@de-otio/trellis 0.7.1 → 0.10.0

package/prisma/schema.prisma

@@ -4,11 +4,10 @@ generator client {
 }
 
 datasource db {
-  provider  = "postgresql"
-  url       = env("DATABASE_URL")
-  directUrl = env("DIRECT_DATABASE_URL")
-  // Note: Prisma 7 will require moving url/directUrl to prisma.config.ts
-  // This schema is correct for Prisma 5.x
+  provider = "postgresql"
+  // Prisma 7: url/directUrl moved out of the datasource block. The migration
+  // connection lives in apps/api/prisma.config.ts; the runtime connection is
+  // supplied via the PrismaPg driver adapter (lib/database-connection-manager.ts).
 }
 
 // Generic Entity model (replaces Dog model)
@@ -32,7 +31,7 @@ model Entity {
   lifeStageCalculatedAt   DateTime? @map("life_stage_calculated_at")
 
   // ActivityPub federation fields
-  actorUri     String? @unique @map("actor_uri") // e.g. https://skybber.app/ap/entities/{id}
+  actorUri     String? @unique @map("actor_uri") // e.g. https://example.com/ap/entities/{id}
   inboxUrl     String? @map("inbox_url")
   outboxUrl    String? @map("outbox_url")
   followersUrl String? @map("followers_url")
@@ -69,6 +68,9 @@ enum EntityStatus {
 
 model PostGeoIndex {
   postUri   String   @id @map("post_uri")
+  // Multi-tenancy — denormalized from the owning post; location data is
+  // sensitive, so geo rows carry their own tenant_id for direct RLS.
+  tenantId  String   @map("tenant_id")
   entityRef String?  @map("entity_ref") // Generic entity reference
   geohash   String
   lat       Float
@@ -82,12 +84,37 @@ model PostGeoIndex {
   sensitivityLevel String @default("benign") @map("sensitivity_level")
   // Values: 'benign', 'sensitive', 'decoy'
 
+  tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+
+  @@index([tenantId])
   @@index([entityRef])
   @@index([geohash])
   @@index([sensitivityLevel]) // Index for sensitivity level queries
   @@map("post_geo_index")
 }
 
+/// Entity geo-location for proximity discovery (C7). Neptune (the graph DB) has
+/// no spatial type, so geo-proximity lives here and is queried with PostGIS
+/// (ST_DWithin / KNN over a GiST index) via $queryRaw. Populated from the
+/// dual-write (syncEntity). Location is sensitive → own tenant_id for direct RLS
+/// (mirrors post_geo_index). See plans/redesign/entity-location-subsystem.md.
+model EntityLocation {
+  entityId  String                                @id @map("entity_id")
+  tenantId  String                                @map("tenant_id")
+  // PostGIS geography(Point,4326). Prisma Client cannot filter/order on it —
+  // spatial reads/writes go through $queryRaw. The geography column type, GiST
+  // index, and RLS are added in the migration SQL (not derivable from Prisma).
+  location  Unsupported("geography(Point, 4326)")
+  lat       Float
+  lng       Float
+  updatedAt DateTime                              @default(now()) @updatedAt @map("updated_at")
+
+  tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+
+  @@index([tenantId])
+  @@map("entity_location")
+}
+
 model IngestState {
   id            String   @id @default(cuid())
   cursor        String?  @unique
@@ -104,9 +131,27 @@ enum UserRole {
   PARTNER_ADMIN
   INTERNAL
   CONTENT_CREATOR
+  MODERATOR // Surveillance-hardening Phase 0 (E5): moderation-queue access; routes are Phase 1
   SUPER_ADMIN
 }
 
