From 2f79374f4867035c33dace91c683440e7e011826 Mon Sep 17 00:00:00 2001
From: Logan Johnson <loganj@squareup.com>
Date: Wed, 14 Oct 2026 17:25:46 -0400
Subject: [PATCH] feat(relay): channel labels (#8175)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🤖
## Summary
A plugin or agent often needs to tag its own channels and then find them
again, for example "my attention-config channel" or "all channels of
this workspace". Today a channel has no labels: the relay ignores any
`t` tags in create or edit requests. This PR adds channel labels.

- A create request can carry up to 8 labels as `["t", "<label>"]` tags.
- An edit request with `t` tags replaces the label set. `["t", ""]`
alone clears it, the same convention as `["ttl", ""]`. Only owners and
admins can change labels, as for the name.
- The relay publishes each label as a `t` tag on the channel's state
events, after the channel type tag.

Part 2 of 3, stacked on part 1.

### Related issue
None found.

### Details
- **Rules.** A label uses 1–64 characters from `a-z`, `0-9`, `.`, `:`
and `-`. The relay refuses a label equal to a channel type name
(`stream`, `forum`, `dm`, `workflow`, `system`), so a label cannot make
a channel look like another type.
- **No trust from labels.** Any admin can set a label. Only the
relay-written creator tag (part 1) says who made a channel.
- **Storage.** New migration `0061_channel_labels.sql` adds
`channels.labels TEXT[] NOT NULL DEFAULT '{}'`. Channels without labels
look and behave as before.
- **Readers.** The CLI and `buzz-acp` read the channel type from the
first `t` tag. Before this PR they used the last one, which would now be
a label.
- **Spec.** NIP-CL gets a "Channel labels" section with these rules.

### Testing
- Relay tests: labels at creation appear after the type tag, edit
replaces and clears them, invalid labels are refused, and members who
are not admins cannot change them.
- Unit tests for the label rules: allowed characters, length, reserved
type names, the 8-label cap and the clear marker.
- `buzz-acp` test: the channel type comes from the first `t` tag, not a
label.

### Stack
These are two stacks. Merge them in this order. Client support
(creating, labeling and finding these channels) will be in
block/buzz-app, not the buzz SDK and CLI.

**Stack 1: channel labels and creator lookup (#8174–#8176)**

1. #8174 channel type and creator tags, and the channel creation time
2. #8175 channel labels ← this PR
3. #8176 database-side label and creator match, and the rule for
choosing one channel

**Stack 2: system channels (#8180–#8182)**, stacked on stack 1 because
it uses labels and the creator tag

4. #8180 the system channel type
5. #8181 leave system channels out of reads that do not name them
6. #8182 channel-state filters opt in to system channels

---------

Signed-off-by: Logan Johnson <loganj@squareup.com>
Co-authored-by: Larry <627498bd4bd1f281a16431e3c6cce3b5c25b6692798c78672298aefbf2f8f8b5@buzz.block.builderlab.xyz>
---
 NOSTR.md                                      |  18 +-
 crates/buzz-acp/src/relay.rs                  |  15 +-
 crates/buzz-admin/src/main.rs                 |   3 +
 crates/buzz-cli/src/commands/channels.rs      |  16 +-
 crates/buzz-core/src/channel.rs               | 208 ++++++++++++++-
 crates/buzz-db/src/runtime/migration.rs       |   4 +-
 crates/buzz-db/src/runtime/tests.rs           |  33 ++-
 .../src/store/admission_postgres_tests.rs     |   5 +
 crates/buzz-db/src/store/channel.rs           | 100 ++++++-
 crates/buzz-db/src/store/channel_members.rs   |  16 +-
 crates/buzz-db/src/store/dm.rs                |   7 +-
 .../buzz-db/src/store/relay_admin_actions.rs  |   1 +
 crates/buzz-db/src/store/replaceable.rs       |   1 +
 crates/buzz-db/src/store/thread.rs            |   3 +
 crates/buzz-relay/src/api/bridge.rs           |   2 +
 .../handlers/group_state_postgres_tests.rs    | 251 ++++++++++++++++++
 crates/buzz-relay/src/handlers/ingest.rs      |   7 +-
 .../buzz-relay/src/handlers/side_effects.rs   |  77 +++++-
 docs/nips/NIP-CL.md                           |  42 ++-
 migrations/0061_channel_labels.sql            |  13 +
 schema/tables/public/channels.sql             |   4 +
 21 files changed, 769 insertions(+), 57 deletions(-)
 create mode 100644 migrations/0061_channel_labels.sql

diff --git a/NOSTR.md b/NOSTR.md
index a3a021e490..bb9b911017 100644
--- a/NOSTR.md
+++ b/NOSTR.md
@@ -50,10 +50,10 @@ PGPASSWORD=buzz_dev psql -h localhost -U buzz -d buzz -c \
 | **Reactions (kind:7)** | ✅ | Standard NIP-25; channel derived from target event's `#e` tag (client `#h` ignored) |
 | **Deletions (kind:5)** | ✅ | Standard NIP-09; self-authored only. `#h` optional, `#e` required |
 | **User profiles (kind:0)** | ✅ | NIP-01 metadata; synced to users table (display_name, avatar, about, NIP-05). NIP-05 handles must canonicalize to this relay's domain — off-domain or invalid handles are silently cleared. If a NIP-05 handle collides with another user's (UNIQUE constraint), the handle is skipped but other profile fields (display_name, avatar, about) are still synced. |
-| **Group creation (kind:9007)** | ✅ | NIP-29; include `name` tag, optional `visibility` and `channel_type` |
+| **Group creation (kind:9007)** | ✅ | NIP-29; include `name` tag, optional `visibility`, `channel_type` and label `t` tags |
 | **Add user (kind:9000)** | ✅ | Open: any user, subject to target's `channel_add_policy` (`owner_only`/`nobody` can block). Private: owner/admin only. Self-add bypasses agent policy but not private-channel auth. |
 | **Remove user (kind:9001)** | ✅ | Self-remove allowed (with last-owner guard). Removing others: owner/admin only. |
-| **Edit group metadata (kind:9002)** | ✅ | `name`/`about` tags: owner/admin. `topic`/`purpose` tags: any member. |
+| **Edit group metadata (kind:9002)** | ✅ | `name`/`about`/label `t` tags: owner/admin. `topic`/`purpose` tags: any member. |
 | **Admin delete event (kind:9005)** | ✅ | Event author can always delete own. Otherwise owner/admin required. Target must be in same channel. |
 | **Group deletion (kind:9008)** | ✅ | Owner only. |
 | **Leave group (kind:9022)** | ✅ | Any member. Last-owner guard prevents orphaned groups. |
@@ -113,7 +113,9 @@ All discovery events include a `d` tag set to the channel UUID (NIP-29 addressab
 | **39001** | `d=<uuid>`, `t=<channel_type>`, `P=<creator>`, `p` tags with role label (`owner`, `admin`) | Admin list |
 | **39002** | `d=<uuid>`, `t=<channel_type>`, `P=<creator>`, `p` tags for all members | Member list |
 
-On all three kinds the channel type `t` tag comes first, then `P`. `P` is
+On all three kinds the channel type `t` tag comes first, then one `t` tag
+per channel label, then `P`. Clients read the first `t` value as the
+channel type. `P` is
 the public key that signed the channel's kind:9007. The relay writes it
 from the database, and it does not change when ownership moves. Uppercase
 `P` follows NIP-22, NIP-34 and NIP-72, where it names the author of the root
@@ -124,6 +126,16 @@ kind:39000 also carries `["created_at", <unix seconds>]`: the time the
 channel was created. The event's own `created_at` is the time of the last
 edit, so use the tag to find the older of two channels.
 
