[LIghtJUNction]

Motivation

• Prevent anonymous reads of /.../_events.md from scanning and decoding the global events table, which allowed unbounded database and CPU work for small responses.

Description

• Add a topic-indexed projection table topic_event_projection for both SQLite and PostgreSQL to store (seq, topic, body) and an index on (topic, seq DESC) to make topic-scoped queries efficient and bounded (src/msg/storage/sqlite.py, src/msg/storage/postgres.py).
• Backfill existing governance events into the projection at schema initialization using SELECT ... FROM events so historical behavior is preserved for existing data.
• When a topic governance event is appended, write the projection row transactionally from the same transaction that appends the event so the projection remains consistent (src/msg/plugins/content.py).
• Replace the unbounded global scan in the content.topic_events handler with a paginated, topic-filtered SQL query that uses LIMIT limit+1 and cursor semantics to bound rows fetched and decoded (src/msg/plugins/content.py).

Testing

• Ran pytest for repository foundation/security tests via the development runner which executed tests/test_foundation.py and tests/test_security.py, resulting in 11 passed.
• Performed an in-memory SQLite smoke test that initialized _SCHEMA, inserted a sample governance event, re-ran schema initialization to backfill, and verified topic_event_projection contains the projected row and that EXPLAIN QUERY PLAN uses the new index.
• Verified git diff --check and local lint/smoke steps; style/lint suggestions were observed during development but do not affect the functional fix.
• Could not run the full tests/test_topic_governance.py PostgreSQL-backed integration under the repository-required Python >=3.15 because that interpreter and initdb were not available in the execution environment, so the Postgres-backed topic tests could not be collected here.

---

Codex Task

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T11:46:29.787669Z	6691bff	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

已被合并的 #142（merge commit edf0d55）取代，关闭。这些分支基于集成前的树，直接合并会与主线上的安全修复冲突或重复。