Governance Basics

ls docs/postgresql-style-guide.md  # or repo equivalent
psql -c "SELECT extname FROM pg_extension ORDER BY 1;"

# PostgreSQL Style Guide (excerpt)
- Tables: plural snake_case (`orders`, `line_items`)
- PK: `bigint GENERATED ALWAYS AS IDENTITY` or `uuid` with explicit default
- Timestamps: `timestamptz` named `created_at`, `updated_at`
- FK: `{referenced_table_singular}_id`
- No reserved words unquoted

CREATE ROLE app_read NOLOGIN;
CREATE ROLE app_write NOLOGIN;
CREATE ROLE migrator LOGIN PASSWORD 'vault-rotated';
 
GRANT app_read TO app_api;
GRANT app_write TO app_worker;
-- migrator owns DDL in CI only

SELECT extname, extversion FROM pg_extension;

Service team authors SQL → DBA reviews tier → CI applies with migrator role

# ADR-0142: JSONB config blob on tenants
Status: Accepted
Context: Rapid tenant flags before GA
Consequence: Validate in app; migrate to columns by Q4
Review date: 2026-12-01

-- Weekly job: objects created outside migrator role
SELECT obj.object_identity, ev.objid, ev.classid
FROM pg_event_trigger_ddl_commands() ev
JOIN pg_identify_object(ev.classid, ev.objid, ev.objsubid) obj
ON true;
-- Prefer ddl audit via pgaudit or event trigger in platform account

payments_db and billing_db both use same:
- naming guide
- timestamp conventions
- RLS policy naming (`{table}_tenant_isolation`)