+// Surveillance-hardening Phase 0 (E2): how an account was created. Nullable on
+// User — existing accounts predate capture and stay NULL (unknown), never
+// backfilled. See doc/02-technical/surveillance-threat-model/03-signup-...
+enum SignupMethod {
+  COGNITO
+  INVITE
+  MAGIC_LINK
+}
+
+// Surveillance-hardening Phase 0 (E3): discriminator for the generalized Report
+// model. LINK reports exist today (folded in from LinkReport, P4); ACCOUNT
+// reports are Phase 1 (just a new reportType, not a new subsystem).
+enum ReportType {
+  LINK
+  ACCOUNT
+}
+
 // Role metadata for UI display and documentation
 model RoleMetadata {
   role        UserRole @id // Maps to enum value
@@ -128,8 +173,15 @@ model User {
   id        String   @id @default(cuid())
   email     String   @unique
   role      UserRole @default(END_USER)
-  actorUri  String?  @unique @map("actor_uri") // ActivityPub actor URI (e.g., "https://skybber.com/users/{username}")
-  handle    String? // ActivityPub handle (e.g., "@user@skybber.com")
+  actorUri  String?  @unique @map("actor_uri") // ActivityPub actor URI (e.g., "https://example.com/users/{handle}")
+  // Canonical, portable, AP-actor-shaped identifier (S-CP2). The bare local
+  // label (e.g. "alice"); the addressable handle is `@{handle}@{domain}` and
+  // the actor URI is `{baseUrl}/users/{handle}`. Derived + collision-checked at
+  // provisioning; non-null + globally unique so federation is additive, never a
+  // migration. (WebFinger/AP still resolve on `username` until the federation
+  // repoint — that change is code-only, no data migration, since `handle` is the
+  // stable key.)
+  handle    String  @unique
   createdAt DateTime @default(now()) @map("created_at")
 
   // Cognito Auth integration
@@ -179,6 +231,14 @@ model User {
   // FUTURE USE: Respect user preference when sending analytics events
   analyticsOptOut Boolean @default(false) @map("analytics_opt_out")
 
+  // Surveillance-hardening Phase 0 (E2): signup-metadata capture (P3 wires it).
+  // signupMethod records how the account was created; invitationId links the
+  // redeemed invitation. Client signals (IP/UA) go to SecurityEvent (retention-
+  // bound), NEVER as columns here — see 07-data-minimization.md. Both nullable:
+  // existing accounts stay NULL (unknown), no fabricated backfill.
+  signupMethod SignupMethod? @map("signup_method")
+  invitationId String?       @map("invitation_id")
+
   // Verification Status (synced from Cognito)
   emailVerified   Boolean   @default(false) @map("email_verified")
   emailVerifiedAt DateTime? @map("email_verified_at")
@@ -194,19 +254,19 @@ model User {
   identityVerificationProvider String?   @map("identity_verification_provider") // 'jumio', 'onfido', 'veriff', 'manual'
   showIdentityVerifiedBadge    Boolean   @default(true) @map("show_identity_verified_badge")
 
-  // PREPARATORY CHANGE: Region tracking for China expansion
+  // PREPARATORY CHANGE: Region tracking for multi-region support
   // region: User's detected region (where they're located)
   // dataRegion: Where user's data is stored (for compliance)
-  // FUTURE USE: When China expansion is implemented, dataRegion will be used
+  // FUTURE USE: When CN-region support is enabled, dataRegion will be used
   // to route data to the correct regional database
   region     String  @default("EU") @map("region") // User's region (US, EU, CN)
   dataRegion String? @map("data_region") // Where data is stored (for compliance)
 
-  posts               Post[]
-  securityEvents      SecurityEvent[]
-  createdInvitations  Invitation[]         @relation("CreatedInvitations")
-  usedInvitations     Invitation[]         @relation("UsedInvitations")
-  crossRegionConsents CrossRegionConsent[]
+  posts              Post[]
+  securityEvents     SecurityEvent[]
+  createdInvitations Invitation[]    @relation("CreatedInvitations")
+  usedInvitations    Invitation[]    @relation("UsedInvitations")
+  consents           Consent[]
 
   // Circle configuration and read state
   circleConfig     CircleConfig?
@@ -226,8 +286,14 @@ model User {
   createdAudiences    CustomAudience[]       @relation("AudienceCreator")
   audienceMemberships CustomAudienceMember[] @relation("AudienceMembers")
 
-  // Link reports
-  linkReports LinkReport[]
+  // Surveillance-hardening Phase 0: behavioral-event actor side (E1, P2) and
+  // generalized reports filed BY this user (E3, P4). Both cascade on delete.
+  interactionEvents InteractionEvent[] @relation("InteractionActor")
+  filedReports      Report[]           @relation("ReportReporter")
+
+  // Surveillance-hardening Phase 0 (E2): the invitation this user redeemed at
+  // signup, if any. Distinct from createdInvitations / usedInvitations.
+  signupInvitation Invitation? @relation("SignupInvitation", fields: [invitationId], references: [id])
 
   // ActivityPub protocol fields
   inboxUrl     String? @map("inbox_url") // ActivityPub inbox endpoint
@@ -270,6 +336,14 @@ model User {
   dateOfBirth DateTime? @map("date_of_birth")
   ageTier     AgeTier   @default(ADULT) @map("age_tier")
 
