Route the MAS evidence Scaleway supplier key.

The founder stored it at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics. The catalog points at metadata only and does not proxy the value.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd

registry/routing/catalog.yaml

@@ -1515,6 +1515,45 @@ entries:
         - "Delete or overwrite platform/workloads/railiance/scaleway/bootstrap; do not copy values into chat."
         - "Confirm metadata gone or version bumped; capabilities-safe only."
 
+  - id: scaleway-mas-evidence-backup-primary
+    title: Scaleway API key for the MAS evidence backup publisher
+    # Pointer only. Founder stored the value at the supplier path on 2026-11-02.
+    # Preferred Scaleway project mail-address-semantics. IAM application
+    # mas-evidence-backup-primary is 25a4cbca-220e-40c0-9af5-6c7713000174.
+    # ops-warden routes this path and does not read or proxy the value.
+    # The workload pair platform/workloads/mas/backup-primary stays empty until
+    # the admitted CAS=0 write. Not the email-connect publisher.
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Supplier API key for the MAS evidence publisher. Delivery remains the separate workload path platform/workloads/mas/backup-primary, which is not admitted."
+    need_keywords: [scaleway, mas, mas-evidence, mail-address-semantics, backup, object-storage, supplier, publisher, preferred-project]
+    owner_repo: railiance-platform
+    subsystem: OpenBao platform mount (suppliers/scaleway)
+    warden_executes: false
+    wiki_ref: wiki/playbooks/platform-supplier-credentials.md#account-mas-evidence-backup-primary
+    canon_ref: railiance-platform/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md
+    reviewed: "2026-11-02"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      reviewed: "2026-11-02"
+      verified: source-read
+    auth_method: "caller's own OpenBao token (founder / operator workstation); value already provisioned by the founder"
+    path_template: "platform/suppliers/scaleway/mas-evidence-backup-primary"
+    fetch_command: "bao kv metadata get platform/suppliers/scaleway/mas-evidence-backup-primary"
+    exec_capable: false
+    lane: secret
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "Revoke the API key on IAM application mas-evidence-backup-primary in Scaleway project mail-address-semantics."
+        - "Mint the replacement into platform/suppliers/scaleway/mas-evidence-backup-primary from a mode-0600 file. Do not print it or copy it onto platform/workloads/mas/backup-primary until the admitted pair write."
+        - "Verify with bao kv metadata get and bao token capabilities only."
+
   - id: openbao-structure-survey
     title: OpenBao existing-structure survey for a construction plan (section 2)
     # Pointer only (WARDEN-WP-0042). Founder decision: ops-warden routes,

wiki/playbooks/platform-supplier-credentials.md

@@ -13,8 +13,9 @@ does not store values and does not apply OpenBao.
 
 1. Pick the path `platform/suppliers/<supplier>/<account>` (two levels, lowercase).
 2. To create or change the path, open a delegated credential change with
-   railiance-platform. The `credential-change.py` allowlist does not yet
-   accept `platform/suppliers/` (WARDEN-WP-0043-T02).
+   railiance-platform. `credential-change.py` accepts
+   `platform/suppliers/<supplier>/<account>` with exactly two segments
+   (WARDEN-WP-0043-T02).
 3. The founder provisions values on a trusted terminal from a mode-0600
    file. Never put a value in git, State Hub, a workplan, a log, or chat.
 4. Verify with metadata and capabilities only:
@@ -35,3 +36,32 @@ A path with a live reader stays where it is until that reader is retargeted.
 
 llm-connect already tries the supplier path first and falls back to the
 workload path.
+
+## Account mas-evidence-backup-primary
+
+Catalog: `scaleway-mas-evidence-backup-primary` (status `active`)  
+Owner: `railiance-platform` · consumer: `mail-address-semantics`  
+Custody: `ops-mason/manifests/custody-descriptions.yaml`
+
+Founder-stored Scaleway API key for IAM application
+`mas-evidence-backup-primary`
+(`25a4cbca-220e-40c0-9af5-6c7713000174`). Its preferred project is
+`mail-address-semantics`. It is the publisher identity for prefix
+`platform-pg/application-archives/mas/` in bucket
+`railiance-platform-pg-backup`. It is not the email-connect publisher
+and not the workload pair.
+
+| Field | Value |
+| --- | --- |
+| Path | `platform/suppliers/scaleway/mas-evidence-backup-primary` |
+| Preferred project | `mail-address-semantics` |
+| Workload pair | `platform/workloads/mas/backup-primary` is still empty |
+
+1. Confirm metadata only:
+   `bao kv metadata get platform/suppliers/scaleway/mas-evidence-backup-primary`
+2. Do not print the value, and do not copy it onto the workload path.
+   That copy waits for the admitted CAS=0 pair write.
+3. The ops-mason custody row is accepted. A full
+   `custody-describe.py apply` rewrites every accepted path, so the live
+   metadata write for this account is a one-path patch under the
+   platform-admin login.