-- +goose Up
-- dp_budget_ledger is the append only privacy budget accountant record for the cross tenant federated
-- differential privacy release path (WS8). Each row records one release: the Renyi orders considered, the
-- accumulated RDP after composition, the converted (epsilon, delta) at the target delta, the number of
-- live non test tenants that contributed, and when it was released. The hard spend gate reads the running
-- accumulation here and refuses a release once the configured budget is spent, a server side check that is
-- never client trusted. The spent epsilon is stored as numeric so the audit record is bit stable, while the
-- grid math runs in float64. tenant_id is nullable: a cross tenant post DP release has no single owning
-- tenant. Global reference data: migrator owned, app SELECT only, outside RLS, no PII and no eeo reach. The
-- whole path is inert until MM_FEDERATED_DP_ENABLED is set and a real cohort of five or more live tenants
-- exists, so this table stays empty in tenant LIVE.
CREATE TABLE dp_budget_ledger (
    id                        uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    model_version             text NOT NULL,
    tenant_id                 uuid,                 -- NULL for a cross tenant release, no single owning tenant
    rdp_orders                jsonb NOT NULL DEFAULT '{}'::jsonb,  -- the Renyi order grid and per order RDP at this release
    accumulated_rdp           numeric NOT NULL,     -- running RDP after composition over all releases so far
    epsilon_at_delta          numeric NOT NULL,     -- the converted epsilon at the target delta
    delta                     numeric NOT NULL,     -- the target delta for the conversion
    contributing_tenant_count int NOT NULL,         -- count of live non test distinct organizations in the cohort
    released_at               timestamptz NOT NULL DEFAULT now()
);

GRANT SELECT ON dp_budget_ledger TO missionmatch_app;

-- +goose Down
DROP TABLE IF EXISTS dp_budget_ledger;