+  // Fail-CLOSED age signal for research/cohort inclusion. Distinct from
+  // `ageTier` (which fails OPEN at ADULT — a deliberate, accepted product-side
+  // minor-safety choice, see PSEUDONYM.md / RESEARCH-AGE-SIGNAL note). Any
+  // future research or cohort query MUST gate on `ageVerified = true`. `ageTier`
+  // is NEVER an includability signal: an unverified user defaults to ADULT and
+  // would otherwise leak into adult cohorts.
+  ageVerified Boolean @default(false) @map("age_verified")
+
   // Parental links
   parentalLinks ParentalLink[] @relation("ChildParentalLinks")
   guardianLinks ParentalLink[] @relation("GuardianParentalLinks")
@@ -313,6 +387,7 @@ model User {
   @@index([anonymousId]) // Index for anonymous ID lookups
   @@index([cognitoSub]) // Index for Cognito sub lookups
   @@index([personalTenantId])
+  @@index([invitationId]) // Phase 0 (E2): invitation-chain traversal, Phase 2 detection only
   @@map("users")
 }
 
@@ -361,28 +436,70 @@ model UserEncryptionKey {
   @@map("user_encryption_keys")
 }
 
-// Cross-region access consent for GDPR compliance
-// Tracks user consent for accessing data from different regions
-model CrossRegionConsent {
-  id           String    @id @default(cuid())
-  userId       String    @map("user_id")
-  dataRegion   String    @map("data_region") // Where data is stored (e.g., "EU")
-  accessRegion String    @map("access_region") // Region user is accessing from (e.g., "US")
-  consented    Boolean   @default(false)
-  consentedAt  DateTime? @map("consented_at")
-  withdrawnAt  DateTime? @map("withdrawn_at")
-  ipAddress    String?   @map("ip_address")
-  userAgent    String?   @map("user_agent")
-  createdAt    DateTime  @default(now()) @map("created_at")
-  updatedAt    DateTime  @updatedAt @map("updated_at")
+// Purpose discriminator for the unified Consent model.
+//   CROSS_REGION           — GDPR cross-region data-access consent (sets
+//                            dataRegion/accessRegion; studyId is NULL).
+//   RESEARCH_OBSERVATION   — opt-in to observational research (no per-study
+//                            intervention; studyId set).
+//   RESEARCH_PARTICIPATION — opt-in to active study participation (studyId set).
+enum ConsentPurpose {
+  CROSS_REGION
+  RESEARCH_OBSERVATION
+  RESEARCH_PARTICIPATION
+}
+
+// Purpose-tagged consent (generalised from the old CrossRegionConsent).
+//
+// CONSENT-HISTORY DESIGN — APPEND-ONLY (GDPR Art.7(1)/(3), IRB audit):
+//   Each grant or withdrawal is a NEW row. A grant/withdraw never mutates an
+//   earlier row, so the original `consentedAt` of every grant is preserved
+//   forever and the full lifecycle is reconstructable. The CURRENT state for a
+//   (user, purpose, key) is the single row with `active = true`; superseding a
+//   row sets `active = false` + `supersededAt = now()`. `withdrawnAt` records
+//   when consent was withdrawn ON the row that recorded it (a withdrawal row
+//   carries consented=false + withdrawnAt set and PRESERVES the grant's
+//   consentedAt if it descends from one — never null it).
+//
+//   Uniqueness is therefore keyed on ACTIVE rows only:
+//     - research rows (studyId non-null): @@unique([userId, purpose, studyId]).
+//       NOTE Postgres treats NULLs as DISTINCT, so this composite does NOT
+//       constrain CROSS_REGION rows (studyId is NULL there) — by design.
+//     - CROSS_REGION rows: a RAW partial unique index in the migration:
+//         CREATE UNIQUE INDEX consent_cross_region_key
+//           ON consent (user_id, data_region, access_region)
+//           WHERE purpose = 'CROSS_REGION' AND active;
+//       This preserves the pre-existing @@unique([userId, dataRegion,
+//       accessRegion]) guarantee for the active cross-region row.
+model Consent {
+  id           String         @id @default(cuid())
+  userId       String         @map("user_id")
+  purpose      ConsentPurpose @default(CROSS_REGION)
+  // Research consents only. NULL for CROSS_REGION rows.
+  studyId      String?        @map("study_id")
+  // Cross-region consents only. NULL for research rows.
+  dataRegion   String?        @map("data_region") // Where data is stored (e.g., "EU")
+  accessRegion String?        @map("access_region") // Region user is accessing from (e.g., "US")
+  consented    Boolean        @default(false)
+  consentedAt  DateTime?      @map("consented_at")
+  withdrawnAt  DateTime?      @map("withdrawn_at")
+  ipAddress    String?        @map("ip_address")
+  userAgent    String?        @map("user_agent")
+  // Append-only history discriminators.
+  active       Boolean        @default(true)
+  supersededAt DateTime?      @map("superseded_at")
+  createdAt    DateTime       @default(now()) @map("created_at")
+  updatedAt    DateTime       @updatedAt @map("updated_at")
 