+**Channel labels.** A label groups channels across channel types, for
+example `["t", "workspace"]`. Set labels with `["t", <label>]` tags on
+kind:9007. On kind:9002 the `t` tags replace the whole set, and
+`["t", ""]` with no other `t` tag clears it; a kind:9002 without `t` tags
+leaves the labels as they are. Only an owner or admin may change labels.
+The relay refuses a label set with more than 8 distinct labels, a label
+that is not 1-64 characters from `a-z`, `0-9`, `.`, `:` and `-`, or a
+label equal to a channel type name (`stream`, `forum`, `dm`, `workflow`,
+`system`).
+
 Events are stored **channel-scoped** so access control applies — private channel member lists are
 only visible to members. Discover groups via historical REQ:
 
diff --git a/crates/buzz-acp/src/relay.rs b/crates/buzz-acp/src/relay.rs
index e1046c4d4a..5587682d0b 100644
--- a/crates/buzz-acp/src/relay.rs
+++ b/crates/buzz-acp/src/relay.rs
@@ -149,7 +149,10 @@ pub(crate) fn channel_type_from_tags(tags: &[serde_json::Value]) -> String {
             match arr.first().and_then(|v| v.as_str()) {
                 Some("hidden") => is_hidden = true,
                 Some("private") => is_private = true,
-                Some("t") => declared_type = arr.get(1).and_then(|v| v.as_str()),
+                // The first `t` is the channel type; later `t` tags are labels.
+                Some("t") if declared_type.is_none() => {
+                    declared_type = arr.get(1).and_then(|v| v.as_str())
+                }
                 _ => {}
             }
         }
@@ -4189,6 +4192,16 @@ mod recovery_tests;
 mod tests {
     use super::*;
 
+    #[test]
+    fn channel_type_comes_from_the_first_t_tag_not_a_label() {
+        let tags = vec![
+            serde_json::json!(["d", "c"]),
+            serde_json::json!(["t", "dm"]),
+            serde_json::json!(["t", "workspace"]),
+        ];
+        assert_eq!(channel_type_from_tags(&tags), "dm");
+    }
+
     async fn nip11_test_client(
         responses: HashMap<String, (u16, String)>,
     ) -> (
diff --git a/crates/buzz-admin/src/main.rs b/crates/buzz-admin/src/main.rs
index 9c4177b701..736b8d4f12 100644
--- a/crates/buzz-admin/src/main.rs
+++ b/crates/buzz-admin/src/main.rs
@@ -842,6 +842,7 @@ async fn reconcile_channels(
                 tags.push(Tag::parse(["closed"])?);
                 tags.extend(group_state_identity_tags(
                     &channel.channel_type,
+                    &channel.labels,
                     &channel.created_by,
                 )?);
                 tags.push(channel_created_at_tag(channel.created_at.timestamp())?);
@@ -859,6 +860,7 @@ async fn reconcile_channels(
                 let mut tags: Vec<Tag> = vec![Tag::parse(["d", &channel_id_str])?];
                 tags.extend(group_state_identity_tags(
                     &channel.channel_type,
+                    &channel.labels,
                     &channel.created_by,
                 )?);
                 for m in members
@@ -882,6 +884,7 @@ async fn reconcile_channels(
             let mut tags: Vec<Tag> = vec![Tag::parse(["d", &channel_id_str])?];
             tags.extend(group_state_identity_tags(
                 &channel.channel_type,
+                &channel.labels,
                 &channel.created_by,
             )?);
             for m in &members {
diff --git a/crates/buzz-cli/src/commands/channels.rs b/crates/buzz-cli/src/commands/channels.rs
index f956d0f7f9..31de6035e2 100644
--- a/crates/buzz-cli/src/commands/channels.rs
+++ b/crates/buzz-cli/src/commands/channels.rs
@@ -192,7 +192,8 @@ impl ChannelSummary {
             match key {
                 "d" => channel_id = val.map(str::to_string),
                 "name" => name = val.map(str::to_string),
-                "t" => channel_type = val.map(str::to_string),
+                // The first `t` is the channel type; later `t` tags are labels.
+                "t" if channel_type.is_none() => channel_type = val.map(str::to_string),
                 // NIP-29 emits both `private` and `public` (Buzz adds the latter).
                 // The presence of either tag is the source of truth; tag value is unused.
                 "private" => visibility = Some("private".to_string()),
@@ -2008,6 +2009,19 @@ mod tests {
         }
     }
 
+    #[test]
+    fn from_event_reads_the_type_from_the_first_t_tag() {
+        let ev = event(json!([
+            ["d", "11111111-1111-1111-1111-111111111111"],
+            ["name", "labeled"],
+            ["t", "forum"],
+            ["t", "workspace"],
+            ["P", "ab".repeat(32)],
+        ]));
+        let s = ChannelSummary::from_event(&ev).expect("parse");
+        assert_eq!(s.channel_type.as_deref(), Some("forum"));
+    }
+
     #[test]
     fn from_event_extracts_known_tags() {
         let ev = event(json!([
diff --git a/crates/buzz-core/src/channel.rs b/crates/buzz-core/src/channel.rs
index 41ba48670c..0a40dca926 100644
--- a/crates/buzz-core/src/channel.rs
+++ b/crates/buzz-core/src/channel.rs
@@ -17,26 +17,110 @@ pub fn canonical_channel_name(name: &str) -> &str {
         .trim_end()
 }
 
+/// Maximum number of labels on one channel.
+pub const MAX_CHANNEL_LABELS: usize = 8;
+
+/// Maximum length of one channel label, in bytes.
+pub const MAX_CHANNEL_LABEL_LEN: usize = 64;
+
+/// Names a label may not take, because the channel type uses the same `t`
+/// tag. A label equal to one of these could make a channel look like
+/// another type. The list includes types that a later relay may add.
+pub const RESERVED_CHANNEL_LABELS: &[&str] = &["stream", "forum", "dm", "workflow", "system"];
+
+/// Why a set of channel labels was refused.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+pub enum ChannelLabelError {
+    /// More than [`MAX_CHANNEL_LABELS`] distinct labels.
+    #[error("too many labels: at most {MAX_CHANNEL_LABELS} are allowed")]
+    TooMany,
+    /// A label is not 1–64 characters from `a-z`, `0-9`, `.`, `:` and `-`.
+    #[error("invalid label {0:?}: use 1-{MAX_CHANNEL_LABEL_LEN} characters from a-z, 0-9, '.', ':' and '-'")]
+    Invalid(String),
+    /// A label equals a channel type name.
+    #[error("invalid label {0:?}: a label cannot be a channel type name")]
+    Reserved(String),
+    /// The clear marker `""` was combined with other labels.
+    #[error("an empty label clears all labels and cannot be combined with other labels")]
+    ClearWithOthers,
+}
+
+/// Validate the values of a channel's `["t", <label>]` tags and return the
+/// label set to store, in first-seen order without duplicates.
+///
+/// `""` alone (one or more times) means "no labels" and returns an empty
+/// set; kind:9002 uses it to clear the labels, the same convention as
+/// `["ttl", ""]`. Repeated labels are stored once and count once toward
+/// [`MAX_CHANNEL_LABELS`].
+pub fn parse_channel_labels<'a>(
+    values: impl IntoIterator<Item = &'a str>,
+) -> Result<Vec<String>, ChannelLabelError> {
+    let values: Vec<&str> = values.into_iter().collect();
+    if values.contains(&"") {
+        return if values.iter().all(|value| value.is_empty()) {
+            Ok(Vec::new())
+        } else {
+            Err(ChannelLabelError::ClearWithOthers)
+        };
+    }
+    let mut labels: Vec<String> = Vec::with_capacity(values.len());
+    for value in values {
+        let valid = value.len() <= MAX_CHANNEL_LABEL_LEN
+            && value.bytes().all(|byte| {
+                byte.is_ascii_lowercase() || byte.is_ascii_digit() || b".:-".contains(&byte)
+            });
+        if !valid {
+            return Err(ChannelLabelError::Invalid(value.to_owned()));
+        }
+        if RESERVED_CHANNEL_LABELS.contains(&value) {
+            return Err(ChannelLabelError::Reserved(value.to_owned()));
+        }
+        if !labels.iter().any(|label| label == value) {
+            labels.push(value.to_owned());
+        }
+    }
+    if labels.len() > MAX_CHANNEL_LABELS {
+        return Err(ChannelLabelError::TooMany);
+    }
+    Ok(labels)
+}
+
 /// Tags that identify a channel on every NIP-29 group-state event the relay
 /// signs (kinds 39000–39002), in this order:
 ///
 /// 1. `["t", <channel_type>]`. It comes first, so a client that reads the
 ///    first `t` tag gets the channel type.
-/// 2. `["P", <creator hex>]`: the key that signed the channel's kind:9007.
+/// 2. `["t", <label>]` for each label, in stored order.
+/// 3. `["P", <creator hex>]`: the key that signed the channel's kind:9007.
 ///    It comes from the database and does not change when ownership moves.
 ///    Uppercase `P` names the author of the root object, as in NIP-22,
 ///    NIP-34 and NIP-72; lowercase `p` already means members and DM
 ///    participants on these kinds.
 ///
-/// Filters such as `{kinds:[39000], #P:[<key>]}` select by these tags.
+/// Filters such as `{kinds:[39000], #P:[<key>], #t:[<label>]}` select by
+/// these tags.
 pub fn group_state_identity_tags(
     channel_type: &str,
+    labels: &[String],
     created_by: &[u8],
 ) -> Result<Vec<nostr::Tag>, nostr::event::tag::Error> {
-    Ok(vec![
-        nostr::Tag::parse(["t", channel_type])?,
-        nostr::Tag::parse(["P", &hex::encode(created_by)])?,
-    ])
+    let mut tags = Vec::with_capacity(labels.len() + 2);
+    tags.push(nostr::Tag::parse(["t", channel_type])?);
+    for label in labels {
+        tags.push(nostr::Tag::parse(["t", label.as_str()])?);
+    }
+    tags.push(nostr::Tag::parse(["P", &hex::encode(created_by)])?);
+    Ok(tags)
+}
+
+/// Return the channel type from group-state tags: the value of the first
+/// `t` tag. Later `t` tags are labels.
+pub fn channel_type_from_group_state_tags<'a>(
+    tags: impl IntoIterator<Item = &'a nostr::Tag>,
+) -> Option<&'a str> {
+    tags.into_iter()
+        .find(|tag| tag.kind() == nostr::TagKind::t())
+        .and_then(|tag| tag.content())
 }
 
