update AGENTs.md and makefile

Author: adityathebe

AGENTS.md

@@ -15,10 +15,10 @@ RLS policies filter database rows based on JWT claims passed via PostgREST, ensu
 
 ### Policy Patterns
 
-**Direct Policies**: Tables with direct RLS use the `match_scope()` function to evaluate JWT claims against row attributes (tags, agents, names, id).
+**Direct Policies**: Tables with direct RLS use the `__scope` array column and compare it against JWT claims.
 
-- Examples: `config_items`, `canaries`, `components`, `playbooks`
-- Policy checks row attributes directly using `match_scope(jwt_claims, row.tags, row.agent_id, row.name, row.id)`
+- Examples: `config_items`, `canaries`, `components`, `playbooks`, `views`
+- Policy checks scope overlap using `COALESCE(__scope, '{}'::uuid[]) && rls_scope_access()` and wildcard via `rls_has_wildcard('<type>')`.
 
 **Inherited Policies**: Child tables inherit access control from their parent using `EXISTS` clauses.
 
@@ -29,7 +29,7 @@ RLS policies filter database rows based on JWT claims passed via PostgREST, ensu
 
 1. Add RLS enable logic to `@views/9998_rls_enable.sql`
    - Enable RLS on the table
-   - Create the policy (either direct with `match_scope()` or inherited with `EXISTS`)
+   - Create the policy (either direct with `__scope` overlap or inherited with `EXISTS`)
 2. Add counterpart disable logic to `@views/9999_rls_disable.sql`
    - Disable RLS on the table
    - Drop the policy
@@ -42,7 +42,7 @@ RLS policies filter database rows based on JWT claims passed via PostgREST, ensu
 
 The RLS policies work by injecting JWT claims into PostgreSQL session variables via `request.jwt.claims`. The flow is:
 
-- Go code builds an RLS Payload (scopes for config, component, playbook, canary, view) in `@rls/payload.go`
+- Go code builds an RLS Payload (scope UUIDs + wildcard scopes) in `@rls/payload.go`
 - `SetPostgresSessionRLS()` serializes the Payload to JSON and executes: `SET request.jwt.claims TO <json>`
 - PostgreSQL RLS policies read `(current_setting('request.jwt.claims')::jsonb)` to enforce access control
 

Makefile

@@ -12,6 +12,10 @@ ginkgo:
 	go install github.com/onsi/ginkgo/v2/ginkgo
 
 test: ginkgo
+	# cleanup git directories that were downloaded from previous test run
+	# cuz we don't want to run their unit tests
+	rm -rf tests/e2e/exec-checkout
+	
 	ginkgo -r -v --skip-package=tests/e2e
 
 .PHONY: test-e2e