catalog: draft scaleway-bootstrap lane

Pointer to the mason plan and playbook. Founder provision only;
warden does not execute the fetch.

registry/routing/catalog.yaml

@@ -692,3 +692,31 @@ entries:
         - "`bao kv put platform/workloads/email-connect/transactional EMAIL_CONNECT_SMTP_PASSWORD=@file` (and USERNAME/INGEST_TOKEN if those rotate); shred mode-0600 files."
         - "ESO re-syncs email-connect/email-connect-runtime; roll email-connect. If INGEST_TOKEN changed, update user-engine runtime and roll user-engine."
         - "Verify capabilities-safe on platform/data/workloads/email-connect/transactional; confirm /healthz Ready without printing secret values."
+
+  - id: scaleway-bootstrap
+    title: Scaleway org/project API key for reef-storage bucket create
+    need_keywords: [scaleway, s3, object-storage, bootstrap, reef-storage, backup, nl-ams]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + Scaleway
+    warden_executes: false
+    wiki_ref: wiki/playbooks/scaleway-bootstrap.md#worker-checklist
+    canon_ref: ops-mason/plans/reef-storage-scaleway-bootstrap.md
+    reviewed: "2026-08-14"
+    status: draft
+    risk: high
+    # CCR-2026-0011. Values via founder paste-once or local tfvars ingest.
+    # Not the Barman runtime key (platform-pg-backup-s3).
+    auth_method: "caller's own OpenBao token (founder / operator workstation)"
+    path_template: "platform/workloads/railiance/scaleway/bootstrap"
+    fetch_command: "bao kv metadata get platform/workloads/railiance/scaleway/bootstrap"
+    exec_capable: false
+    resolvable: false
+    lane: secret
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "In Scaleway IAM, revoke the bootstrap API key after the scoped bucket key exists."
+        - "Delete or overwrite platform/workloads/railiance/scaleway/bootstrap; do not copy values into chat."
+        - "Confirm metadata gone or version bumped; capabilities-safe only."

wiki/playbooks/scaleway-bootstrap.md

@@ -0,0 +1,34 @@
+# Scaleway bootstrap API key
+
+Date: 2026-08-14  
+Catalog: `scaleway-bootstrap` (status `draft`)  
+Owner: `railiance-platform` (CCR-2026-0011) · consumer: `reef-storage`  
+Plan: `ops-mason/plans/reef-storage-scaleway-bootstrap.md`
+
+Org/project API key used only to create the WP-0002 backup bucket.
+Not the Barman runtime key.
+
+## OpenBao pointers
+
+| Field | Value |
+| --- | --- |
+| Mount | `platform` |
+| Path | `platform/workloads/railiance/scaleway/bootstrap` |
+| Fields | `ACCESS_KEY`, `SECRET_KEY`, `DEFAULT_ORGANIZATION_ID`, `DEFAULT_PROJECT_ID` |
+| Terraform map | `access_key`, `secret_key`, `organization_id`, `project_id` |
+
+## Worker checklist
+
+1. Confirm metadata exists (no values):  
+   `bao kv metadata get platform/workloads/railiance/scaleway/bootstrap`
+2. Create the bucket with  
+   `reef-storage/tools/create-platform-audit-bucket.sh`  
+   (reads OpenBao, never prints keys).
+3. Commit only non-secret YAML under `reef-storage/substrate/object-stores/`.
+4. After T04 scoped key works, ask the founder to revoke this bootstrap key.
+
+## Founder provision
+
+Preferred: four paste-once desk writes (one field each), or one local ingest
+of an existing `scaleway.auto.tfvars` — see the mason plan. Never paste
+values into chat.