 /// Tag on kind:39000 that holds the channel's creation time in Unix seconds.
@@ -213,25 +297,123 @@ impl FromStr for MemberRole {
 
 #[cfg(test)]
 mod tests {
-    use super::{canonical_channel_name, group_state_identity_tags};
+    use super::{
+        canonical_channel_name, channel_type_from_group_state_tags, group_state_identity_tags,
+        parse_channel_labels, ChannelLabelError, ChannelType, MAX_CHANNEL_LABELS,
+        RESERVED_CHANNEL_LABELS,
+    };
+
+    /// Every channel type name is reserved, so a label cannot pose as a type.
+    /// The `match` has no wildcard: a new `ChannelType` variant does not
+    /// compile until it is added to `ALL` here, and then this test fails
+    /// until its name is in `RESERVED_CHANNEL_LABELS`.
+    #[test]
+    fn every_channel_type_name_is_a_reserved_label() {
+        const ALL: [ChannelType; 4] = [
+            ChannelType::Stream,
+            ChannelType::Forum,
+            ChannelType::Dm,
+            ChannelType::Workflow,
+        ];
+        for channel_type in ALL {
+            match channel_type {
+                ChannelType::Stream
+                | ChannelType::Forum
+                | ChannelType::Dm
+                | ChannelType::Workflow => {}
+            }
+            assert!(
+                RESERVED_CHANNEL_LABELS.contains(&channel_type.as_str()),
+                "{channel_type:?} is not a reserved label"
+            );
+        }
+    }
 
     #[test]
-    fn group_state_identity_tags_put_the_type_first_then_the_creator() {
+    fn group_state_identity_tags_put_the_type_first_then_labels_then_the_creator() {
         let creator = [0xab; 32];
-        let tags: Vec<Vec<String>> = group_state_identity_tags("forum", &creator)
-            .expect("valid tags")
-            .into_iter()
-            .map(|tag| tag.to_vec())
-            .collect();
+        let labels = vec!["workspace".to_string(), "team:core".to_string()];
+        let built = group_state_identity_tags("forum", &labels, &creator).expect("valid tags");
+        assert_eq!(channel_type_from_group_state_tags(&built), Some("forum"));
+        let tags: Vec<Vec<String>> = built.into_iter().map(|tag| tag.to_vec()).collect();
         assert_eq!(
             tags,
             vec![
                 vec!["t".to_string(), "forum".to_string()],
+                vec!["t".to_string(), "workspace".to_string()],
+                vec!["t".to_string(), "team:core".to_string()],
                 vec!["P".to_string(), "ab".repeat(32)],
             ]
         );
     }
 
+    #[test]
+    fn channel_labels_accept_the_allowed_alphabet_and_drop_duplicates() {
+        assert_eq!(
+            parse_channel_labels(["agent-attention", "v1.2:x", "agent-attention"]),
+            Ok(vec!["agent-attention".to_string(), "v1.2:x".to_string()])
+        );
+        assert_eq!(
+            parse_channel_labels(["a".repeat(64).as_str()]),
+            Ok(vec!["a".repeat(64)])
+        );
+    }
+
+    #[test]
+    fn channel_labels_refuse_bad_characters_lengths_and_type_names() {
+        for bad in ["Upper", "has space", "under_score", "emoji🙂"] {
+            assert_eq!(
+                parse_channel_labels([bad]),
+                Err(ChannelLabelError::Invalid(bad.to_string()))
+            );
+        }
+        let long = "a".repeat(65);
+        assert_eq!(
+            parse_channel_labels([long.as_str()]),
+            Err(ChannelLabelError::Invalid(long.clone()))
+        );
+        for reserved in ["stream", "forum", "dm", "workflow", "system"] {
+            assert_eq!(
+                parse_channel_labels([reserved]),
+                Err(ChannelLabelError::Reserved(reserved.to_string()))
+            );
+        }
+    }
+
+    #[test]
+    fn channel_labels_cap_the_distinct_count() {
+        let names: Vec<String> = (0..=MAX_CHANNEL_LABELS).map(|i| format!("l{i}")).collect();
+        assert_eq!(
+            parse_channel_labels(names.iter().map(String::as_str)),
+            Err(ChannelLabelError::TooMany)
+        );
+        assert_eq!(
+            parse_channel_labels(names[..MAX_CHANNEL_LABELS].iter().map(String::as_str))
+                .map(|labels| labels.len()),
+            Ok(MAX_CHANNEL_LABELS)
+        );
+        // Nine tags with one repeat are 8 distinct labels.
+        let mut repeated: Vec<&str> = names[..MAX_CHANNEL_LABELS]
+            .iter()
+            .map(String::as_str)
+            .collect();
+        repeated.push(repeated[0]);
+        assert_eq!(
+            parse_channel_labels(repeated).map(|labels| labels.len()),
+            Ok(MAX_CHANNEL_LABELS)
+        );
+    }
+
+    #[test]
+    fn empty_labels_clear_and_cannot_mix_with_labels() {
+        assert_eq!(parse_channel_labels([""]), Ok(Vec::new()));
+        assert_eq!(parse_channel_labels(["", ""]), Ok(Vec::new()));
+        assert_eq!(
+            parse_channel_labels(["", "workspace"]),
+            Err(ChannelLabelError::ClearWithOthers)
+        );
+    }
+
     #[test]
     fn channel_names_trim_whitespace_and_drop_all_leading_hashes() {
         assert_eq!(canonical_channel_name("channel"), "channel");
diff --git a/crates/buzz-db/src/runtime/migration.rs b/crates/buzz-db/src/runtime/migration.rs
index b6ead54e06..8c40861900 100644
--- a/crates/buzz-db/src/runtime/migration.rs
+++ b/crates/buzz-db/src/runtime/migration.rs
@@ -705,7 +705,7 @@ mod postgres_tests {
         let mut migrations: Vec<_> = MIGRATOR.iter().collect();
         migrations.sort_by_key(|migration| migration.version);
 
-        assert_eq!(migrations.len(), 60);
+        assert_eq!(migrations.len(), 61);
         assert_eq!(migrations[58].version, 59);
         assert!(migrations[58].sql.as_str().contains("buzz.push_enabled"));
         assert_eq!(migrations[59].version, 60);
@@ -713,6 +713,8 @@ mod postgres_tests {
             .sql
             .as_str()
             .contains("ALTER TABLE push_leases DROP COLUMN app_profile"));
+        assert_eq!(migrations[60].version, 61);
+        assert!(migrations[60].sql.as_str().contains("ADD COLUMN labels"));
         assert_eq!(migrations[55].version, 56);
         assert!(migrations[55]
             .sql
diff --git a/crates/buzz-db/src/runtime/tests.rs b/crates/buzz-db/src/runtime/tests.rs
index 2e0e260bd2..3fe785134c 100644
--- a/crates/buzz-db/src/runtime/tests.rs
+++ b/crates/buzz-db/src/runtime/tests.rs
@@ -874,6 +874,10 @@ async fn push_gateway_profile_migration_converges_brownfield_authority() {
 
