docs(#769): start KBN-100 schema migration

docs/native-kanban-sot/TASKS.md

@@ -81,9 +81,9 @@ No consumer implementation begins before KBN-105. No schema work begins before K
 
 ### KBN-010 — Threat, authorization, and constraint-impact gate
 
-- **Status:** IN PROGRESS — issue [#753](https://git.mosaicstack.dev/mosaicstack/stack/issues/753).
-- **Owner:** `kbn-coder3`; independent `secrev`.
-- **Mode:** SERIAL prerequisite of KBN-100.
+- **Status:** COMPLETE — PR #765 squash-merged as `2e228007`; issue #753 closed; post-merge pipeline #1813 terminal success.
+- **Owner:** `kbn-coder3`; independent Homelab schema/SecReview and `web1:coder0` Codex-Ultron review.
+- **Mode:** SERIAL prerequisite of KBN-100; completed.
 - **Exclusive files:** `docs/native-kanban-sot/KBN-010-THREAT-AUTH-CONSTRAINT-GATE.md` and task scratchpad only.
 - **IN:** Cross-workspace owners/principals/evidence; active membership; stale/forged health; approval forgery; fence monotonicity; audit retention; proposal target/audit-event forgery; service tokens; DB/Valkey outage.
 - **OUT:** Runtime/schema edits.
@@ -93,14 +93,15 @@ No consumer implementation begins before KBN-105. No schema work begins before K
 
 ### KBN-100 — Unified Drizzle schema and concrete N-1 migration
 
-- **Owner:** **coder2**.
+- **Status:** IN PROGRESS — issue [#769](https://git.mosaicstack.dev/mosaicstack/stack/issues/769); implementation held until tracking commit and baseline evidence are pushed.
+- **Owner:** **`web1:kbn-schema-coder2`** author lane; independent DB reviewer, SecReview, and Codex-Ultron required.
 - **Mode:** SERIAL.
 - **Exclusive files:** `packages/db/src/schema.ts`, `packages/db/drizzle/**`, DB tests.
 - **IN:** All frozen tables/joins/enums; workspace/project-congruent constraints; owners/principals; tags/archive; change proposals with both workspace-aware task-event composite FKs and frozen event-before-proposal DDL order; assignment approvals; durable execution/quarantine; monotonic bigint fence; exact checkpoint/evidence joins; RESTRICT/immutability; concrete current-main expand/backfill/switch/contract map.
 - **OUT:** Repositories, Gateway, Coordinator behavior, UI, importer.
 - **Depends on:** **KBN-010 completed**.
 - **Contract surfaces:** `kanban-schema.v1.ts`; SHARED-CONTRACT current-main delta map.
-- **Evidence:** reviewed SQL; empty/prod-shape/partial-resume/rollback tests; N-1 app safety; legacy columns remain declared; workspace/project mismatch negatives; proposal event-FK missing/foreign-workspace tests; one active lease; monotonic fence; parent-delete RESTRICT; immutability privileges; SecReview.
+- **Evidence:** TDD RED/GREEN; reviewed generated SQL/journal; real PostgreSQL empty/prod-shape/partial-resume/rollback tests; N-1 startup/read/write safety; legacy columns remain declared; workspace/project mismatch negatives; N100-01..50 including rc.4 candidate-before-FK and two-child foreign-workspace tests; proposal event-FK missing/foreign/unrelated tests; one active lease; monotonic fence; parent-delete RESTRICT; immutability privileges; independent DB review, SecReview, Codex-Ultron, terminal-green PR/main CI.
 
 ### KBN-105 — Exact Gateway/MCP endpoint, DTO, and error freeze
 

docs/scratchpads/769-kbn100-schema-migration.md

@@ -0,0 +1,52 @@
+# Issue #769 — KBN-100 unified schema and N-1 migration
+
+## Status
+
+IN PROGRESS — tracking and baseline gate. No schema or migration implementation is authorized until this scratchpad and `docs/native-kanban-sot/TASKS.md` are committed/pushed and baseline evidence is recorded.
+
+## Requirement authority
+
+- Provider issue: <https://git.mosaicstack.dev/mosaicstack/stack/issues/769>
+- Canonical requirements: `docs/requirements/native-kanban-sot.md`
+- Frozen integration contract: `docs/native-kanban-sot/SHARED-CONTRACT.md` v1.0.0-rc.4
+- Frozen target schema: `docs/native-kanban-sot/contracts/kanban-schema.v1.ts`
+- Threat/auth/constraint gate: `docs/native-kanban-sot/KBN-010-THREAT-AUTH-CONSTRAINT-GATE.md`
+- Dependency evidence: PR #765 merge `2e228007`, issue #753 closed, post-main pipeline #1813 terminal success.
+
+## Fixed decisions
+
+1. PostgreSQL is the sole writable project/task/orchestration SOT; generated projections and external transports are never import/write authority.
+2. Expand is additive and N-1-safe. Do not drop, rename, narrow, or reinterpret legacy data during this card.
+3. Backfill is bounded, idempotent, resumable, checksummed, and quarantines ambiguity rather than guessing.
+4. rc.4 SI-001 creates `missions_workspace_id_uidx(workspace_id,id)` before both dependent artifact/approval FKs while retaining global and project-congruent keys.
+5. Runtime repositories, Gateway/MCP, Coordinator behavior, clients, fleet, channels, connector fencing, deployment, and production migration execution are out of scope.
+6. Critical schema/data behavior uses TDD RED/GREEN and real PostgreSQL integration evidence; PGlite-only evidence cannot certify the migration.
+
+## Authorized paths
+
+- `packages/db/src/schema.ts`
+- `packages/db/drizzle/**`
+- DB-package tests/config files explicitly enumerated by the author before first edit
+- `docs/native-kanban-sot/TASKS.md`
+- this scratchpad
+
+Any additional path requires control-plane approval before edit.
+
+## Delivery cycle
+
+`baseline -> test design/RED -> schema+migration GREEN -> focused tests -> real PostgreSQL migration matrix -> full gates -> independent DB review -> SecReview -> remediate/rereview -> Codex-Ultron -> PR CI -> squash merge -> post-main CI -> issue close`
+
+## Baseline evidence
+
+Pending fresh author-lane intake and baseline test run.
+
+## Collision boundaries
+
+- #758 owns generic local Fleet configuration/lifecycle cards.
+- #757/#755 owns logical-agent connector identity/lease/fencing.
+- #756 channel foundation is merged and remains separate.
+- KBN-105 and all KBN consumers remain held until #769 completes.
+
+## Completion evidence
+
+Pending implementation, reviews, PR, merge, terminal-green main CI, and issue closure.