WP-0011: deploy scaffolding for revenue.coulomb.social

Record T01 package (in-repo k8s/railiance, combined /ui + API app,
dedicated CNPG). Add Dockerfile, healthz, migration/bootstrap scripts,
kustomize manifests, ArgoCD Application (in railiance-platform), and
docs/deployment.md. T05 left open for operator DNS/OpenBao/image push.

scripts/apply_migrations.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""Apply SQL migrations in order against TRF_DATABASE_URL (WP-0011).
+
+Idempotent migrations (IF NOT EXISTS / OR REPLACE). Safe to re-run.
+Uses the admin/bootstrap DSN — typically the CNPG owner role, not trf_app.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+import psycopg
+
+MIGRATIONS_DIR = Path(os.environ.get("TRF_MIGRATIONS_DIR", "/src/migrations"))
+
+
+def main() -> None:
+    dsn = os.environ.get("TRF_DATABASE_URL") or os.environ.get("TRF_MIGRATE_DATABASE_URL")
+    if not dsn:
+        print("TRF_DATABASE_URL or TRF_MIGRATE_DATABASE_URL is required", file=sys.stderr)
+        sys.exit(1)
+    files = sorted(MIGRATIONS_DIR.glob("*.sql"))
+    if not files:
+        print(f"no migrations in {MIGRATIONS_DIR}", file=sys.stderr)
+        sys.exit(1)
+    with psycopg.connect(dsn) as conn:
+        for path in files:
+            print(f"applying {path.name} ...")
+            conn.execute(path.read_text(encoding="utf-8"))
+            conn.commit()
+            print(f"  ok {path.name}")
+    print(f"applied {len(files)} migration(s)")
+
+
+if __name__ == "__main__":
+    main()

scripts/bootstrap_binky.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""Idempotent founding `binky` admin credential bootstrap (WP-0011-T01).
+
+If no active binky credential exists, issues one labeled ``founding-admin``
+with admin rights and prints the token once to stdout (and optionally
+writes it to TRF_BOOTSTRAP_TOKEN_FILE). Re-runs are no-ops when a
+credential already exists — they print the existing label, not a new token.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+
+import psycopg
+
+from target_revenue import registry
+
+
+def main() -> None:
+    dsn = os.environ.get("TRF_DATABASE_URL")
+    if not dsn:
+        print("TRF_DATABASE_URL is required", file=sys.stderr)
+        sys.exit(1)
+    label = os.environ.get("TRF_BOOTSTRAP_LABEL", "founding-admin")
+    with psycopg.connect(dsn) as conn:
+        row = conn.execute(
+            """
+            SELECT token, credential_label, rights
+              FROM licensors
+             WHERE licensor_id = 'binky' AND revoked_at IS NULL
+             ORDER BY created_at ASC
+             LIMIT 1
+            """
+        ).fetchone()
+        if row is not None:
+            token, existing_label, rights = row
+            print(
+                f"binky already has active credential label={existing_label!r} "
+                f"rights={rights!r} — bootstrap no-op (token not re-printed)"
+            )
+            conn.commit()
+            return
+        cred = registry.issue_sub_credential(
+            conn,
+            licensor_id="binky",
+            credential_label=label,
+            rights="admin",
+            issued_by="bootstrap_binky",
+        )
+        conn.commit()
+        print(f"issued binky credential label={cred.credential_label!r}")
+        print(f"TOKEN={cred.token}")
+        out = os.environ.get("TRF_BOOTSTRAP_TOKEN_FILE")
+        if out:
+            with open(out, "w", encoding="utf-8") as f:
+                f.write(cred.token)
+            print(f"wrote token to {out}")
+
+
+if __name__ == "__main__":
+    main()

scripts/docker-entrypoint.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Container entrypoint (WP-0011): combined Trust Service + Control Plane.
+set -e
+# Optional: run migrations when TRF_RUN_MIGRATIONS=1 (used by migrate Job).
+if [ "${TRF_RUN_MIGRATIONS:-0}" = "1" ]; then
+  exec python /usr/local/bin/apply_migrations.py
+fi
+if [ "${TRF_BOOTSTRAP_BINKY:-0}" = "1" ]; then
+  exec python /usr/local/bin/bootstrap_binky.py
+fi
+exec python -m uvicorn target_revenue.service.combined:app \
+  --host 0.0.0.0 \
+  --port 8000 \
+  --proxy-headers \
+  --forwarded-allow-ips='*'