docs(audit-sink): schema.sql adds GRANTs for scoble_audit_writer

scoble-policy/audit-sink/schema.sql

@@ -0,0 +1,42 @@
+-- Postgres schema for the scoble_policy_audit log.
+-- Mirrors the audit shape that OPA produces.
+-- Time-partitioned (assumes pg_partman or a manual monthly partition
+-- rotation script; for personal-cluster scale a single table is fine).
+--
+-- MIGRATION NOTE (2026-06-07): the previous table (with a decision_id/actor/action/
+-- resource/verdict/metadata shape) was dropped and replaced with this shape.
+-- The audit-sink Integration (audit-sink-integration.yaml) has always targeted
+-- this shape (agent_id/kamelet_ref/decision/reasons/rule_id/request_id).
+-- Run as the `postgres` superuser or a role that owns the table.
+
+CREATE TABLE IF NOT EXISTS scoble_policy_audit (
+    id              BIGSERIAL PRIMARY KEY,
+    timestamp       TIMESTAMPTZ NOT NULL,
+    agent_id        TEXT        NOT NULL,
+    kamelet_ref     TEXT        NOT NULL,
+    decision        TEXT        NOT NULL CHECK (decision IN ('allow', 'deny', 'needs_l1', 'pending', 'escalated')),
+    reasons         JSONB       NOT NULL DEFAULT '[]'::jsonb,
+    rule_id         TEXT,
+    request_id      TEXT        NOT NULL,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Index for "what did agent X do in the last hour" queries.
+CREATE INDEX IF NOT EXISTS scoble_policy_audit_agent_time
+    ON scoble_policy_audit (agent_id, timestamp DESC);
+
+-- Index for "all denies in the last 24h" queries.
+CREATE INDEX IF NOT EXISTS scoble_policy_audit_decision_time
+    ON scoble_policy_audit (decision, timestamp DESC)
+    WHERE decision = 'deny';
+
+-- Index for traceability by request_id (correlation across services).
+CREATE UNIQUE INDEX IF NOT EXISTS scoble_policy_audit_request_id
+    ON scoble_policy_audit (request_id);
+
+-- Grant INSERT (and SELECT for readback) to the audit-sink role.
+-- The CNPG managed.roles controller will only set the password, not the
+-- GRANTs. These are durable as long as the role exists and the table
+-- doesn't get dropped.
+GRANT SELECT, INSERT ON scoble_policy_audit TO scoble_audit_writer;
+GRANT USAGE, SELECT ON SEQUENCE scoble_policy_audit_id_seq TO scoble_audit_writer;