Self-bootstrapping startup: zero ordered setup commands

[maxkuttner]

What

A fresh checkout is now just run the app — no ordered make commands. The app self-provisions on boot and auto-syncs instruments.

How

• Boot-time bootstrap (src/setup/bootstrap.rs) runs before the runtime pool connects: orchestrates the existing idempotent scripts (provision.sh → migrate.sh up → access.sh → seed.sh) as the admin role, then the app serves as least-privilege oms_user. Reuses tested SQL rather than reimplementing psql meta-commands.
• Background instrument sync after the server binds — every credentialed broker, so the minutes-long Alpaca option chain never blocks listening.
• broker_connection auto-created at boot for every broker whose creds are present. This is routing config, not fixture data — without it a configured broker can't take an order. (This was the "no brokers" gap.)
• Dev identity (principal/account/portfolio/api-key) created when OMS_DEV_IDENTITY=true, so a fresh install can place a paper order with no admin setup. Off by default — it mints a known API secret, PAPER/dev only.

Safety

• Bootstrap skips gracefully when provisioning creds are incomplete or OMS_BOOTSTRAP=off — it only adds the fresh-install path, never turns a working DB into a broken one. The runtime pool is still oms_user; only the bounded boot step touches admin creds (already in .env).
• preflight: an empty catalog is expected (not fatal) when a background sync will fill it.

Knobs

OMS_BOOTSTRAP (auto|off) · OMS_SYNC_ON_BOOT (if-empty|never) · OMS_SYNC_UNDERLYINGS · OMS_DEV_IDENTITY (default false)

Fixture split

By ownership: minimal_seed.sql = master-data only (admin role); dev_identity.sql = the oms-schema identity chain (include_str!'d, run as oms_user).

Verification

• Bare Postgres → run the app: 39 migrations applied, ref-data seeded, both alpaca-paper + binance-paper connections created, full dev identity chain, 14,161 instruments synced in background — server bound immediately. Zero make commands.
• Existing DB, incomplete creds: bootstrap skips, feeds live, data untouched.
• OMS_BOOTSTRAP=off: skips, boots as oms_user.
• Cockpit verified end-to-end (Principals/Accounts/Broker connections/Instruments all populate).
• Tests 105, cockpit tsc + build clean, clippy clean on new code. Scratch DBs dropped.

Context

Grew out of researching how a runtime-load framework does setup (in-memory cache, one config, no seeding) — we keep the DB-backed model but remove the ordered-command friction.