awoooi/apps/api/migrations/awooop_phase6_ewoooc_onboarding_2026-05-04.sql

-- =============================================================================
-- AwoooP Phase 6: EwoooC Tenant Onboarding
-- ADR-115（Tenant Onboarding 模板）
-- 2026-05-04 ogt + Claude Sonnet 4.6
-- =============================================================================
-- 執行前提：Phase 1 migration（awooop_phase1_control_plane_2026-05-04.sql）已執行
-- 說明：
--   EwoooC 是第二個接入 AwoooP 的租戶（awoooi 為第一個）
--   migration_mode = 'shadow' 啟動，進入 canary 前需通過 shadow run 驗證
--   budget_limit_usd = 50.0（初始限制，可調整）
--   4 個 read-only MCP tools 預先在白名單中（不需 approval）
-- =============================================================================

BEGIN;

-- ---------------------------------------------------------------------------
-- Step 1: INSERT awooop_projects（EwoooC 租戶）
-- ---------------------------------------------------------------------------
INSERT INTO awooop_projects (
    project_id,
    display_name,
    migration_mode,
    budget_limit_usd,
    allowed_channels,
    metadata
) VALUES (
    'ewoooc',
    'EwoooC Business Platform',
    'shadow',           -- Phase 6 啟動模式；通過驗證後升級為 canary
    50.00,              -- 初始 USD 預算上限
    '["telegram","api"]'::jsonb,
    '{
        "onboarded_at": "2026-05-04",
        "tier": "business",
        "ollama_topology": "gcp_three_tier",
        "note": "ADR-115 EwoooC 接入，共用 GCP Ollama 三層拓撲"
    }'::jsonb
) ON CONFLICT (project_id) DO NOTHING;

-- ---------------------------------------------------------------------------
-- Step 2: awooop_mcp_tool_registry — 4 個 read-only MCP tools
-- （ewoooc 初始只允許唯讀工具，write/admin 需另外建 grant）
-- ---------------------------------------------------------------------------

-- Tool 1: k8s_get — 查詢 k8s resource（唯讀）
INSERT INTO awooop_mcp_tool_registry (
    project_id, tool_name, tool_type, description, allowed_scopes, environment_tags
) VALUES (
    'ewoooc',
    'k8s_get',
    'builtin',
    'kubectl get 唯讀查詢（pod/deployment/service 狀態）',
    '["read"]'::jsonb,
    '{"env": "any"}'::jsonb
) ON CONFLICT (project_id, tool_name) DO NOTHING;

-- Tool 2: signoz_query — 查詢 SigNoz metrics/traces（唯讀）
INSERT INTO awooop_mcp_tool_registry (
    project_id, tool_name, tool_type, description, allowed_scopes, environment_tags
) VALUES (
    'ewoooc',
    'signoz_query',
    'builtin',
    'SigNoz metrics/traces 查詢（唯讀，無告警修改）',
    '["read"]'::jsonb,
    '{"env": "any"}'::jsonb
) ON CONFLICT (project_id, tool_name) DO NOTHING;

-- Tool 3: incident_read — 讀取 EwoooC incident 記錄（唯讀，RLS 隔離）
INSERT INTO awooop_mcp_tool_registry (
    project_id, tool_name, tool_type, description, allowed_scopes, environment_tags
) VALUES (
    'ewoooc',
    'incident_read',
    'builtin',
    'Incident 查詢（僅限 ewoooc 租戶資料，RLS 強制隔離）',
    '["read"]'::jsonb,
    '{"env": "any"}'::jsonb
) ON CONFLICT (project_id, tool_name) DO NOTHING;

-- Tool 4: km_read — 讀取 Knowledge Management 條目（唯讀）
INSERT INTO awooop_mcp_tool_registry (
    project_id, tool_name, tool_type, description, allowed_scopes, environment_tags
) VALUES (
    'ewoooc',
    'km_read',
    'builtin',
    'Knowledge Management 讀取（ewoooc 租戶 KM，RLS 隔離）',
    '["read"]'::jsonb,
    '{"env": "any"}'::jsonb
) ON CONFLICT (project_id, tool_name) DO NOTHING;

COMMIT;