 /// Insert identical community + channel rows into a database so the same
 /// (community, channel) ids resolve in both writer and replica.
+///
+/// Raw SQL with only columns from the initial schema: some callers seed a
+/// scratch database migrated to an older version, which lacks columns that
+/// the current channel store writes (for example `labels`).
 async fn seed_community_channel(
     pool: &PgPool,
     community: Uuid,
@@ -886,19 +890,28 @@ async fn seed_community_channel(
         .execute(pool)
         .await
         .expect("insert community");
-    crate::channel::create_channel_with_id(
-        pool,
-        CommunityId::from_uuid(community),
-        channel,
-        &format!("replica-routing-{channel}"),
-        crate::channel::ChannelType::Stream,
-        crate::channel::ChannelVisibility::Open,
-        None,
-        author.public_key().to_bytes().as_slice(),
-        None,
+    let author = author.public_key().to_bytes();
+    sqlx::query(
+        "INSERT INTO channels (id, community_id, name, channel_type, visibility, created_by) \
+         VALUES ($1, $2, $3, 'stream', 'open', $4)",
     )
+    .bind(channel)
+    .bind(community)
+    .bind(format!("replica-routing-{channel}"))
+    .bind(author.as_slice())
+    .execute(pool)
     .await
     .expect("create channel");
+    sqlx::query(
+        "INSERT INTO channel_members (community_id, channel_id, pubkey, role, invited_by) \
+         VALUES ($1, $2, $3, 'owner', $3)",
+    )
+    .bind(community)
+    .bind(channel)
+    .bind(author.as_slice())
+    .execute(pool)
+    .await
+    .expect("add channel owner");
 }
 
 fn signed_event_at(keys: &nostr::Keys, content: &str, secs: u64) -> nostr::Event {
diff --git a/crates/buzz-db/src/store/admission_postgres_tests.rs b/crates/buzz-db/src/store/admission_postgres_tests.rs
index 6f1d8cab68..2c65beecb4 100644
--- a/crates/buzz-db/src/store/admission_postgres_tests.rs
+++ b/crates/buzz-db/src/store/admission_postgres_tests.rs
@@ -460,6 +460,7 @@ async fn channel_and_membership_writers_require_application_admission() {
                 None,
                 &creator,
                 None,
+                &[],
             )
             .await
             .expect_err("channel create must reject"),
@@ -491,6 +492,7 @@ async fn channel_and_membership_writers_require_application_admission() {
         None,
         &creator,
         None,
+        &[],
     )
     .await
     .expect("active channel create succeeds");
@@ -561,6 +563,7 @@ async fn thread_metadata_writer_requires_application_admission() {
         None,
         &[1; 32],
         None,
+        &[],
     )
     .await
     .expect("active channel");
@@ -607,6 +610,7 @@ async fn relay_admin_domain_writer_requires_application_admission() {
         None,
         &[1; 32],
         None,
+        &[],
     )
     .await
     .expect("active channel");
@@ -654,6 +658,7 @@ async fn personal_read_writer_requires_application_admission() {
         None,
         &actor.public_key().to_bytes(),
         None,
+        &[],
     )
     .await
     .expect("active channel");
diff --git a/crates/buzz-db/src/store/channel.rs b/crates/buzz-db/src/store/channel.rs
index 13a93263e9..d8ff4dad9c 100644
--- a/crates/buzz-db/src/store/channel.rs
+++ b/crates/buzz-db/src/store/channel.rs
@@ -76,6 +76,8 @@ pub struct ChannelRecord {
     pub ttl_seconds: Option<i32>,
     /// Deadline by which a new message must arrive or the channel is auto-archived.
     pub ttl_deadline: Option<DateTime<Utc>>,
+    /// Labels published as `["t", <label>]` after the channel type tag.
+    pub labels: Vec<String>,
 }
 
 impl ChannelRecord {
@@ -83,6 +85,7 @@ impl ChannelRecord {
     pub fn identity(&self) -> ChannelIdentity {
         ChannelIdentity {
             channel_type: self.channel_type.clone(),
+            labels: self.labels.clone(),
             created_by: self.created_by.clone(),
         }
     }
@@ -99,6 +102,7 @@ pub async fn create_channel(
     description: Option<&str>,
     created_by: &[u8],
     ttl_seconds: Option<i32>,
+    labels: &[String],
 ) -> Result<ChannelRecord> {
     if created_by.len() != 32 {
         return Err(DbError::InvalidData(format!(
@@ -123,9 +127,9 @@ pub async fn create_channel(
 
     sqlx::query(
         r#"
-        INSERT INTO channels (id, community_id, name, channel_type, visibility, description, created_by, ttl_seconds, ttl_deadline)
+        INSERT INTO channels (id, community_id, name, channel_type, visibility, description, created_by, ttl_seconds, ttl_deadline, labels)
         VALUES ($1, $2, $3, $4::channel_type, $5::channel_visibility, $6, $7, $8,
-                CASE WHEN $8 IS NOT NULL THEN NOW() + ($8 || ' seconds')::interval ELSE NULL END)
+                CASE WHEN $8 IS NOT NULL THEN NOW() + ($8 || ' seconds')::interval ELSE NULL END, $9)
         "#,
     )
     .bind(id)
@@ -136,6 +140,7 @@ pub async fn create_channel(
     .bind(description)
     .bind(created_by)
     .bind(ttl_seconds)
+    .bind(labels)
     .execute(tx.conn())
     .await?;
 
@@ -164,7 +169,7 @@ pub async fn create_channel(
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
                purpose, purpose_set_by, purpose_set_at,
-               ttl_seconds, ttl_deadline
+               ttl_seconds, ttl_deadline, labels
         FROM channels WHERE community_id = $1 AND id = $2
         "#,
     )
@@ -193,6 +198,7 @@ pub async fn create_channel_with_id(
     description: Option<&str>,
     created_by: &[u8],
     ttl_seconds: Option<i32>,
+    labels: &[String],
 ) -> Result<(ChannelRecord, bool)> {
     if created_by.len() != 32 {
         return Err(DbError::InvalidData(format!(
@@ -221,9 +227,9 @@ pub async fn create_channel_with_id(
 
     let rows_affected = sqlx::query(
         r#"
-        INSERT INTO channels (id, community_id, name, channel_type, visibility, description, created_by, ttl_seconds, ttl_deadline)
+        INSERT INTO channels (id, community_id, name, channel_type, visibility, description, created_by, ttl_seconds, ttl_deadline, labels)
         VALUES ($1, $2, $3, $4::channel_type, $5::channel_visibility, $6, $7, $8,
-                CASE WHEN $8 IS NOT NULL THEN NOW() + ($8 || ' seconds')::interval ELSE NULL END)
+                CASE WHEN $8 IS NOT NULL THEN NOW() + ($8 || ' seconds')::interval ELSE NULL END, $9)
         ON CONFLICT (community_id, id) DO NOTHING
         "#,
     )
@@ -235,6 +241,7 @@ pub async fn create_channel_with_id(
     .bind(description)
     .bind(created_by)
     .bind(ttl_seconds)
+    .bind(labels)
     .execute(tx.conn())
     .await?
     .rows_affected();
@@ -269,7 +276,7 @@ pub async fn create_channel_with_id(
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
                purpose, purpose_set_by, purpose_set_at,
-               ttl_seconds, ttl_deadline
+               ttl_seconds, ttl_deadline, labels
         FROM channels WHERE community_id = $1 AND id = $2
         "#,
     )
@@ -313,7 +320,7 @@ async fn get_channel_with_operation(
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
                purpose, purpose_set_by, purpose_set_at,
-               ttl_seconds, ttl_deadline
+               ttl_seconds, ttl_deadline, labels
         FROM channels WHERE community_id = $1 AND id = $2 AND deleted_at IS NULL
         "#,
     )
@@ -402,7 +409,7 @@ async fn list_channels_with_operation(
                    nip29_group_id, topic_required, max_members,
                    topic, topic_set_by, topic_set_at,
                    purpose, purpose_set_by, purpose_set_at,
-                   ttl_seconds, ttl_deadline
+                   ttl_seconds, ttl_deadline, labels
             FROM channels
             WHERE community_id = $1 AND deleted_at IS NULL AND visibility::text = $2
             ORDER BY created_at DESC
@@ -422,7 +429,7 @@ async fn list_channels_with_operation(
                    nip29_group_id, topic_required, max_members,
                    topic, topic_set_by, topic_set_at,
                    purpose, purpose_set_by, purpose_set_at,
-                   ttl_seconds, ttl_deadline
+                   ttl_seconds, ttl_deadline, labels
             FROM channels
             WHERE community_id = $1 AND deleted_at IS NULL
             ORDER BY created_at DESC
@@ -486,6 +493,7 @@ pub(crate) fn row_to_channel_record(row: sqlx::postgres::PgRow) -> Result<Channe
         purpose_set_at,
         ttl_seconds,
         ttl_deadline,
+        labels: row.try_get("labels")?,
     })
 }
 
@@ -503,6 +511,9 @@ pub struct ChannelUpdate {
     /// ephemeral TTL (channel becomes permanent), `Some(Some(secs))` sets it.
     /// On any change the `ttl_deadline` is reset to `NOW() + ttl_seconds`.
     pub ttl_seconds: Option<Option<i32>>,
+    /// Replacement label set (empty clears it), or `None` to leave unchanged.
+    /// Callers validate with `buzz_core::channel::parse_channel_labels`.
+    pub labels: Option<Vec<String>>,
 }
 
