-- Wever Labs OS Security Hardening v1
-- Purpose: runtime security boundary for controlled pilot activation.

create table if not exists os_security_audit_events (
  id uuid primary key default gen_random_uuid(),
  event_type text not null,
  runtime_surface text not null,
  task_token text,
  agent_id text,
  client_id text,
  work_order_id text,
  severity text not null default 'info',
  event_payload jsonb not null default '{}'::jsonb,
  created_at timestamptz not null default now()
);

create table if not exists os_security_kill_switches (
  id uuid primary key default gen_random_uuid(),
  switch_key text not null unique,
  is_enabled boolean not null default true,
  runtime_surface text not null default 'shared_runtime',
  reason text,
  updated_by text,
  updated_at timestamptz not null default now()
);

create table if not exists os_runtime_access_scopes (
  id uuid primary key default gen_random_uuid(),
  agent_id text,
  client_id text,
  credential_envelope_id text,
  allowed_tools text[] not null default '{}',
  allowed_callback_hosts text[] not null default '{}',
  expires_at timestamptz,
  created_at timestamptz not null default now()
);

create index if not exists idx_os_security_audit_task_token on os_security_audit_events(task_token);
create index if not exists idx_os_runtime_access_scopes_agent_id on os_runtime_access_scopes(agent_id);

insert into os_security_kill_switches (switch_key, is_enabled, runtime_surface, reason) values
  ('provider_routes_enabled', true, 'shared_runtime', 'Provider route activation switch'),
  ('callback_delivery_enabled', true, 'shared_runtime', 'Callback delivery activation switch'),
  ('controlled_pilot_enabled', true, 'shared_runtime', 'Controlled pilot activation switch')
on conflict (switch_key) do nothing;