   user User @relation(fields: [userId], references: [id], onDelete: Cascade)
 
-  @@unique([userId, dataRegion, accessRegion])
+  // Research-row uniqueness (studyId non-null). Does NOT cover CROSS_REGION
+  // rows — those are constrained by the raw partial index in the migration.
+  @@unique([userId, purpose, studyId])
   @@index([userId])
   @@index([consented])
   @@index([dataRegion, accessRegion])
-  @@map("cross_region_consent")
+  @@index([userId, purpose, active])
+  @@map("consent")
 }
 
 // Posting radius — how far content radiates on the author's social graph
@@ -430,15 +547,15 @@ model Post {
   taxonomyTags    PostTaxonomyTag[]
   linkChecks      LinkCheck[]
 
-  // PREPARATORY CHANGE: Region tracking for China expansion
+  // PREPARATORY CHANGE: Region tracking for multi-region support
   // dataRegion: Where post data is stored (for compliance)
-  // FUTURE USE: When China expansion is implemented, dataRegion will be used
+  // FUTURE USE: When CN-region support is enabled, dataRegion will be used
   // to route data to the correct regional database
   dataRegion String? @map("data_region") // Where post data is stored (for compliance)
 
   // ActivityPub fields (nullable for backward compatibility)
-  activityId String?   @unique @map("activity_id") // Activity URI (e.g., "https://skybber.com/posts/{id}/activity")
-  objectId   String?   @unique @map("object_id") // Note object URI (e.g., "https://skybber.com/posts/{id}")
+  activityId String?   @unique @map("activity_id") // Activity URI (e.g., "https://example.com/posts/{id}/activity")
+  objectId   String?   @unique @map("object_id") // Note object URI (e.g., "https://example.com/posts/{id}")
   to         Json? // Audience targeting (array of URIs)
   cc         Json? // Additional audience
   bto        Json? // Blind recipients (for private posts)
@@ -574,16 +691,20 @@ model UploadSession {
 
 // Post media
 model PostMedia {
-  id      String  @id @default(cuid())
-  postId  String  @map("post_id")
-  mediaId String  @map("media_id")
-  alt     String?
-  order   Int     @default(0)
-
-  post  Post      @relation(fields: [postId], references: [id], onDelete: Cascade)
-  media MediaFile @relation(fields: [mediaId], references: [id], onDelete: Restrict)
+  id       String  @id @default(cuid())
+  // Multi-tenancy — denormalized from the owning post; same scope.
+  tenantId String  @map("tenant_id")
+  postId   String  @map("post_id")
+  mediaId  String  @map("media_id")
+  alt      String?
+  order    Int     @default(0)
+
+  post   Post      @relation(fields: [postId], references: [id], onDelete: Cascade)
+  media  MediaFile @relation(fields: [mediaId], references: [id], onDelete: Restrict)
+  tenant Tenant    @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
   @@unique([postId, mediaId])
+  @@index([tenantId])
   @@index([postId])
   @@index([mediaId])
   @@map("post_media")
@@ -592,13 +713,16 @@ model PostMedia {
 // Post sentiment reactions
 model PostSentiment {
   id        String   @id @default(cuid())
+  // Multi-tenancy — denormalized from the owning post; same scope.
+  tenantId  String   @map("tenant_id")
   postId    String   @map("post_id")
   postUri   String?  @map("post_uri")
   authorId  String   @map("author_id")
   sentiment String
   createdAt DateTime @default(now()) @map("created_at")
 