 /// Updates channel metadata dynamically.
@@ -519,6 +530,7 @@ pub async fn update_channel(
         && updates.description.is_none()
         && updates.visibility.is_none()
         && updates.ttl_seconds.is_none()
+        && updates.labels.is_none()
     {
         return Err(DbError::InvalidData(
             "at least one field must be provided for update".to_string(),
@@ -560,6 +572,10 @@ pub async fn update_channel(
             None => set_parts.push("ttl_deadline = NULL".to_string()),
         }
     }
+    if updates.labels.is_some() {
+        set_parts.push(format!("labels = ${param_idx}"));
+        param_idx += 1;
+    }
     let channel_param_idx = param_idx + 1;
     let sql = format!(
         "UPDATE channels SET {}, updated_at = NOW() WHERE community_id = ${param_idx} AND id = ${channel_param_idx} AND deleted_at IS NULL",
@@ -579,6 +595,9 @@ pub async fn update_channel(
     if let Some(ref ttl) = updates.ttl_seconds {
         q = q.bind(*ttl);
     }
+    if let Some(ref labels) = updates.labels {
+        q = q.bind(labels);
+    }
     q = q.bind(community_id.as_uuid());
     q = q.bind(channel_id);
 
@@ -879,6 +898,7 @@ impl Db {
             description,
             created_by,
             ttl_seconds,
+            &[],
         )
         .await
     }
@@ -909,6 +929,68 @@ impl Db {
             description,
             created_by,
             ttl_seconds,
+            &[],
+        )
+        .await
+    }
+
+    /// Creates a channel with a client-supplied UUID and an initial label set.
+    ///
+    /// The same as [`Db::create_channel_with_id`], plus `labels`, which the
+    /// caller has validated with `buzz_core::channel::parse_channel_labels`.
+    #[allow(clippy::too_many_arguments)]
+    #[datastore_span(name = "create_labeled_channel_with_id", system = "postgresql")]
+    pub async fn create_labeled_channel_with_id(
+        &self,
+        community_id: CommunityId,
+        channel_id: Uuid,
+        name: &str,
+        channel_type: ChannelType,
+        visibility: ChannelVisibility,
+        description: Option<&str>,
+        created_by: &[u8],
+        ttl_seconds: Option<i32>,
+        labels: &[String],
+    ) -> Result<(ChannelRecord, bool)> {
+        create_channel_with_id(
+            &self.pool,
+            community_id,
+            channel_id,
+            name,
+            channel_type,
+            visibility,
+            description,
+            created_by,
+            ttl_seconds,
+            labels,
+        )
+        .await
+    }
+
+    /// Creates a channel with a relay-chosen UUID and an initial label set.
+    #[allow(clippy::too_many_arguments)]
+    #[datastore_span(name = "create_labeled_channel", system = "postgresql")]
+    pub async fn create_labeled_channel(
+        &self,
+        community_id: CommunityId,
+        name: &str,
+        channel_type: ChannelType,
+        visibility: ChannelVisibility,
+        description: Option<&str>,
+        created_by: &[u8],
+        ttl_seconds: Option<i32>,
+        labels: &[String],
+    ) -> Result<ChannelRecord> {
+        create_channel(
+            &self.pool,
+            community_id,
+            name,
+            channel_type,
+            visibility,
+            description,
+            created_by,
+            ttl_seconds,
+            labels,
         )
         .await
     }
diff --git a/crates/buzz-db/src/store/channel_members.rs b/crates/buzz-db/src/store/channel_members.rs
index 1994de14ed..fd3041f969 100644
--- a/crates/buzz-db/src/store/channel_members.rs
+++ b/crates/buzz-db/src/store/channel_members.rs
@@ -307,6 +307,8 @@ pub async fn insert_auto_membership_in_transaction(
 pub struct ChannelIdentity {
     /// Channel type string (e.g. `"stream"`, `"forum"`, `"dm"`).
     pub channel_type: String,
+    /// Labels, published as `t` tags after the channel type.
+    pub labels: Vec<String>,
     /// Public key bytes of the channel creator (the kind:9007 signer).
     pub created_by: Vec<u8>,
 }
@@ -316,7 +318,7 @@ pub struct ChannelIdentity {
 pub struct LockedMemberSnapshot {
     /// Canonical active members captured behind the lock.
     pub members: Vec<MemberRecord>,
-    /// The channel's type and creator, read on the same connection, so the
+    /// The channel's type, labels and creator, read on the same connection, so the
     /// roster carries the same identity tags as the channel's other
     /// group-state events. `None` when no channel row exists.
     pub identity: Option<ChannelIdentity>,
@@ -491,15 +493,16 @@ pub async fn lock_member_snapshot(
         .into_iter()
         .map(row_to_member_record)
         .collect::<Result<Vec<_>>>()?;
-    let identity = sqlx::query_as::<_, (String, Vec<u8>)>(
-        "SELECT channel_type::text, created_by FROM channels WHERE community_id = $1 AND id = $2",
+    let identity = sqlx::query_as::<_, (String, Vec<String>, Vec<u8>)>(
+        "SELECT channel_type::text, labels, created_by FROM channels WHERE community_id = $1 AND id = $2",
     )
     .bind(community_id.as_uuid())
     .bind(channel_id)
     .fetch_optional(tx.conn())
     .await?
-    .map(|(channel_type, created_by)| ChannelIdentity {
+    .map(|(channel_type, labels, created_by)| ChannelIdentity {
         channel_type,
+        labels,
         created_by,
     });
     Ok(LockedMemberSnapshot {
@@ -1270,7 +1273,7 @@ async fn get_channel_tx(
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
                purpose, purpose_set_by, purpose_set_at,
-               ttl_seconds, ttl_deadline
+               ttl_seconds, ttl_deadline, labels
         FROM channels WHERE community_id = $1 AND id = $2 AND deleted_at IS NULL
         "#,
     )
@@ -1366,7 +1369,7 @@ pub async fn get_accessible_channels(
                c.nip29_group_id, c.topic_required, c.max_members,
                c.topic, c.topic_set_by, c.topic_set_at,
                c.purpose, c.purpose_set_by, c.purpose_set_at,
-               c.ttl_seconds, c.ttl_deadline,
+               c.ttl_seconds, c.ttl_deadline, c.labels,
                (cm.channel_id IS NOT NULL) AS is_member
         FROM channels c
         LEFT JOIN channel_members cm
@@ -3491,6 +3494,7 @@ mod postgres_tests {
             None,
             author.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("create channel");
diff --git a/crates/buzz-db/src/store/dm.rs b/crates/buzz-db/src/store/dm.rs
index 8d51866e85..021376b315 100644
--- a/crates/buzz-db/src/store/dm.rs
+++ b/crates/buzz-db/src/store/dm.rs
@@ -76,7 +76,7 @@ pub async fn find_dm_by_participants(
                created_by, created_at, updated_at, archived_at, deleted_at,
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
-               purpose, purpose_set_by, purpose_set_at
+               purpose, purpose_set_by, purpose_set_at, labels
         FROM channels
         WHERE community_id = $1
           AND participant_hash = $2
@@ -142,7 +142,7 @@ pub async fn create_dm(
                created_by, created_at, updated_at, archived_at, deleted_at,
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
-               purpose, purpose_set_by, purpose_set_at
+               purpose, purpose_set_by, purpose_set_at, labels
         FROM channels
         WHERE community_id = $1
           AND participant_hash = $2
@@ -212,7 +212,7 @@ pub async fn create_dm(
                created_by, created_at, updated_at, archived_at, deleted_at,
                nip29_group_id, topic_required, max_members,
                topic, topic_set_by, topic_set_at,
-               purpose, purpose_set_by, purpose_set_at
+               purpose, purpose_set_by, purpose_set_at, labels
         FROM channels WHERE community_id = $1 AND id = $2
         "#,
     )
@@ -532,6 +532,7 @@ fn row_to_channel_record(row: sqlx::postgres::PgRow) -> Result<ChannelRecord> {
         purpose_set_at: row.try_get("purpose_set_at").unwrap_or(None),
         ttl_seconds: row.try_get("ttl_seconds").unwrap_or(None),
         ttl_deadline: row.try_get("ttl_deadline").unwrap_or(None),
+        labels: row.try_get("labels")?,
     })
 }
 
