
    Wi              	      h    d Z ddlmZ dZdZdZdZdZdZd	Z	d
j                  eeeeeee	g      ZddZy)a  RLM Neo-Cortex -- Tenant Partitioning PostgreSQL Schema (Story 6.08).

SQL definitions for rlm_tenants and rlm_memories tables with:
  - Row-Level Security (RLS) policies
  - Composite indexes for tenant-scoped queries
  - Content deduplication per tenant
  - Encryption key hash audit trail

Run via Alembic migration or directly against PostgreSQL.

VERIFICATION_STAMP
Story: 6.08
Verified By: parallel-builder
Verified At: 2026-02-26
Tests: 5/5
Coverage: 100%
    )annotationsa_  
CREATE TABLE IF NOT EXISTS rlm_tenants (
    tenant_id    UUID PRIMARY KEY,
    tier         VARCHAR(20) NOT NULL DEFAULT 'starter'
                 CHECK (tier IN ('starter', 'professional', 'enterprise', 'queen')),
    encryption_key_hash VARCHAR(64) NOT NULL,
    region       VARCHAR(20) DEFAULT 'au-east',
    is_active    BOOLEAN DEFAULT TRUE,
    created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX IF NOT EXISTS ix_rlm_tenants_tier ON rlm_tenants (tier);
CREATE INDEX IF NOT EXISTS ix_rlm_tenants_active ON rlm_tenants (is_active);
a  
CREATE TABLE IF NOT EXISTS rlm_memories (
    id              SERIAL PRIMARY KEY,
    tenant_id       UUID NOT NULL REFERENCES rlm_tenants(tenant_id) ON DELETE CASCADE,
    content         TEXT NOT NULL,
    content_hash    VARCHAR(64) NOT NULL,
    source          VARCHAR(100) NOT NULL,
    domain          VARCHAR(100) NOT NULL,
    memory_tier     VARCHAR(20) NOT NULL DEFAULT 'working'
                    CHECK (memory_tier IN ('discard', 'working', 'episodic', 'semantic')),
    surprise_score  FLOAT DEFAULT 0.0,
    access_count    INTEGER DEFAULT 0,
    vector_id       VARCHAR(100),
    metadata        JSONB,
    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    last_accessed   TIMESTAMPTZ NOT NULL DEFAULT NOW(),

    CONSTRAINT uq_rlm_memory_dedup UNIQUE (tenant_id, content_hash)
);

CREATE INDEX IF NOT EXISTS ix_rlm_memories_tenant ON rlm_memories (tenant_id);
CREATE INDEX IF NOT EXISTS ix_rlm_memories_hash ON rlm_memories (content_hash);
CREATE INDEX IF NOT EXISTS ix_rlm_memories_tier ON rlm_memories (memory_tier);
CREATE INDEX IF NOT EXISTS ix_rlm_memories_accessed ON rlm_memories (last_accessed);
CREATE INDEX IF NOT EXISTS ix_rlm_memories_tenant_tier
    ON rlm_memories (tenant_id, memory_tier);
z4
ALTER TABLE rlm_tenants ENABLE ROW LEVEL SECURITY;
z5
ALTER TABLE rlm_memories ENABLE ROW LEVEL SECURITY;
a  
DO $$
BEGIN
    IF NOT EXISTS (
        SELECT 1 FROM pg_policies
        WHERE tablename = 'rlm_tenants'
        AND policyname = 'tenant_isolation_rlm_tenants'
    ) THEN
        CREATE POLICY tenant_isolation_rlm_tenants ON rlm_tenants
            FOR ALL
            USING (tenant_id::text = current_setting('app.tenant_id', true))
            WITH CHECK (tenant_id::text = current_setting('app.tenant_id', true));
    END IF;
END
$$;
a  
DO $$
BEGIN
    IF NOT EXISTS (
        SELECT 1 FROM pg_policies
        WHERE tablename = 'rlm_memories'
        AND policyname = 'tenant_isolation_rlm_memories'
    ) THEN
        CREATE POLICY tenant_isolation_rlm_memories ON rlm_memories
            FOR ALL
            USING (tenant_id::text = current_setting('app.tenant_id', true))
            WITH CHECK (tenant_id::text = current_setting('app.tenant_id', true));
    END IF;
END
$$;
a  
CREATE TABLE IF NOT EXISTS rlm_shred_audit (
    id          SERIAL PRIMARY KEY,
    tenant_id   UUID NOT NULL,
    shredded_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    memories_shredded INTEGER DEFAULT 0,
    vectors_deleted   INTEGER DEFAULT 0,
    redis_keys_deleted INTEGER DEFAULT 0,
    initiated_by VARCHAR(100) DEFAULT 'system',
    reason       TEXT DEFAULT 'right_to_erasure'
);

CREATE INDEX IF NOT EXISTS ix_rlm_shred_audit_tenant
    ON rlm_shred_audit (tenant_id);

c                   K   ddl }|j                  |        d{   }	 |j                  t               d{    |j	                          d{    y7 ;7 7 	# |j	                          d{  7   w xY ww)zlExecute the full migration against PostgreSQL.

    Args:
        pg_dsn: PostgreSQL connection string.
    r   N)dsn)asyncpgconnectexecuteFULL_MIGRATIONclose)pg_dsnr   conns      5/mnt/e/genesis-system/core/rlm/partitioning_schema.pyrun_migrationr      s`      V,,Dll>***jjl	 -*djjlsS   A<AA<A AA A<AA<A A<A92A53A99A<N)r   strreturnNone)__doc__
__future__r   CREATE_TENANTS_TABLECREATE_MEMORIES_TABLEENABLE_RLS_TENANTSENABLE_RLS_MEMORIESCREATE_RLS_POLICY_TENANTSCREATE_RLS_POLICY_MEMORIESCREATE_SHRED_AUDIT_TABLEjoinr
   r        r   <module>r      sw   " #   @   " * (  r   