Discovered during PAR-480's verification audit; follow-up to PAR-449 and PAR-408.
Evidence in the committed schema:
- V10__issue_event.sql creates issue_event_issue_idx on (issue_id, created_at), without tenant_id first.
- V13__issue_ref_alias.sql creates issue_ref_alias_issue_idx on (issue_id).
- V12__issue_fulltext.sql creates a global GIN search_tsv index; vector search also uses a shared ANN index.
- V45__deployments.sql creates deployment_settings_argo_idx on (argo_token_hash), intentionally used to resolve a workspace from a credential before tenant context exists.
- Tenant tables also have global UUID primary-key indexes.
Rule 25 currently says every index begins with tenant_id. The schema therefore does not literally meet the written rule. This is not evidence that the tested reads leak tenant data; existing behavioral tests enforce tenant predicates.
Acceptance:
- Inventory actual PostgreSQL catalog indexes and tenant foreign keys after all migrations, classifying tenant query indexes, uniqueness/primary keys, search/ANN indexes and pre-tenant credential lookups.
- Obtain an explicit decision on legitimate global index/query exceptions; document it precisely rather than silently weakening R25 or mechanically changing all indexes.
- Add new idempotent Flyway migrations for ordinary tenant-query indexes that need tenant-leading definitions. Never edit applied migrations.
- Compare query plans and performance before/after; preserve credential uniqueness, search recall and tenant isolation.
- Add meaningful schema assertions for the agreed policy and behavioral two-workspace tests for changed queries.
PAR-480 documents this residual mismatch instead of claiming that passing ArchUnit proves schema compliance.