From d5fe80586067e9bb869a84b1ec2d0f222b01ade8 Mon Sep 17 00:00:00 2001
From: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr
 <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co>
Date: Sun, 28 Jun 2026 12:17:24 -0400
Subject: [PATCH] test(relay): track feed conformance lane

Co-authored-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co>
Signed-off-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co>
---
 crates/buzz-db/src/event.rs                   |  4 +++
 crates/buzz-db/src/feed.rs                    |  7 +++--
 .../tests/conformance_multitenant.rs          | 29 +++++++++++++++++++
 3 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/crates/buzz-db/src/event.rs b/crates/buzz-db/src/event.rs
index 3da7f2866..357e337b4 100644
--- a/crates/buzz-db/src/event.rs
+++ b/crates/buzz-db/src/event.rs
@@ -259,6 +259,8 @@ pub async fn query_events(pool: &PgPool, q: &EventQuery) -> Result<Vec<StoredEve
              WHERE e.community_id = ",
         );
         b.push_bind(q.community_id.as_uuid());
+        b.push(" AND m.community_id = ");
+        b.push_bind(q.community_id.as_uuid());
         b.push(" AND e.deleted_at IS NULL AND m.pubkey_hex = ");
         b.push_bind(p_hex.to_ascii_lowercase());
         b
@@ -489,6 +491,8 @@ pub async fn count_events(pool: &PgPool, q: &EventQuery) -> Result<i64> {
              WHERE e.community_id = ",
         );
         b.push_bind(q.community_id.as_uuid());
+        b.push(" AND m.community_id = ");
+        b.push_bind(q.community_id.as_uuid());
         b.push(" AND e.deleted_at IS NULL AND m.pubkey_hex = ");
         b.push_bind(p_hex.to_ascii_lowercase());
         b
diff --git a/crates/buzz-db/src/feed.rs b/crates/buzz-db/src/feed.rs
index c824e9e7f..7cc02d801 100644
--- a/crates/buzz-db/src/feed.rs
+++ b/crates/buzz-db/src/feed.rs
@@ -117,7 +117,8 @@ fn build_mentions_query(
 /// Find events that @mention the given pubkey (have `["p", pubkey_hex]` in tags).
 ///
 /// Joins against the `event_mentions` table -- Phase 2 implementation.
-/// **Performance**: indexed lookup on `(pubkey_hex, event_created_at DESC)`.
+/// **Performance**: community-leading indexed lookup on
+/// `(community_id, pubkey_hex, event_created_at DESC)`.
 ///
 /// Only returns community-global events and events from `accessible_channel_ids`.
 /// `limit` is capped at [`FEED_MAX_LIMIT`] regardless of the value passed by the caller.
@@ -179,8 +180,8 @@ fn build_needs_action_query(
 /// Only returns community-global events and events from channels the user has access to
 /// (`accessible_channel_ids`). This prevents surfacing approval requests from channels
 /// the user was removed from.
-/// **Performance**: indexed lookup via `event_mentions` join on
-/// `(pubkey_hex, event_kind, event_created_at DESC)`.
+/// **Performance**: community-leading indexed lookup via `event_mentions` join on
+/// `(community_id, pubkey_hex, event_kind, event_created_at DESC)`.
 /// `limit` is capped at [`FEED_MAX_LIMIT`] regardless of the value passed by the caller.
 pub async fn query_needs_action(
     pool: &PgPool,
diff --git a/crates/buzz-test-client/tests/conformance_multitenant.rs b/crates/buzz-test-client/tests/conformance_multitenant.rs
index 5da5dc1fa..ca37905a7 100644
--- a/crates/buzz-test-client/tests/conformance_multitenant.rs
+++ b/crates/buzz-test-client/tests/conformance_multitenant.rs
@@ -1254,6 +1254,35 @@ mod channelless_global_events_dms {
     }
 }
 
+// ---------------------------------------------------------------------------
+// Feed read-side isolation (Perci — buzz-db/relay bridge)
+// ---------------------------------------------------------------------------
+mod feed_read_side_isolation {
+    use super::*;
+
+    /// Obligation: two-host feed reads are scoped by the request host's
+    /// community. A mention/feed item for the same pubkey in A must never be
+    /// returned by B's feed endpoint, including the empty-accessible-channel
+    /// case where SQL must mean "community-global only" rather than "all
+    /// channels".
+    ///
+    /// DB-level adversarial regressions for this exact leak shape landed in
+    /// `crates/buzz-db/src/feed.rs`; this row is the wire-level conformance
+    /// lane left pending until the two-host feed client harness is wired.
+    #[tokio::test]
+    #[ignore]
+    async fn feed_mentions_do_not_cross_communities_over_the_wire() {
+        pending_lane(
+            "feed read-side conformance",
+            concat!(
+                "two-host feed mentions query for the same pubkey returns only the ",
+                "host-derived community's events; empty accessible-channel lists ",
+                "remain community-global only",
+            ),
+        );
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Channels and channel membership (Mari — buzz-db)
 // ---------------------------------------------------------------------------