diff --git a/crates/buzz-db/src/store/relay_admin_actions.rs b/crates/buzz-db/src/store/relay_admin_actions.rs
index e1cf4ca4c5..305ab18de2 100644
--- a/crates/buzz-db/src/store/relay_admin_actions.rs
+++ b/crates/buzz-db/src/store/relay_admin_actions.rs
@@ -3228,6 +3228,7 @@ mod postgres_tests {
             None,
             keys.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("channel");
diff --git a/crates/buzz-db/src/store/replaceable.rs b/crates/buzz-db/src/store/replaceable.rs
index 1bce5766a4..5cb76d7262 100644
--- a/crates/buzz-db/src/store/replaceable.rs
+++ b/crates/buzz-db/src/store/replaceable.rs
@@ -739,6 +739,7 @@ mod postgres_tests {
             None,
             author.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("create channel");
diff --git a/crates/buzz-db/src/store/thread.rs b/crates/buzz-db/src/store/thread.rs
index 719861241c..9a18554efe 100644
--- a/crates/buzz-db/src/store/thread.rs
+++ b/crates/buzz-db/src/store/thread.rs
@@ -1272,6 +1272,7 @@ mod postgres_tests {
                 None,
                 author.public_key().to_bytes().as_slice(),
                 None,
+                &[],
             )
             .await
             .expect("channel");
@@ -1346,6 +1347,7 @@ mod postgres_tests {
             None,
             author.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("create community A channel");
@@ -1359,6 +1361,7 @@ mod postgres_tests {
             None,
             author.public_key().to_bytes().as_slice(),
             None,
+            &[],
         )
         .await
         .expect("create community B channel");
diff --git a/crates/buzz-relay/src/api/bridge.rs b/crates/buzz-relay/src/api/bridge.rs
index 4e90a20e15..8f341341c1 100644
--- a/crates/buzz-relay/src/api/bridge.rs
+++ b/crates/buzz-relay/src/api/bridge.rs
@@ -7768,6 +7768,7 @@ pub(crate) mod postgres_tests {
                     None,
                     author.public_key().to_bytes().as_slice(),
                     None,
+                    &[],
                 )
                 .await
                 .expect("create channel");
@@ -8006,6 +8007,7 @@ pub(crate) mod postgres_tests {
                 None,
                 author.public_key().to_bytes().as_slice(),
                 None,
+                &[],
             )
             .await
             .expect("create channel");
diff --git a/crates/buzz-relay/src/handlers/group_state_postgres_tests.rs b/crates/buzz-relay/src/handlers/group_state_postgres_tests.rs
index 2df126d097..6f1e65e5c6 100644
--- a/crates/buzz-relay/src/handlers/group_state_postgres_tests.rs
+++ b/crates/buzz-relay/src/handlers/group_state_postgres_tests.rs
@@ -238,3 +238,254 @@ async fn creator_tag_survives_ownership_transfer() {
         );
     }
 }
+
+/// Ingest a kind:9002 that `keys` signs for `channel_id` with `tags`.
+async fn edit_channel(
+    state: &Arc<AppState>,
+    tenant: &TenantContext,
+    keys: &Keys,
+    channel_id: Uuid,
+    tags: &[&[&str]],
+) -> Result<(), String> {
+    let mut built = vec![Tag::parse(["h", &channel_id.to_string()]).unwrap()];
+    for tag in tags {
+        built.push(Tag::parse(tag.iter().copied()).unwrap());
+    }
+    let event = EventBuilder::new(Kind::Custom(9002), "")
+        .tags(built)
+        .sign_with_keys(keys)
+        .expect("sign 9002");
+    match ingest_event(state, tenant, event, http_auth(keys)).await {
+        Ok(result) if result.accepted => Ok(()),
+        Ok(result) => Err(result.message),
+        Err(error) => Err(format!("{error:?}")),
+    }
+}
+
+/// The `t` values of a group-state event, in tag order.
+async fn t_values(
+    state: &AppState,
+    tenant: &TenantContext,
+    channel_id: Uuid,
+    kind: i32,
+) -> Vec<String> {
+    group_state_tags(state, tenant, channel_id, kind)
+        .await
+        .into_iter()
+        .filter(|tag| tag[0] == "t")
+        .map(|tag| tag[1].clone())
+        .collect()
+}
+
+/// Labels from kind:9007 follow the type tag on every group-state kind,
+/// in the order given, without duplicates, and the creator `P` stays.
+/// Mutation: publish labels before the type, or drop them from 39002 → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn create_publishes_labels_after_the_type() {
+    let state = state().await;
+    let tenant = community(&state, "group-state-labels").await;
+    let creator = Keys::generate();
+    let channel_id = create_channel(
+        &state,
+        &tenant,
+        &creator,
+        &[
+            &["channel_type", "forum"],
+            &["t", "workspace"],
+            &["t", "team:core"],
+            &["t", "workspace"],
+        ],
+    )
+    .await;
+
+    let record = state
+        .db
+        .get_channel(tenant.community(), channel_id)
+        .await
+        .expect("channel");
+    assert_eq!(record.labels, vec!["workspace", "team:core"]);
+    for kind in [39000, 39001, 39002] {
+        assert_eq!(
+            t_values(&state, &tenant, channel_id, kind).await,
+            vec!["forum", "workspace", "team:core"],
+            "kind:{kind}"
+        );
+        let tags = group_state_tags(&state, &tenant, channel_id, kind).await;
+        assert!(
+            tags.iter()
+                .any(|tag| tag[0] == "P" && tag[1] == creator.public_key().to_hex()),
+            "kind:{kind} keeps the creator: {tags:?}"
+        );
+    }
+}
+
+/// kind:9002 `t` tags replace the whole set, a lone `["t", ""]` clears
+/// it, and an edit without `t` tags leaves it alone.
+/// Mutation: append instead of replace, or treat `""` as a label → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn edit_replaces_and_clears_labels() {
+    let state = state().await;
+    let tenant = community(&state, "group-state-label-edit").await;
+    let owner = Keys::generate();
+    let channel_id = create_channel(&state, &tenant, &owner, &[&["t", "old"]]).await;
+
+    edit_channel(
+        &state,
+        &tenant,
+        &owner,
+        channel_id,
+        &[&["t", "new-a"], &["t", "new-b"]],
+    )
+    .await
+    .expect("replace labels");
+    for kind in [39000, 39001, 39002] {
+        assert_eq!(
+            t_values(&state, &tenant, channel_id, kind).await,
+            vec!["stream", "new-a", "new-b"],
+            "kind:{kind} after replace"
+        );
+    }
+
+    edit_channel(&state, &tenant, &owner, channel_id, &[&["about", "x"]])
+        .await
+        .expect("edit about");
+    assert_eq!(
+        t_values(&state, &tenant, channel_id, 39000).await,
+        vec!["stream", "new-a", "new-b"],
+        "an edit without t tags keeps the labels"
+    );
+
+    edit_channel(&state, &tenant, &owner, channel_id, &[&["t", ""]])
+        .await
+        .expect("clear labels");
+    for kind in [39000, 39001, 39002] {
+        assert_eq!(
+            t_values(&state, &tenant, channel_id, kind).await,
+            vec!["stream"],
+            "kind:{kind} after clear"
+        );
+    }
+}
+
+/// Bad label sets are refused before storage, on create and on edit.
+/// Mutation: skip validation in either path → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn invalid_labels_are_refused() {
+    let state = state().await;
+    let tenant = community(&state, "group-state-label-invalid").await;
+    let owner = Keys::generate();
+
+    for bad in [vec!["t", "Upper"], vec!["t", "forum"], vec!["t"]] {
+        let channel_id = Uuid::new_v4();
+        let event = EventBuilder::new(Kind::Custom(9007), "")
+            .tags([
+                Tag::parse(["h", &channel_id.to_string()]).unwrap(),
+                Tag::parse(["name", "bad-labels"]).unwrap(),
+                Tag::parse(bad.clone()).unwrap(),
+            ])
+            .sign_with_keys(&owner)
+            .unwrap();
+        let accepted = ingest_event(&state, &tenant, event, http_auth(&owner))
+            .await
+            .is_ok_and(|result| result.accepted);
+        assert!(!accepted, "create with {bad:?} must fail");
+        assert!(
+            state
+                .db
+                .get_channel(tenant.community(), channel_id)
+                .await
+                .is_err(),
+            "no channel row for {bad:?}"
+        );
+    }
+
+    let channel_id = create_channel(&state, &tenant, &owner, &[&["t", "keep"]]).await;
+    let nine: Vec<String> = (0..9).map(|i| format!("l{i}")).collect();
+    let too_many: Vec<[&str; 2]> = nine.iter().map(|l| ["t", l.as_str()]).collect();
+    let too_many: Vec<&[&str]> = too_many.iter().map(|t| t.as_slice()).collect();
+    for tags in [
+        vec![&["t", "workflow"][..]],
+        vec![&["t", ""][..], &["t", "x"][..]],
+        too_many,
+    ] {
+        assert!(
+            edit_channel(&state, &tenant, &owner, channel_id, &tags)
+                .await
+                .is_err(),
+            "edit with {tags:?} must fail"
+        );
+    }
+    assert_eq!(
+        t_values(&state, &tenant, channel_id, 39000).await,
+        vec!["stream", "keep"]
+    );
+}
+
+/// Only an owner or admin may change labels; a plain member may not.
+/// The join must be accepted, so the refusal comes from the label rule and
+/// not from "not a member".
+/// Mutation: drop `t` from the privileged tag list → RED (the member's
+/// edit is accepted).
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn members_cannot_change_labels() {
+    let state = state().await;
+    let tenant = community(&state, "group-state-label-auth").await;
+    let owner = Keys::generate();
+    let member = Keys::generate();
+    let channel_id = create_channel(&state, &tenant, &owner, &[&["t", "keep"]]).await;
+    let join = EventBuilder::new(Kind::Custom(9021), "")
+        .tags([Tag::parse(["h", &channel_id.to_string()]).unwrap()])
+        .sign_with_keys(&member)
+        .unwrap();
+    let joined = ingest_event(&state, &tenant, join, http_auth(&member))
+        .await
+        .expect("member joins");
+    assert!(joined.accepted, "join refused: {}", joined.message);
+
+    assert!(
+        edit_channel(&state, &tenant, &member, channel_id, &[&["t", "mine"]])
+            .await
+            .is_err(),
+        "a member must not set labels"
+    );
+    assert_eq!(
+        t_values(&state, &tenant, channel_id, 39000).await,
+        vec!["stream", "keep"]
+    );
+}
+
+/// An admin who is not the owner may change labels.
+/// Mutation: allow only the owner role to set labels → RED.
+#[tokio::test]
+#[ignore = "requires Postgres"]
+async fn admins_can_change_labels() {
+    let state = state().await;
+    let tenant = community(&state, "group-state-label-admin").await;
+    let owner = Keys::generate();
+    let admin = Keys::generate();
+    let channel_id = create_channel(&state, &tenant, &owner, &[&["t", "keep"]]).await;
+    let grant = EventBuilder::new(Kind::Custom(9000), "")
+        .tags([
+            Tag::parse(["h", &channel_id.to_string()]).unwrap(),
+            Tag::parse(["p", &admin.public_key().to_hex()]).unwrap(),
+            Tag::parse(["role", "admin"]).unwrap(),
+        ])
+        .sign_with_keys(&owner)
+        .unwrap();
+    let granted = ingest_event(&state, &tenant, grant, http_auth(&owner))
+        .await
+        .expect("owner adds admin");
+    assert!(granted.accepted, "admin grant refused: {}", granted.message);
+
+    edit_channel(&state, &tenant, &admin, channel_id, &[&["t", "theirs"]])
+        .await
+        .expect("an admin may set labels");
+    assert_eq!(
+        t_values(&state, &tenant, channel_id, 39000).await,
+        vec!["stream", "theirs"]
+    );
+}
diff --git a/crates/buzz-relay/src/handlers/ingest.rs b/crates/buzz-relay/src/handlers/ingest.rs
index 9e8311e8f6..a07e2054c1 100644
--- a/crates/buzz-relay/src/handlers/ingest.rs
+++ b/crates/buzz-relay/src/handlers/ingest.rs
@@ -3108,6 +3108,10 @@ async fn ingest_event_inner(
             channel_type_str.parse().map_err(|_| {
                 IngestError::Rejected(format!("invalid channel_type: {channel_type_str}"))
             })?;
+        let labels = super::side_effects::channel_labels_from_tags(&event)
+            .transpose()
+            .map_err(|e| IngestError::Rejected(format!("invalid: {e}")))?
+            .unwrap_or_default();
 