-  post Post @relation(fields: [postId], references: [id], onDelete: Cascade)
+  post   Post   @relation(fields: [postId], references: [id], onDelete: Cascade)
+  tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
   @@unique([postId, authorId])
   @@unique([postUri, authorId])
@@ -609,6 +733,7 @@ model PostSentiment {
   @@index([postId, createdAt]) // For time-based sentiment queries
   @@index([postId, sentiment, createdAt(sort: Desc)], name: "idx_post_sentiment_summary") // For window function query (top 3 users per sentiment)
   @@index([postId, sentiment, createdAt(sort: Desc), id(sort: Desc)], name: "idx_post_sentiment_pagination") // For cursor-based pagination
+  @@index([tenantId])
   @@map("post_sentiments")
 }
 
@@ -747,11 +872,13 @@ model SecurityEvent {
   details   String // JSON string
   timestamp DateTime @default(now())
 
-  // PREPARATORY CHANGE: Retention tracking for future log retention policy
-  // This field stores when the log entry should be automatically deleted
-  // FUTURE USE: A scheduled cleanup job will delete events where retentionUntil < NOW()
-  // Retention periods: critical=365 days, high=90 days, medium=30 days, low=7 days
-  retentionUntil DateTime? @map("retention_until")
+  // Retention bound — NON-NULLABLE (Surveillance-hardening Phase 0, P1). A NULL
+  // row escapes the hourly-cron pruning forever: exactly the unbounded client-
+  // metadata log the threat model forbids (07-data-minimization.md), and P3
+  // writes IP/UA `signup` rows into this table. The hourly cron deletes events
+  // where retention_until < NOW(). Retention by severity: critical=365d,
+  // high=90d, medium=30d, low=7d (see security-monitor.calculateRetentionUntil).
+  retentionUntil DateTime @map("retention_until")
 
   user User? @relation(fields: [userId], references: [id])
 
@@ -765,18 +892,68 @@ model SecurityEvent {
   @@map("security_events")
 }
 
-// Feature Toggle model for global feature flags
+// AuditEvent model (phase 1.C.2)
+//
+// Backing store for `@de-otio/saas-foundation/audit` via
+// `PostgresAuditStore` (the `auditEvent.create` shape). Column names
+// and nullability mirror foundation's `PrismaAuditClient` contract
+// EXACTLY — see foundation `src/audit/prisma.ts`. The frozen
+// `AuditEvent` type owns this shape; changes require the frozen-type
+// RFC process.
+//
+// Append-only posture: foundation's PostgresAuditStore performs INSERT
+// only. A separate sweeper deletes rows where `retention_until < now()`.
+// `id` is a foundation-minted ulid (NOT a Prisma cuid default).
+model AuditEvent {
+  id             String   @id
+  timestamp      DateTime
+  tenantId       String?  @map("tenant_id")
+  actorKind      String   @map("actor_kind")
+  actorId        String   @map("actor_id")
+  action         String
+  resourceKind   String?  @map("resource_kind")
+  resourceId     String?  @map("resource_id")
+  outcome        String
+  failureReason  String?  @map("failure_reason")
+  severity       String
+  requestId      String?  @map("request_id")
+  traceId        String?  @map("trace_id")
+  ipAddress      String?  @map("ip_address")
+  userAgent      String?  @map("user_agent")
+  metadata       Json?
+  retentionUntil DateTime @map("retention_until")
+
+  @@index([tenantId])
+  @@index([timestamp])
+  @@index([action])
+  @@index([retentionUntil]) // sweeper: DELETE WHERE retention_until < now()
+  @@map("audit_event")
+}
+
+// Feature Toggle model — global or per-tenant (Surveillance-hardening Phase 0,
+// E4). tenantId NULL = global row; a non-NULL row overrides the global for that
+// tenant. Resolution (tenant → global → coded default) is P5.
+//
+// Uniqueness: `@@unique([key, tenantId])` lets each tenant hold one row per key.
+// Postgres treats NULLs as DISTINCT, so that constraint alone would permit
+// DUPLICATE global rows for the same key — the migration adds a PARTIAL unique
+// index `feature_toggles_key_global ON (key) WHERE tenant_id IS NULL` to forbid
+// it. That partial index is NOT expressible in schema.prisma; it lives only in
+// the migration SQL. Do not let a later `prisma migrate dev` treat it as drift.
 model FeatureToggle {
   id          String   @id @default(cuid())
-  key         String   @unique // e.g., "global_public_posting_enabled"
+  key         String // e.g., "global_public_posting_enabled"
   enabled     Boolean  @default(false)
   description String? // Human-readable description
+  tenantId    String?  @map("tenant_id") // NULL = global; non-NULL = per-tenant override
   changedBy   String?  @map("changed_by") // Email of user who last changed it
-  lastChanged DateTime @default(now()) @updatedAt @map("last_changed")
+  changedAt   DateTime @default(now()) @updatedAt @map("last_changed")
   createdAt   DateTime @default(now()) @map("created_at")
 
