[quality-runtime]

Adds the tenant-owned tables behind the requirement → control → evidence loop — control, standard, requirement, control_requirement, evidence, file, audit_event — and makes PostgreSQL, not application code, enforce tenancy and finality. First of a series; builds on #1 and #2, and the server routes and docs follow.

What the database enforces

• Tenancy. Row-level security is enabled and forced on every domain table, so the policies bind the table owner too. Foreign keys are composite on (id, organization_id), so a cross-tenant reference cannot be written at all.
• Per-command policies where the rule depends on the row: audit_event is append-only; evidence is amendable and discardable only until attested; a file is never detached and a mapping never rewritten; only a draft control may be deleted.
• Two triggers, only where a policy can't do the job.
  • file_evidence_open locks the evidence FOR NO KEY UPDATE on every attachment and refuses attested evidence. A policy is a test, not a lock: under read committed it would miss an attestation committing alongside.
  • control_lifecycle_enforce owns activated_at and keeps a retired control retired. With a CHECK tying draft to a null activated_at, the lifecycle is draft → active → retired, one way, whatever writes the row.
  • Both pin search_path and qualify their tables, so a temporary table named evidence cannot stand in for the real one.
• Shape checks on rows that can never be corrected: user attribution must be a usr_… identifier, the system actor carries none, and audit before/after must be JSON objects.

Migrations

0000_schema.sql is generated from the schema and replaces the 0000 already on main, which no database has applied. 0001_tenancy_and_finality.sql is hand-written and keeps the whole enforcement boundary in one place: FORCE, the policies and the triggers.

Runtime API

await assertTenantIsolation(db); // at start-up
const controls = await withOrganization(db, organizationId, (tx) => tx.select().from(control));

• withOrganization sets the tenant for one transaction and refuses to nest, because a savepoint does not scope SET LOCAL.
• assertTenantIsolation refuses to start when the role bypasses row security, when row_security = off (the migrator's setting), or when any domain table's row security is not both enabled and forced.
• db:migrate now requires MIGRATION_DATABASE_URL and never falls back to DATABASE_URL. .env.example and docs/development.md are updated for that and nothing else.

Comments cite ADRs by path. Those documents span the schema and the API, so they land with the docs PR later in this series.

Verification

In a clean checkout of main with only this change applied: bun run check, bun run test (148 tests, including the existing server tests against this package) and reuse lint pass. packages/db/enforcement.test.ts exercises each rule as a non-superuser role. The race guarantees are proven against real PostgreSQL 18 by the concurrency suite, which lands with the server routes.