Remove migration CLI command

Author: sl5-guy

README.md

@@ -24,7 +24,7 @@ sudo apt-get install libtss2-dev swtpm tpm2-tools pkg-config
 cp config.example.toml config.toml    # edit to taste
 docker compose -f docker-compose.postgres.yml up -d
 export AGENT_GATEWAY_DATABASE_URL=postgres://agent_gateway_admin:agent_gateway_dev@localhost:5432/agent_gateway
-cargo run -- --config config.toml migrate
+psql "$AGENT_GATEWAY_DATABASE_URL" -f migrations/0001_signed_authorization_registry.sql
 ```
 
 `generate-certs.sh` only creates **server** TLS material (`server-ca.pem`, `server.pem`, ...). Each agent platform enrolls with `./examples/demo-agent.sh`, which starts a local `swtpm`, creates a persistent P-256 signing key in that simulated TPM, and prepares `machine-client.pem` as a certificate carrier for that public key and identity extension. The gateway does not trust a client CA bundle; it authorizes the exact subject public key recorded in signed Postgres permission rows.
@@ -95,7 +95,7 @@ agent_gateway --config config.toml
 Run migrations explicitly before starting the gateway:
 
 ```bash
-agent_gateway --config config.toml migrate
+psql "$AGENT_GATEWAY_DATABASE_URL" -f migrations/0001_signed_authorization_registry.sql
 ```
 
 Gateway startup verifies the authorization registry schema version and fails fast if the database is not migrated. The runtime gateway database role should be read-only for authorization tables; use a separate admin role for migrations and registry writes.

src/main.rs

@@ -1,39 +1,23 @@
-mod config;
-mod observability;
-mod policy;
-mod proxy;
-mod registry;
-mod tls;
-
 use std::path::PathBuf;
 use std::str::FromStr;
 use std::sync::Arc;
 
+use agent_gateway::policy::PostgresPolicyEngine;
+use agent_gateway::proxy::MakeProxyService;
+use agent_gateway::{config, observability, policy, proxy, registry, tls};
 use anyhow::Context;
-use clap::{Parser, Subcommand};
+use clap::Parser;
 use hyper_util::rt::TokioExecutor;
 use sqlx::postgres::{PgConnectOptions, PgPool, PgPoolOptions};
 use tokio::net::TcpListener;
 use tracing::{error, info};
 
-use crate::policy::PostgresPolicyEngine;
-use crate::proxy::MakeProxyService;
-
 #[derive(Parser)]
 #[command(name = "agent_gateway", about = "mTLS HTTP/2 CONNECT proxy")]
 struct Cli {
     /// Path to the TOML configuration file
     #[arg(short, long, default_value = "config.toml")]
     config: PathBuf,
-
-    #[command(subcommand)]
-    command: Option<CliCommand>,
-}
-
-#[derive(Clone, Copy, Subcommand)]
-enum CliCommand {
-    /// Run authorization registry database migrations and exit
-    Migrate,
 }
 
 #[tokio::main]
@@ -46,10 +30,7 @@ async fn main() -> anyhow::Result<()> {
     let config = config::Config::load(&cli.config)
         .with_context(|| format!("loading config from {}", cli.config.display()))?;
 
-    match cli.command {
-        None => serve(config).await,
-        Some(CliCommand::Migrate) => migrate(config).await,
-    }
+    serve(config).await
 }
 
 async fn serve(config: config::Config) -> anyhow::Result<()> {
@@ -85,12 +66,6 @@ async fn serve(config: config::Config) -> anyhow::Result<()> {
     Ok(())
 }
 
-async fn migrate(config: config::Config) -> anyhow::Result<()> {
-    let db_pool = build_pg_pool(&config.policy).await?;
-    registry::RegistryStore::run_migrations(&db_pool).await?;
-    Ok(())
-}
-
 async fn build_pg_pool(policy: &config::PolicyConfig) -> anyhow::Result<PgPool> {
     let database_url = policy.database_url()?;
     let connect_options = PgConnectOptions::from_str(&database_url)