From 4fcd8cd7fdb920069673c27e381b9b24af6449fa Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 2 Nov 2026 11:33:05 +0100 Subject: [PATCH] Describe the MAS evidence Scaleway supplier key. The custody row names platform/suppliers/scaleway/mas-evidence-backup-primary and preferred project mail-address-semantics. It does not contain the key. Assistant: grok Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd --- manifests/custody-descriptions.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/manifests/custody-descriptions.yaml b/manifests/custody-descriptions.yaml index 9fd3dc1..22c2379 100644 --- a/manifests/custody-descriptions.yaml +++ b/manifests/custody-descriptions.yaml @@ -12,6 +12,24 @@ operators/nextcloud/backup: used_by: Attended operator only, to manage the account and its create-only /railiance-backups share. Never delivered to production; workloads get only the derived NC_WEBDAV_TOKEN/NC_WEBDAV_URL via the workload lane. +platform/suppliers/scaleway/mas-evidence-backup-primary: + description: Scaleway API key for IAM application mas-evidence-backup-primary + (25a4cbca-220e-40c0-9af5-6c7713000174), preferred project mail-address-semantics. + Publisher for prefix platform-pg/application-archives/mas/ only. + missing: [] + on_loss: Revoke the API key on IAM application mas-evidence-backup-primary in Scaleway + project mail-address-semantics, mint a replacement into this path from a mode-0600 + file, and do not copy it onto platform/workloads/mas/backup-primary until the admitted + pair write. + owner: railiance-platform + review: accepted + rotation: ops-warden/wiki/playbooks/platform-supplier-credentials.md#account-mas-evidence-backup-primary + sources: + - founder provision 2026-11-02 + - ops-warden catalog scaleway-mas-evidence-backup-primary + used_by: Not delivered. The MAS evidence backup publisher may use it only after delivery + admission. platform/workloads/mas/backup-primary and /etc/mas-backup/primary.env do not + hold it. platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets: description: llm-connect provider access through OpenBao workload KV and External Secrets missing: []