         if let Some(client_uuid) = channel_id {
             let name = create_name.unwrap_or_default();
@@ -3126,7 +3130,7 @@ async fn ingest_event_inner(
             let actor_bytes = event.pubkey.to_bytes().to_vec();
             let (_, was_created) = state
                 .db
-                .create_channel_with_id(
+                .create_labeled_channel_with_id(
                     tenant.community(),
                     client_uuid,
                     name,
@@ -3135,6 +3139,7 @@ async fn ingest_event_inner(
                     description.as_deref(),
                     &actor_bytes,
                     ttl_seconds,
+                    &labels,
                 )
                 .await
                 .map_err(|e| IngestError::Internal(format!("error: {e}")))?;
diff --git a/crates/buzz-relay/src/handlers/side_effects.rs b/crates/buzz-relay/src/handlers/side_effects.rs
index d821a46516..8a7b580a2a 100644
--- a/crates/buzz-relay/src/handlers/side_effects.rs
+++ b/crates/buzz-relay/src/handlers/side_effects.rs
@@ -662,6 +662,7 @@ pub async fn validate_admin_event(
                 "purpose",
                 "visibility",
                 "ttl",
+                "t",
             ];
             let has_recognized = event
                 .tags
@@ -669,7 +670,7 @@ pub async fn validate_admin_event(
                 .any(|t| RECOGNIZED_TAGS.contains(&t.kind().to_string().as_str()));
             if !has_recognized {
                 return Err(anyhow::anyhow!(
-                    "kind:9002 must include at least one metadata tag (name, about, archived, topic, purpose, visibility, ttl)"
+                    "kind:9002 must include at least one metadata tag (name, about, archived, topic, purpose, visibility, ttl, t)"
                 ));
             }
 
@@ -748,11 +749,21 @@ pub async fn validate_admin_event(
                 }
             }
 
-            // name/about/archived/visibility/ttl require owner/admin;
+            // Validate label (`t`) values before storage.
+            if let Some(labels) = channel_labels_from_tags(event) {
+                labels.map_err(|e| anyhow::anyhow!("{e}"))?;
+            }
+
+            // name/about/archived/visibility/ttl/labels require owner/admin;
             // topic/purpose allow any member.
             let has_privileged_tag = event.tags.iter().any(|t| {
                 let k = t.kind().to_string();
-                k == "name" || k == "about" || k == "archived" || k == "visibility" || k == "ttl"
+                k == "name"
+                    || k == "about"
+                    || k == "archived"
+                    || k == "visibility"
+                    || k == "ttl"
+                    || k == "t"
             });
             if has_privileged_tag {
                 let members = state.db.get_members(tenant.community(), channel_id).await?;
@@ -774,7 +785,7 @@ pub async fn validate_admin_event(
                             return Ok(());
                         }
                         Err(anyhow::anyhow!(
-                            "actor not authorized for name/about/archived/visibility/ttl changes"
+                            "actor not authorized for name/about/archived/visibility/ttl/label changes"
                         ))
                     }
                 }
@@ -1166,12 +1177,13 @@ async fn emit_addressable_discovery_event(
 }
 
 /// Tags that identify the channel on every relay-signed group-state event:
-/// the channel type `t` first, then the creator `P`.
+/// the channel type `t` first, then one `t` per label, then the creator `P`.
 fn group_state_identity_tags(
     identity: &buzz_db::channel::ChannelIdentity,
 ) -> anyhow::Result<Vec<Tag>> {
     Ok(buzz_core::channel::group_state_identity_tags(
         &identity.channel_type,
+        &identity.labels,
         &identity.created_by,
     )?)
 }
@@ -1876,6 +1888,23 @@ async fn handle_edit_metadata(
         }
     }
 
+    // All `t` tags together form the new label set, so they are applied
+    // once after the loop. `["t", ""]` alone clears the set.
+    if let Some(labels) = channel_labels_from_tags(event) {
+        let labels = labels.map_err(|e| anyhow::anyhow!("{e}"))?;
+        state
+            .db
+            .update_channel(
+                tenant.community(),
+                channel_id,
+                buzz_db::channel::ChannelUpdate {
+                    labels: Some(labels),
+                    ..Default::default()
+                },
+            )
+            .await?;
+    }
+
     if let Err(e) = emit_group_discovery_events(tenant, state, channel_id).await {
         warn!(channel = %channel_id, error = %e, "NIP-29 group discovery emission failed");
     }
@@ -1883,6 +1912,33 @@ async fn handle_edit_metadata(
     Ok(())
 }
 
+/// The channel label set named by an event's `["t", <label>]` tags, or
+/// `None` when the event has no `t` tag. kind:9007 uses it for the initial
+/// labels and kind:9002 for a replacement set. A `t` tag without a value is
+/// refused.
+pub(crate) fn channel_labels_from_tags(
+    event: &Event,
+) -> Option<Result<Vec<String>, buzz_core::channel::ChannelLabelError>> {
+    let mut values = Vec::new();
+    for tag in event.tags.iter() {
+        if tag.kind() == nostr::TagKind::t() {
+            match tag.content() {
+                Some(value) => values.push(value),
+                None => {
+                    return Some(Err(buzz_core::channel::ChannelLabelError::Invalid(
+                        String::new(),
+                    )))
+                }
+            }
+        }
+    }
+    if values.is_empty() {
+        None
+    } else {
+        Some(buzz_core::channel::parse_channel_labels(values))
+    }
+}
+
 async fn handle_delete_event_side_effect(
     tenant: &TenantContext,
     event: &Event,
@@ -2005,6 +2061,10 @@ async fn handle_create_group(
     let actor_bytes = event.pubkey.to_bytes().to_vec();
     let description = extract_tag_value(event, "about");
     let ttl_seconds = super::resolve_ttl(event, state.config.ephemeral_ttl_override);
+    let labels = channel_labels_from_tags(event)
+        .transpose()
+        .map_err(|e| anyhow::anyhow!("{e}"))?
+        .unwrap_or_default();
 
