 5432 | Primary event store — events, channels, tokens, workflows, audit |
+| Postgres | `postgres:17-alpine` | 5432 | Primary event store — events, channels, tokens, workflows, audit; full-text search (`search_tsv` GIN) |
 | Redis | `redis:7-alpine` | 6379 | Pub/sub fan-out, presence (SET EX), typing (sorted sets) |
-| Typesense | `typesense/typesense:27.1` | 8108 | Full-text search index |
 | Adminer | `adminer` | 8082 | DB web UI (dev only) |
 | MinIO | `minio/minio` | 9000 (API), 9001 (console) | S3-compatible object storage (media) |
 | Prometheus | `prom/prometheus` | 9090 | Metrics collection |
@@ -859,9 +869,16 @@ Docker Compose provides the full local development stack. All services include h
 | `buzz:presence:{pubkey_hex}` | String | 90s | Online/away status (single-community form; shared multi-community Redis must scope by community) |
 | `buzz:typing:{channel_uuid}` | Sorted Set | 60s | Active typers (5s window; shared multi-community Redis must scope by community) |
 
-### Typesense Collection
+### Full-Text Search (Postgres FTS)
 
-Single collection (`events` by default, configurable via `TYPESENSE_COLLECTION`). Schema today: `id`, `content`, `kind` (int32), `pubkey` (facet), `channel_id` (facet, optional), `created_at` (int64, default sort), `tags_flat` (string[]). Multi-community mode adds faceted `community_id` and either prefixes document IDs with community or makes all upsert/delete/refetch paths carry community context.
+Search runs over the `events.search_tsv` generated `tsvector` column on the
+`events` table (no separate collection or service). The column is populated on
+insert — `to_tsvector('simple', content)` — and excludes privacy-sensitive
+kinds via `CASE WHEN kind IN (1059, 30300, 30622) THEN NULL`, so those rows are
+storage-level unsearchable (a `NULL` tsvector never matches `@@`). A GIN index
+(`idx_events_search_tsv`) backs the `@@` probe; in multi-community mode the
+community-leading btree filters BitmapAnd with the GIN probe so every query is
+fenced to its `community_id`.
 
 ---
 

CONTRIBUTING.md

@@ -43,7 +43,7 @@ unacceptable behavior to **conduct@buzz-relay.org**.
 | Node.js | 24+ | Required for desktop app commands and `just ci` |
 | pnpm | 10+ | Required for desktop app commands and `just ci` |
 | Flutter | 3.41+ | Required for mobile app — install via [flutter.dev](https://docs.flutter.dev/get-started/install) |
-| Docker | 24+ | For Postgres, Redis, Typesense |
+| Docker | 24+ | For Postgres, Redis, MinIO |
 | `just` | latest | Task runner — `cargo install just` |
 | `lefthook` | latest | Optional; run `lefthook install` for local Git hooks |
 | `sqlx` migrations | workspace crate | `just migrate` applies embedded migrations from `migrations/` |
@@ -85,9 +85,9 @@ cached thereafter). You can also run `just bootstrap` independently at any time;
 it is safe to re-run.
 
 `just setup` then starts Docker services (Postgres on `:5432`, Redis on `:6379`,
-Typesense on `:8108`, Adminer on `:8082`, Keycloak on `:8180` for local
-OAuth/OIDC testing, MinIO on `:9000` for media storage, and Prometheus on
-`:9090` for metrics) and runs all pending database migrations.
+Adminer on `:8082`, Keycloak on `:8180` for local OAuth/OIDC testing, MinIO on
+`:9000` for media storage, and Prometheus on `:9090` for metrics) and runs all
+pending database migrations.
 
 ### Running the Relay and Desktop App
 
@@ -380,8 +380,11 @@ for team access setup, onboarding, and the full repo inventory. See
    handler in `buzz-db/src/` (e.g., `buzz-db/src/my_feature.rs`) with
    the appropriate `INSERT` and `SELECT` queries.
 
-6. **Index for search** (if applicable) — add the kind to the Typesense
-   indexing logic in `buzz-search/src/index.rs`.
+6. **Index for search** (if applicable) — Postgres FTS indexes persisted
+   events automatically via the `events.search_tsv` generated column. To
+   exclude a privacy-sensitive kind from search, add it to the `CASE WHEN
+   kind IN (...)` exclusion in the `search_tsv` definition (see the initial
+   schema migration) rather than wiring a separate indexer.
 
 7. **Audit** — the audit log captures all events automatically; no changes
    needed unless you need custom audit metadata.

Cargo.toml

@@ -2,6 +2,7 @@
 members = [
     "crates/buzz-relay",
     "crates/buzz-core",
+    "crates/buzz-conformance",
     "crates/buzz-db",
     "crates/buzz-pubsub",
     "crates/buzz-auth",
@@ -78,7 +79,7 @@ anyhow    = "1"
 uuid    = { version = "1", features = ["v4", "serde"] }
 chrono  = { version = "0.4", features = ["serde"] }
 
-# HTTP client (webhook delivery, Typesense indexing)
+# HTTP client (webhook delivery)
 reqwest = { version = "0.13", features = ["json", "rustls"], default-features = false }
 
 # Cryptography
@@ -108,6 +109,7 @@ schemars = { version = "1", default-features = false }
 
 # Internal crates
 buzz-core = { path = "crates/buzz-core" }
+buzz-conformance = { path = "crates/buzz-conformance" }
 buzz-db = { path = "crates/buzz-db" }
 buzz-auth = { path = "crates/buzz-auth" }
 buzz-pubsub = { path = "crates/buzz-pubsub" }

Justfile

@@ -427,13 +427,6 @@ migrate: _ensure-migrations
 
 # ─── Utilities ────────────────────────────────────────────────────────────────
 
-# Rebuild Typesense docs for all kind:0 (user profile) events.
-# Required once after deploying the indexer change that flattens kind:0 content
-# for searchability; new/updated profiles are indexed correctly automatically.
-# Safe to run repeatedly — Typesense upserts.
-reindex-kind0:
-    cargo run --release -p buzz-relay --bin buzz-reindex-kind0
-
 # Remove build artifacts
 clean:
     cargo clean