+  @@unique([key, tenantId])
   @@index([key])
   @@index([enabled])
+  @@index([tenantId])
   @@map("feature_toggles")
 }
 
@@ -797,6 +974,9 @@ model Invitation {
   creator User? @relation("CreatedInvitations", fields: [createdBy], references: [id])
   user    User? @relation("UsedInvitations", fields: [usedBy], references: [id])
 
+  // Phase 0 (E2): accounts that recorded this invitation as their signup origin.
+  signupUsers User[] @relation("SignupInvitation")
+
   @@index([code])
   @@index([createdBy])
   @@index([createdBy, createdAt]) // Composite index for efficient listing queries (filter by createdBy, order by createdAt)
@@ -930,15 +1110,23 @@ model EntityTaxonomyTag {
 }
 
 // Junction table for product-taxonomy tag relationships
+// Tags a tenant's Shopify product (an external `productId` string — there is
+// no local `Product` table) with internal taxonomy taxa. This is tenant-owned
+// data, so it carries its own tenant_id for direct RLS. (Without it,
+// `findMany({ where: { productId } })` leaks tags across tenants that happen to
+// reference the same Shopify product id.)
 model ProductTaxonomyTag {
   id        String   @id @default(cuid())
+  tenantId  String   @map("tenant_id")
   productId String   @map("product_id")
   taxonId   String   @map("taxon_id")
   createdAt DateTime @default(now()) @map("created_at")
 
-  taxon TaxonomyTaxon @relation(fields: [taxonId], references: [id], onDelete: Cascade)
+  taxon  TaxonomyTaxon @relation(fields: [taxonId], references: [id], onDelete: Cascade)
+  tenant Tenant        @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
   @@unique([productId, taxonId])
+  @@index([tenantId])
   @@index([productId])
   @@index([taxonId])
   @@map("product_taxonomy_tags")
@@ -1167,7 +1355,7 @@ model CustomAudience {
   id           String   @id @default(cuid())
   name         String
   creatorId    String   @map("creator_id") // Creator's user ID
-  collectionId String   @unique @map("collection_id") // Collection URI (e.g., "https://skybber.com/audiences/{id}")
+  collectionId String   @unique @map("collection_id") // Collection URI (e.g., "https://example.com/audiences/{id}")
   createdAt    DateTime @default(now()) @map("created_at")
   updatedAt    DateTime @updatedAt @map("updated_at")
 
@@ -1220,6 +1408,9 @@ model DomainReputation {
 // Link check results (for posts/comments)
 model LinkCheck {
   id            String    @id @default(cuid())
+  // Multi-tenancy — denormalized from the owning post/comment (both are
+  // tenant-scoped); required so geo/link rows are directly RLS-able.
+  tenantId      String    @map("tenant_id")
   postId        String?   @map("post_id") // Nullable for comments
   commentId     String?   @map("comment_id") // Nullable for posts
   originalUrl   String    @map("original_url")
@@ -1236,7 +1427,9 @@ model LinkCheck {
   post             Post?            @relation(fields: [postId], references: [id], onDelete: Cascade)
   comment          PostComment?     @relation(fields: [commentId], references: [id], onDelete: Cascade)
   domainReputation DomainReputation @relation(fields: [domain], references: [domain])
+  tenant           Tenant           @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
+  @@index([tenantId])
   @@index([postId])
   @@index([commentId])
   @@index([domain])
@@ -1244,22 +1437,94 @@ model LinkCheck {
   @@map("link_checks")
 }
 
