From e2ac6448c23c1dad1a3c18e3c88a24f2a3229cc0 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sun, 18 Oct 2026 11:37:06 +0200
Subject: [PATCH] Add placeholder script for Scaleway supplier KV entries

Creates platform/suppliers/scaleway/{bootstrap,backup,mas-tem-relay} with
xxx values (cas=0, silent, receipt without values) for the founder to fill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
---
 scripts/put-scaleway-supplier-placeholders.sh | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100755 scripts/put-scaleway-supplier-placeholders.sh

diff --git a/scripts/put-scaleway-supplier-placeholders.sh b/scripts/put-scaleway-supplier-placeholders.sh
new file mode 100755
index 0000000..6f391ae
--- /dev/null
+++ b/scripts/put-scaleway-supplier-placeholders.sh
@@ -0,0 +1,63 @@
+#!/bin/sh
+# Create the Scaleway supplier-account KV entries with placeholder values
+# (supplier convention platform/suppliers/<supplier>/<account>, founder
+# decision 2026-10-08). The founder then replaces each `xxx` in the OpenBao UI.
+#
+# Founder act; ops-mason's survey grant cannot write. Run silently:
+#   warden access openbao-platform-admin-login --exec -- \
+#     sh /home/worsch/ops-mason/scripts/put-scaleway-supplier-placeholders.sh
+#
+# -cas=0 refuses to write a path that already exists, so a real value is never
+# overwritten; a rerun fails harmlessly. No secret values pass through this script.
+# The receipt holds path, version and result only.
+set -u
+umask 077
+receipt_dir=/home/worsch/.local/state/railiance/receipts
+mkdir -p "$receipt_dir"
+receipt="$receipt_dir/scaleway-supplier-placeholders.txt"
+: >"$receipt"
+
+put() {
+  path=$1; shift
+  if bao kv put -cas=0 "$path" "$@" >/dev/null 2>&1; then
+    echo "$path created" >>"$receipt"
+  else
+    echo "$path not written (exists or denied)" >>"$receipt"
+  fi
+}
+
+meta() {
+  path=$1; shift
+  bao kv metadata put "$@" "$path" >/dev/null 2>&1 \
+    || echo "$path metadata not written" >>"$receipt"
+}
+
+# Same field names as platform/workloads/railiance/{scaleway/bootstrap,backup/object-storage}.
+put platform/suppliers/scaleway/bootstrap \
+  ACCESS_KEY=xxx SECRET_KEY=xxx DEFAULT_ORGANIZATION_ID=xxx DEFAULT_PROJECT_ID=xxx
+meta platform/suppliers/scaleway/bootstrap \
+  -custom-metadata=owner=railiance-platform \
+  -custom-metadata=purpose=scaleway-bootstrap-iam-key \
+  -custom-metadata=readers=none-yet
+
+put platform/suppliers/scaleway/backup \
+  ACCESS_KEY=xxx SECRET_KEY=xxx DEFAULT_ORGANIZATION_ID=xxx DEFAULT_PROJECT_ID=xxx
+meta platform/suppliers/scaleway/backup \
+  -custom-metadata=owner=railiance-platform \
+  -custom-metadata=purpose=resource-control-scoped-backup-key \
+  -custom-metadata=readers=none-yet
+
+# MASON-WP-0014, temporary: tear down at MAS-WP-0003 close.
+put platform/suppliers/scaleway/mas-tem-relay username=xxx password=xxx
+meta platform/suppliers/scaleway/mas-tem-relay \
+  -custom-metadata=owner=railiance-platform \
+  -custom-metadata=purpose=mas-live-test-tem-smtp \
+  -custom-metadata=readers=external-secrets-mas-tem-relay \
+  -custom-metadata=plan=ops-mason/plans/mas-tem-relay-smtp.md
+
+# Version numbers only; values are never read.
+for p in bootstrap backup mas-tem-relay; do
+  v=$(bao kv metadata get -format=json "platform/suppliers/scaleway/$p" 2>/dev/null \
+      | sed -n 's/.*"current_version": *\([0-9]*\).*/\1/p' | head -1)
+  echo "platform/suppliers/scaleway/$p current_version=${v:-unknown}" >>"$receipt"
+done