awoooi/docs/runbooks/AWOOOP-RLS-CANARY-WAVE1.md

AwoooP RLS Canary Wave 1

This wave is a staged apply package only. It enables fail-closed RLS on tables that were empty in the latest production preflight.

Apply script:

scripts/ops/awooop-rls-canary-wave1-empty-tables.sql

Rollback script:

scripts/ops/awooop-rls-canary-wave1-empty-tables-rollback.sql

Scope

Wave 1 targets only tables that had total_rows=0 and null_project_id_rows=0 on 2026-05-12:

• awooop_contract_revisions
• awooop_conversation_event
• awooop_mcp_credential_refs
• awooop_mcp_gateway_audit
• awooop_mcp_grants
• budget_ledger

The SQL aborts if any target now has rows, is missing, lacks project_id, or contains NULL project_id.

Pre-Apply Gate

Run these before any production apply:

python3 scripts/ops/awooop-rls-access-audit.py
python3 scripts/ops/awooop-rls-manual-script-audit.py
bash scripts/ops/awooop-rls-preflight.sh --exact-counts

Expected before wave1 apply:

• Runtime access audit: BLOCKED=0.
• Manual script audit: BLOCKED=0; review items acknowledged.
• RLS preflight: still blocked only because policies are not enabled.
• Exact counts for the six wave1 target tables remain total_rows=0.

Apply

Run with a migration/operator role in a reviewed maintenance window:

psql "$DATABASE_URL" -v ON_ERROR_STOP=1 \
  -f scripts/ops/awooop-rls-canary-wave1-empty-tables.sql

Then rerun:

bash scripts/ops/awooop-rls-preflight.sh --exact-counts
curl -fsS https://awoooi.wooo.work/api/v1/health

The global preflight will still be blocked until later waves cover the remaining tables. The six wave1 tables should show rls=true, force=true, and policies=1, with no fail-open policy expression.

Rollback

psql "$DATABASE_URL" -v ON_ERROR_STOP=1 \
  -f scripts/ops/awooop-rls-canary-wave1-empty-tables-rollback.sql

Rollback disables RLS and removes only the wave1 policies on the six canary tables. It does not modify data.