test(relay): track feed conformance lane

Co-authored-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co>
Signed-off-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co>

crates/buzz-db/src/event.rs

@@ -259,6 +259,8 @@ pub async fn query_events(pool: &PgPool, q: &EventQuery) -> Result<Vec<StoredEve
              WHERE e.community_id = ",
         );
         b.push_bind(q.community_id.as_uuid());
+        b.push(" AND m.community_id = ");
+        b.push_bind(q.community_id.as_uuid());
         b.push(" AND e.deleted_at IS NULL AND m.pubkey_hex = ");
         b.push_bind(p_hex.to_ascii_lowercase());
         b
@@ -489,6 +491,8 @@ pub async fn count_events(pool: &PgPool, q: &EventQuery) -> Result<i64> {
              WHERE e.community_id = ",
         );
         b.push_bind(q.community_id.as_uuid());
+        b.push(" AND m.community_id = ");
+        b.push_bind(q.community_id.as_uuid());
         b.push(" AND e.deleted_at IS NULL AND m.pubkey_hex = ");
         b.push_bind(p_hex.to_ascii_lowercase());
         b

crates/buzz-db/src/feed.rs

@@ -117,7 +117,8 @@ fn build_mentions_query(
 /// Find events that @mention the given pubkey (have `["p", pubkey_hex]` in tags).
 ///
 /// Joins against the `event_mentions` table -- Phase 2 implementation.
-/// **Performance**: indexed lookup on `(pubkey_hex, event_created_at DESC)`.
+/// **Performance**: community-leading indexed lookup on
+/// `(community_id, pubkey_hex, event_created_at DESC)`.
 ///
 /// Only returns community-global events and events from `accessible_channel_ids`.
 /// `limit` is capped at [`FEED_MAX_LIMIT`] regardless of the value passed by the caller.
@@ -179,8 +180,8 @@ fn build_needs_action_query(
 /// Only returns community-global events and events from channels the user has access to
 /// (`accessible_channel_ids`). This prevents surfacing approval requests from channels
 /// the user was removed from.
-/// **Performance**: indexed lookup via `event_mentions` join on
-/// `(pubkey_hex, event_kind, event_created_at DESC)`.
+/// **Performance**: community-leading indexed lookup via `event_mentions` join on
+/// `(community_id, pubkey_hex, event_kind, event_created_at DESC)`.
 /// `limit` is capped at [`FEED_MAX_LIMIT`] regardless of the value passed by the caller.
 pub async fn query_needs_action(
     pool: &PgPool,

crates/buzz-test-client/tests/conformance_multitenant.rs

@@ -1254,6 +1254,35 @@ mod channelless_global_events_dms {
     }
 }
 
+// ---------------------------------------------------------------------------
+// Feed read-side isolation (Perci — buzz-db/relay bridge)
+// ---------------------------------------------------------------------------
+mod feed_read_side_isolation {
+    use super::*;
+
+    /// Obligation: two-host feed reads are scoped by the request host's
+    /// community. A mention/feed item for the same pubkey in A must never be
+    /// returned by B's feed endpoint, including the empty-accessible-channel
+    /// case where SQL must mean "community-global only" rather than "all
+    /// channels".
+    ///
+    /// DB-level adversarial regressions for this exact leak shape landed in
+    /// `crates/buzz-db/src/feed.rs`; this row is the wire-level conformance
+    /// lane left pending until the two-host feed client harness is wired.
+    #[tokio::test]
+    #[ignore]
+    async fn feed_mentions_do_not_cross_communities_over_the_wire() {
+        pending_lane(
+            "feed read-side conformance",
+            concat!(
+                "two-host feed mentions query for the same pubkey returns only the ",
+                "host-derived community's events; empty accessible-channel lists ",
+                "remain community-global only",
+            ),
+        );
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Channels and channel membership (Mari — buzz-db)
 // ---------------------------------------------------------------------------