[TheGreatAxios]

Summary

CL-8210 ruling: every custom (non-Interchange) Postgres table Workbench owns lives on its own schema (never public, never inside Interchange's schemas) and carries real foreign keys to Interchange's tenant/principal id columns with ON DELETE CASCADE.

Inventory of every pgTable(/pgSchema( outside vendor/ and packages/chat/**:

Package	Schema	Before	After
packages/notify (notify_dispatch)	own notify schema	tenant_id/principal_id plain text	real FKs to tenant/principal, ON DELETE CASCADE
packages/onboarding (pending_seed)	own onboarding schema	tenant_id plain text	real FK to tenant, ON DELETE CASCADE; user_id left alone (see below)
packages/webhook-triggers (webhook_trigger, repo_review_lease)	own webhook_triggers schema	tenant_id (both) and created_by plain text	real FKs to tenant (both) and principal (created_by), ON DELETE CASCADE
packages/evals (evals.run)	own evals schema	no tenant/principal columns	unchanged — nothing to FK

Interchange's tenant/principal tables (vendor/intx/db/src/schema/tenants.ts, principals.ts): tenant.id (text PK), principal.id (text PK, itself FK'd to tenant.id cascade). Each fixed package now declares a local, never-migrated hostTenant/hostPrincipal stub (id column only) to carry the drizzle .references() — the same pattern @corbits/artifacts's src/schema.ts already uses.

Forward-only migrations (literal SQL, matching each package's existing pattern) add the FK constraints: packages/notify/src/migrations.ts (0002), packages/onboarding/src/migrations.ts (0002), packages/webhook-triggers/src/migrations.ts (0005).

Column I could not FK: packages/onboarding's pending_seed.user_id is the workbench web app's own better-auth user id (packages/connections/src/oauth-routes.ts's user.id), not an Interchange principal id — there is no Interchange row for it to reference, so it stays plain text.

Pinned Corbits library compliance (not modified, report only):

• @corbits/artifacts — own artifacts schema; tenant_id/principal_id are real .references() FKs. Fully compliant.
• @corbits/mailbox — own mailbox schema; tenant_id/principal_id are real FKs enforced in its migration DDL (runMailboxMigrations), deliberately not restated as drizzle .references() thunks in schema.ts. Compliant in substance.
• @corbits/memory — own memory schema; tenant_id columns are plain text with no FK anywhere (schema or migrations). Not compliant with CL-8210 — flagged for a follow-up ticket against that library, out of scope here (upstream repo, per house rule).

New structural check: scripts/checks/owned-tables-fk.ts fails any pgTable(...)/<schema>.table(...) declaration outside vendor/ that either (a) isn't declared on a named pgSchema(...), or (b) has a tenant_id/principal_id column with no .references(...). packages/chat/src/schema.ts is explicitly exempted as tracked pre-existing debt (out of scope — this PR is barred from touching packages/chat/**).

Also bumped scripts/checks/no-product-tenancy.ts's per-file maxOccurrences for the three touched files, since each now also declares a local tenant/principal FK-target stub.

Test plan

• bun run typecheck
• bun run lint
• bun run fmt
• bun run check:structural (all green, including new owned-tables-fk and updated no-product-tenancy)
• bun test scripts/checks/test/owned-tables-fk.test.ts scripts/checks/test/no-product-tenancy.test.ts scripts/checks/test/run.test.ts
• Package DB tests (packages/notify, packages/onboarding, packages/webhook-triggers) — not run: port 5432 was already occupied by another local Postgres/Docker instance and no DATABASE_URL was set, so these suites skip locally with their usual banner. CI's db-suites/e2e-suite jobs provision Postgres and will exercise the new migrations.

[linear-code]

CL-8210