From 2cb3a24d6d62d1822f94c0929cb16ed18586ba91 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Wed, 5 Aug 2026 16:41:00 +0200
Subject: [PATCH 1/2] Add ArgoCD Application for target-revenue Trust Service
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

WP-0011: sync coulomb/target-revenue path k8s/railiance into namespace
target-revenue (revenue.coulomb.social). Requires image, OpenBao secrets,
and DNS before a healthy sync — see target-revenue docs/deployment.md.
---
 .../target-revenue.application.yaml           | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 argocd/applications/target-revenue.application.yaml

diff --git a/argocd/applications/target-revenue.application.yaml b/argocd/applications/target-revenue.application.yaml
new file mode 100644
index 0000000..ecdc8ae
--- /dev/null
+++ b/argocd/applications/target-revenue.application.yaml
@@ -0,0 +1,29 @@
+# Target Revenue Trust Service + Control Plane (WP-0011).
+# Source of truth: coulomb/target-revenue k8s/railiance (issue-core pattern).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: target-revenue
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance.io/domain: target-revenue
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  project: railiance-tenants
+  source:
+    repoURL: https://forgejo.coulomb.social/coulomb/target-revenue.git
+    targetRevision: main
+    path: k8s/railiance
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: target-revenue
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true

From 79387f1350f343e6ee51417af4fef76f60468d19 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Wed, 5 Aug 2026 17:56:39 +0200
Subject: [PATCH 2/2] Add OpenBao/ESO lane for target-revenue on railiance01

ClusterSecretStore openbao-target-revenue and read policies for
platform/workloads/target-revenue/runtime-secrets (WP-0011).
---
 ...bao-target-revenue.clustersecretstore.yaml | 28 +++++++++++++++++++
 .../external-secrets-target-revenue.hcl       |  9 ++++++
 ...orkload-kv-read-target-revenue-runtime.hcl |  9 ++++++
 3 files changed, 46 insertions(+)
 create mode 100644 argocd/platform-addons/openbao-secretstore/openbao-target-revenue.clustersecretstore.yaml
 create mode 100644 openbao/policies/external-secrets-target-revenue.hcl
 create mode 100644 openbao/policies/workload-kv-read-target-revenue-runtime.hcl

diff --git a/argocd/platform-addons/openbao-secretstore/openbao-target-revenue.clustersecretstore.yaml b/argocd/platform-addons/openbao-secretstore/openbao-target-revenue.clustersecretstore.yaml
new file mode 100644
index 0000000..c4fba08
--- /dev/null
+++ b/argocd/platform-addons/openbao-secretstore/openbao-target-revenue.clustersecretstore.yaml
@@ -0,0 +1,28 @@
+# target-revenue Trust Service runtime secrets on railiance01 (WP-0011).
+# Pattern matches openbao-reuse / openbao-activity-core: token auth to the
+# in-cluster OpenBao service, store limited to the target-revenue namespace.
+#
+# Prereq: Secret external-secrets/openbao-target-revenue-eso-token (key: token)
+# Bootstrap: target-revenue scripts/openbao-eso-token-apply.sh
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-target-revenue
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    railiance.io/domain: target-revenue
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        tokenSecretRef:
+          name: openbao-target-revenue-eso-token
+          namespace: external-secrets
+          key: token
+  conditions:
+    - namespaces:
+        - target-revenue
diff --git a/openbao/policies/external-secrets-target-revenue.hcl b/openbao/policies/external-secrets-target-revenue.hcl
new file mode 100644
index 0000000..b7e6293
--- /dev/null
+++ b/openbao/policies/external-secrets-target-revenue.hcl
@@ -0,0 +1,9 @@
+# ESO policy for the target-revenue namespace (WP-0011).
+
+path "platform/data/workloads/target-revenue/*" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/target-revenue/*" {
+  capabilities = ["read", "list"]
+}
diff --git a/openbao/policies/workload-kv-read-target-revenue-runtime.hcl b/openbao/policies/workload-kv-read-target-revenue-runtime.hcl
new file mode 100644
index 0000000..07b0305
--- /dev/null
+++ b/openbao/policies/workload-kv-read-target-revenue-runtime.hcl
@@ -0,0 +1,9 @@
+# Read-only policy for Target Revenue Trust Service runtime secrets (WP-0011).
+
+path "platform/data/workloads/target-revenue/runtime-secrets" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/target-revenue/runtime-secrets" {
+  capabilities = ["read"]
+}