-// Link reports from users
-model LinkReport {
-  id        String   @id @default(cuid())
-  userId    String   @map("user_id")
-  linkUrl   String   @map("link_url")
-  domain    String
-  reason    String?
-  status    String   @default("pending") // pending, reviewed, resolved
+// LinkReport was folded into the generalized `Report` model (Surveillance-
+// hardening Phase 0, P4): reportType=LINK, resourceType="url", resourceId=url,
+// reporterUserId=userId, plus the indexed `domain` column. The link_reports
+// table is dropped in the P4 migration.
+
+// ============================================================================
+// Surveillance-hardening Phase 0 (doc/02-technical/surveillance-threat-model/)
+// ============================================================================
+
+// E1 — Append-only behavioral event log. Preserves the TEMPORAL signal that
+// `Relationship.signals` aggregate counters destroy, bounded to a rolling
+// retention window. P2 writes the rows (dual-write alongside aggregation);
+// Phase 0 ships ZERO read paths — any future read is restricted to the Phase 2
+// detection path + moderator surfaces (MODERATOR/SUPER_ADMIN, audited).
+//
+// Data-minimization invariants (security review blocks on these):
+//   - NO free-text/content column — event type + references only. The table
+//     must be useless as a content archive.
+//   - `expiresAt` is NON-NULLABLE: no schema path to an unbounded behavioral
+//     log. P2 sets it to createdAt + retentionDays (config).
+//   - `targetId` has no FK (polymorphic; the target may be a deleted user) —
+//     so cascade can't reach rows ABOUT a deleted user. P2 adds the explicit
+//     deleteMany to user-data-deletion.ts (GDPR Art. 17).
+model InteractionEvent {
+  id          String @id @default(cuid())
+  actorUserId String @map("actor_user_id")
+
+  // Polymorphic target, no FK (matches Relationship's convention). Vocabulary:
+  // "user" | "entity" | "post" — the GraphNodeType strings P2 dual-writes from.
+  targetType String @map("target_type")
+  targetId   String @map("target_id")
+
+  // Interaction vocabulary — exactly InteractionCounts in graph/postgres/
+  // scoring.ts: view | react | comment | share | depth_mode | profile_visit |
+  // content_creation. A string, not an enum, to track that vocabulary cheaply.
+  interactionType String @map("interaction_type")
+
+  tenantId  String?  @map("tenant_id")
   createdAt DateTime @default(now()) @map("created_at")
 
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+  // Retention bound — NON-NULLABLE. Append-only: no updatedAt, no update path.
+  expiresAt DateTime @map("expires_at")
 
+  actor User @relation("InteractionActor", fields: [actorUserId], references: [id], onDelete: Cascade)
+
+  @@index([actorUserId, createdAt])
+  @@index([targetType, targetId, createdAt])
+  @@index([expiresAt]) // pruning: DELETE WHERE expires_at < now()
+  @@map("interaction_events")
+}
+
+// E3 — Generalized report model. Folds in LinkReport (P4) and makes Phase 1
+// account reporting "add a reportType", not a new subsystem. Queue fields
+// (assignee/resolution) exist now but are unused until Phase 1.
+//
+// Erasure:
+//   - `reporterUserId` cascades (a deleted reporter's reports go with them —
+//     matches the old LinkReport behavior).
+//   - `resourceId` is an OPAQUE string, no FK: an ACCOUNT report's reported
+//     user may be deleted. P4 pseudonymizes resourceId on erasure of the
+//     reported user (aggregate pattern analysis survives; plaintext ID does
+//     not — "pattern analysis" is not an Art. 17(3) exemption).
+//   - `assigneeUserId` is a plain string (no FK): a deleted moderator must not
+//     cascade-delete the reports they were assigned.
+model Report {
+  id             String     @id @default(cuid())
+  reportType     ReportType @map("report_type")
+  resourceType   String     @map("resource_type") // "url" (LINK) | "user" (ACCOUNT)
+  resourceId     String     @map("resource_id") // opaque; no FK by design
+  reporterUserId String     @map("reporter_user_id")
+  reason         String? // free-text; P4 enforces a 1000-char Zod bound at the boundary
+  status         String     @default("pending") // pending | reviewed | resolved
+  // LINK-report registrable domain (P4 fold-in of LinkReport). Indexed +
+  // queried hot by DomainReputationService (auto-block threshold counts by
+  // domain). Nullable: ACCOUNT reports have no domain.
+  domain         String?
+  assigneeUserId String?    @map("assignee_user_id") // Phase 1 moderator queue
+  resolvedAt     DateTime?  @map("resolved_at")
+  resolution     String? // Phase 1 moderator queue
+  createdAt      DateTime   @default(now()) @map("created_at")
+
+  reporter User @relation("ReportReporter", fields: [reporterUserId], references: [id], onDelete: Cascade)
+
+  @@index([reportType, status])
+  @@index([resourceType, resourceId])
+  @@index([reporterUserId])
   @@index([domain])
-  @@index([status])
-  @@index([userId])
-  @@map("link_reports")
+  @@map("reports")
 }
 
