chore(rls): stage projects canary path

docs/runbooks/AWOOOP-RLS-CANARY-WAVE1-2.md

@@ -0,0 +1,65 @@
+# AwoooP RLS Canary Wave 1.2
+
+This wave targets:
+
+- `awooop_projects`
+
+Status: staged, apply pending.
+
+## Safety Model
+
+`awooop_projects` is special. Runtime checks such as MCP Gate 1 and budget
+lookup should be tenant-scoped, but Operator Console needs a cross-tenant
+project list.
+
+Wave 1.2 keeps normal table access tenant-scoped and adds an explicit platform
+read function:
+
+```sql
+public.awooop_operator_list_projects()
+```
+
+The function is `SECURITY DEFINER`, has a fixed `search_path`, returns only the
+Operator Console project-list columns, and grants execute only to `awooop_app`.
+
+## App Changes
+
+- `platform_operator_service.list_tenants()` reads from
+  `awooop_operator_list_projects()`.
+- `budget_service._get_tenant_budget_limit(project_id)` now opens
+  `get_db_context(project_id)`, so tenant budget reads match RLS context.
+
+## Apply
+
+```bash
+psql "$DATABASE_URL" -v ON_ERROR_STOP=1 \
+  -f scripts/ops/awooop-rls-canary-wave1-2-projects.sql
+```
+
+The SQL aborts if:
+
+- table is missing,
+- `project_id` is missing,
+- any `project_id` is NULL,
+- row count exceeds the reviewed canary cap of 20 rows.
+
+## Verification
+
+Expected after apply:
+
+- `app.project_id='awoooi'`: direct table read sees only `awoooi`.
+- `app.project_id='ewoooc'`: direct table read sees only `ewoooc`.
+- `awooop_operator_list_projects()`: returns both projects for Operator Console.
+- tenant budget lookup can read the matching tenant row.
+- global RLS preflight remains blocked only by later-wave tables.
+
+## Rollback
+
+```bash
+psql "$DATABASE_URL" -v ON_ERROR_STOP=1 \
+  -f scripts/ops/awooop-rls-canary-wave1-2-projects-rollback.sql
+```
+
+Rollback disables RLS and removes the Wave1.2 policies on `awooop_projects`.
+It intentionally keeps `awooop_operator_list_projects()` for deployed API
+compatibility.