carlos / contra Public

web: bootstrap the instance, the gate, and something to deploy

Nothing else in the web track can land cleanly until this exists, and the
sharpest reason is the merge gate: AGENTS.md wants "done, approved, CI
green", and with no CI script there was no green anybody could reach. That
is what .amadan/ci and its four steps close. Each step execs a make target
rather than carrying its own copy of the commands, following amadan's own
rule that debugging CI is running it — `make ci` locally is byte-for-byte
what the runner does.

Scaffolded with `rastrillo new --shell=console`, not hand-rolled: the
framework's packages exist to be used, and rastrillo/db already sets
busy_timeout before journal_mode, WAL, foreign keys and a
single-connection writer pool — exactly what web/1 asks for and exactly the
ordering that crashes under concurrent open when you get it backwards.

Two departures from the scaffold, both deliberate.

The example `notes(title, body)` model is gone rather than renamed. In a
host-blind password manager a plaintext table is not a starting point to
edit; the whole SQLite file replicates to object storage, so it is the
shape the one rule forbids. The app therefore owns no tables at all yet,
and the sealed schema arrives with the merciless greps in web/2 or it does
not arrive. TestAppOwnsNoTablesYet fails the moment a table appears, and
says why in its message — a placeholder for those greps, to be replaced by
them rather than deleted.

sessions.Schema is in BootSchema from this first migration even though
sign-in is web/3's. Migrations are additive-only and the first deploy of a
version carrying them has to be schema-neutral; getting the session tables
into 0001 costs nothing today and is the case the framework refuses later.

The storage tests assert the pragmas rather than trusting the framework to
have set them. "The framework does it" is a claim; PRAGMA journal_mode is
a fact, and the two are worth keeping distinguishable.

internal/crypto moves to internal/contra/crypto: `rastrillo migration
check` requires exactly one app package under internal/, and keeping that
check in CI is worth more than the old path.

The landing page's prose is lifted verbatim from README.md. Copy in this
repo is a reviewed artifact and the canary needed a page before that review
could happen, so it says only what the README already says.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hz8mMZYs75WuRC1hYpmapJ