 // ============================================================================
@@ -1485,6 +1750,14 @@ model Tenant {
   connectionCodeRedemptions ConnectionCodeRedemption[]
   notifications             Notification[]
 
+  // Denormalized tenant_id on by-relation children (P1 — for direct RLS).
+  postMedia           PostMedia[]
+  postSentiments      PostSentiment[]
+  linkChecks          LinkCheck[]
+  postGeoIndexes      PostGeoIndex[]
+  productTaxonomyTags ProductTaxonomyTag[]
+  entityLocations     EntityLocation[]
+
   // Personal-tenant owner back-relation (uses @relation name to disambiguate)
   personalOwner User? @relation("PersonalTenantOwner", fields: [personalOwnerUserId], references: [id])
 
@@ -1656,3 +1929,88 @@ model TenantInvitation {
   @@index([expiresAt])
   @@map("tenant_invitations")
 }
+
+// ============================================================================
+// Graph edges in Postgres (graph-db revisit 2026-06: see
+// plans/redesign/graph-backend-contract.md)
+//
+// These two tables hold the edges that previously lived only in the graph DB
+// (RELATES_TO and typed entity-to-entity edges). OWNS (entity_ownerships) and
+// ABOUT (post_subjects) already existed in Postgres. Modeled as standalone
+// tables (no Prisma @relation) so the migration is self-contained and
+// non-breaking; targetId is polymorphic (user|entity) so it cannot carry a
+// single FK. Cascade-on-delete is enforced in app code by the GraphService
+// remove* methods, exactly as the graph layer did. Read by the Postgres
+// GraphService adapter (apps/api/src/lib/graph/postgres/).
+// ============================================================================
+
+// RELATES_TO — a scored relationship from a user to a target (user or entity).
+model Relationship {
+  id       String @id @default(cuid())
+  tenantId String @map("tenant_id") // denormalized scope, like entity_ownerships
+  userId   String @map("user_id")
+
+  // Polymorphic target: "user" | "entity" (matches GraphNodeType). No FK.
+  targetType String @map("target_type")
+  targetId   String @map("target_id")
+
+  computedScore     Float     @default(0) @map("computed_score")
+  manualScore       Float?    @map("manual_score") // null = no override
+  tier              Int       @default(3) // CircleTier 0..3
+  interactionCount  Int       @default(0) @map("interaction_count")
+  lastInteractionAt DateTime? @map("last_interaction_at")
+  connectionMethod  String    @map("connection_method") // code|import|suggestion|discovery
+  reciprocated      Boolean   @default(false)
+  // Per-interaction-type signal breakdown used by scoring-engine.ts.
+  // Shape finalized in Phase 1 (B5) against the scoring engine; JSON keeps the
+  // migration stable while that lands.
+  signals           Json?
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  @@unique([userId, targetType, targetId])
+  @@index([userId]) // forward: a user's relationships
+  @@index([targetType, targetId]) // reverse: who relates to X (FoF, recompute)
+  @@index([targetId])
+  @@index([userId, tier]) // circle-tier membership
+  @@index([tenantId])
+  @@map("relationships")
+}
+
+// Typed, unscored entity-to-entity edge (PACK_MATE, SIBLING, …), confirmable.
+model EntityRelationship {
+  id       String @id @default(cuid())
+  tenantId String @map("tenant_id")
+
+  entityId         String                   @map("entity_id")
+  relatedEntityId  String                   @map("related_entity_id")
+  type             EntityRelationshipType
+  status           EntityRelationshipStatus @default(PENDING)
+  proposedByUserId String                   @map("proposed_by_user_id")
+
+  since     DateTime @default(now())
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  @@unique([entityId, relatedEntityId, type])
+  @@index([entityId, type, status]) // discovery / list-by-entity
+  @@index([relatedEntityId, type, status]) // reverse / pending-by-owner
+  @@index([tenantId])
+  @@map("entity_relationships")
+}
+
+enum EntityRelationshipType {
+  PACK_MATE
+  SIBLING
+  PLAYMATE
+  PARENT
+  OFFSPRING
+  WALK_BUDDY
+}
+
+enum EntityRelationshipStatus {
+  PENDING
+  CONFIRMED
+  REJECTED
+}