     // If the event has an h-tag UUID, ingest_event() already created the channel
     // via create_channel_with_id(). Fetch it rather than creating a duplicate.
@@ -2029,7 +2089,7 @@ async fn handle_create_group(
                 // but fall back to creation to stay resilient.
                 let ch = state
                     .db
-                    .create_channel(
+                    .create_labeled_channel(
                         tenant.community(),
                         &name,
                         channel_type,
@@ -2037,6 +2097,7 @@ async fn handle_create_group(
                         description.as_deref(),
                         &actor_bytes,
                         ttl_seconds,
+                        &labels,
                     )
                     .await?;
                 metrics::counter!(
@@ -2051,7 +2112,7 @@ async fn handle_create_group(
     } else {
         let ch = state
             .db
-            .create_channel(
+            .create_labeled_channel(
                 tenant.community(),
                 &name,
                 channel_type,
@@ -2059,6 +2120,7 @@ async fn handle_create_group(
                 description.as_deref(),
                 &actor_bytes,
                 ttl_seconds,
+                &labels,
             )
             .await?;
         metrics::counter!(
@@ -4022,6 +4084,7 @@ mod tests {
 
         let identity = buzz_db::channel::ChannelIdentity {
             channel_type: "forum".to_string(),
+            labels: Vec::new(),
             created_by: vec![0xab; 32],
         };
         let tags = group_members_tags(&channel_id.to_string(), Some(&identity), &members)
diff --git a/docs/nips/NIP-CL.md b/docs/nips/NIP-CL.md
index f533d0b4e3..30adfba3c9 100644
--- a/docs/nips/NIP-CL.md
+++ b/docs/nips/NIP-CL.md
@@ -21,13 +21,18 @@ plain NIP-29, a client cannot:
 - tell which of two channels is older. The `created_at` of a kind:39000 event
   is the time of the last edit, not the time of creation.
 
+A client also cannot mark its own channels so that it can find them again.
+Channel labels (below) do this.
+
 ## Channel identity tags
 
 On every channel-state event that the relay signs, the relay MUST put these
 tags in this order, before any other `t` or `P` tag:
 
 1. `["t", <channel type>]`, for example `stream`, `forum`, `dm`, `workflow`.
-2. `["P", <creator public key, hex>]`.
+2. `["t", <label>]` for each channel label, in stored order (see
+   [Channel labels](#channel-labels)).
+3. `["P", <creator public key, hex>]`.
 
 kind:39000 also carries `["created_at", <unix seconds>]`.
 
@@ -42,6 +47,7 @@ Example kind:39000 (signing fields and unrelated tags omitted):
     ["d", "9b353519-f4fe-4757-aef4-bec6cc0ae54c"],
     ["name", "agent-config"],
     ["t", "stream"],
+    ["t", "agent-config"],
     ["P", "<creator public key>"],
     ["created_at", "1759939200"]
   ]
@@ -51,11 +57,12 @@ Example kind:39000 (signing fields and unrelated tags omitted):
 | Tag | Kinds | Meaning |
 | --- | --- | --- |
 | first `t` | 39000–39002 | Channel type. |
+| later `t` | 39000–39002 | Channel labels. |
 | `P` | 39000–39002 | Public key that signed the kind:9007 that created the channel. |
 | `created_at` | 39000 | Time the channel was created, in unix seconds, as a decimal string. |
 
 **Channel type.** Clients MUST read the channel type from the first `t` tag.
-A relay can add other `t` tags after it.
+Later `t` tags are labels.
 
 **Creator.** The relay writes `P` from its own record of the kind:9007 that
 created the channel. No client can set it. It does not change when ownership
@@ -76,6 +83,28 @@ until the channel next changes, for example on an edit or a membership
 change. A client MUST treat a missing tag as unknown. A missing `P` does not
 mean that a key did not create the channel.
 
+## Channel labels
+
+A label groups channels across channel types, for example `workspace` or
+`agent-config`. Labels have no meaning to the relay.
+
+**Set labels.** A kind:9007 (create group) MAY carry up to 8 distinct
+labels as `["t", <label>]` tags. On kind:9002 (edit metadata):
+
+- `t` tags replace the whole label set;
+- `["t", ""]` tags and no other `t` tag clear the set;
+- no `t` tag leaves the labels as they are.
+
+Only an owner or admin of the channel MAY change its labels.
+
+**Rules.** A label is 1–64 characters from `a-z`, `0-9`, `.`, `:` and `-`. A
+label MUST NOT be `stream`, `forum`, `dm`, `workflow` or `system`. These are
+channel type names, so this rule stops a label from making a channel look like
+another type. The relay MUST reject the whole event if it has more than 8
+distinct labels, an invalid label, a reserved name, or `["t", ""]` together
+with other labels. The relay stores repeated labels once, so a repeat does
+not count toward the 8, and repeated `["t", ""]` tags clear the set like one.
+
 ## Finding channels
 
 Use ordinary NIP-01 filters on the channel-state kinds.
@@ -83,17 +112,26 @@ Use ordinary NIP-01 filters on the channel-state kinds.
 | To find | Filter |
 | --- | --- |
 | Channels that a key created | `{"kinds": [39000], "#P": ["<creator>"]}` |
+| Channels with a label | `{"kinds": [39000], "#t": ["<label>"]}` |
+| One creator's channels with a label | `{"kinds": [39000], "#P": ["<creator>"], "#t": ["<label>"]}` |
 | Channels of one type | `{"kinds": [39000], "#t": ["<type>"]}` |
 
 A `#P` filter does not return a channel whose events lack `P` (see
 **Older events**). So it can miss channels that a key created before the relay
 supported this NIP.
 
+Values in one tag filter combine with OR, as in NIP-01. So
+`"#t": ["workspace", "notes"]` finds channels with either label. To require a
+label and a creator, use `#t` and `#P` together.
+
 ## Trust
 
 A client that relies on these tags MUST check that the relay's key signed the
 event, as for all NIP-29 group-state events.
 
+Labels give no trust. Any owner or admin can set them. Only `P` says who
+created a channel.
+
 ## Relation to other NIPs
 
 - NIP-29: the group-state events that this NIP adds tags to.
diff --git a/migrations/0061_channel_labels.sql b/migrations/0061_channel_labels.sql
new file mode 100644
index 0000000000..72e5f27e2d
--- /dev/null
+++ b/migrations/0061_channel_labels.sql
@@ -0,0 +1,13 @@
+-- Channel labels: creator- or admin-chosen tags that group channels across
+-- channel types. The relay publishes each label as a ["t", <label>] tag on
+-- the channel's group-state events (kinds 39000-39002), after the channel
+-- type tag. kind:9007 sets them and kind:9002 replaces them; the relay
+-- validates their shape (1-64 of a-z 0-9 . : -, not a channel type name).
+--
+-- Additive: existing channels get an empty set and look as before. The
+-- CHECK bounds the set even if a writer skips the relay's validation.
+-- No index yet: label lookups match the GIN-indexed tags of the relay-signed
+-- group-state events, not this column.
+ALTER TABLE channels
+    ADD COLUMN labels TEXT[] NOT NULL DEFAULT '{}'
+        CONSTRAINT channels_labels_bounded CHECK (cardinality(labels) <= 8);
diff --git a/schema/tables/public/channels.sql b/schema/tables/public/channels.sql
index 5fe5659cfb..ef5e25cbb5 100644
--- a/schema/tables/public/channels.sql
+++ b/schema/tables/public/channels.sql
@@ -32,6 +32,10 @@ CREATE TABLE channels (
     participant_hash BYTEA,
     ttl_seconds     INT,
     ttl_deadline    TIMESTAMPTZ,
+    -- Labels, published as ["t", <label>] after the channel type tag on the
+    -- relay-signed group-state events. The relay validates their shape.
+    labels          TEXT[] NOT NULL DEFAULT '{}'
+        CONSTRAINT channels_labels_bounded CHECK (cardinality(labels) <= 8),
     PRIMARY KEY (community_id, id),
     CONSTRAINT chk_channels_id_not_nil CHECK (id <> '00000000-0000-0000-0000-000000000000'::uuid)
 );