catalog: draft scaleway-bootstrap lane

Pointer to the mason plan and playbook. Founder provision only;
warden does not execute the fetch.

registry/routing/catalog.yaml

@@ -640,6 +640,23 @@ entries:
         - "USER_ENGINE_PROXY_SECRET: rotate user-engine/user-engine-runtime, re-run make coulomb-social-env-secret, restart app."
         - "DATABASE_URL: platform rotates apps-pg role password secret; re-run make coulomb-social-env-secret; restart app."
 
+  - id: audit-core-senders
+    title: audit-core sender registry (write and operator-read tokens)
+    need_keywords: [audit-core, senders, sender registry, ingest token, AUDIT_CORE_SENDERS]
+    owner_repo: ops-mason
+    subsystem: OpenBao + audit-core
+    warden_executes: false
+    wiki_ref: wiki/playbooks/audit-core-senders.md#worker-checklist
+    canon_ref: audit-core/docs/operator-runbook.md
+    reviewed: "2026-08-13"
+    status: draft
+    auth_method: "in-cluster generated Secret audit-core-senders; later OpenBao KV via Mason wrap-migrate"
+    path_template: "platform/workloads/audit-core/senders"
+    policy_ref: "external-secrets-audit-core"
+    exec_capable: false
+    resolvable: false
+    lane: secret
+
   - id: email-connect-transactional
     title: email-connect transactional SMTP and caller ingest token
     need_keywords: [email-connect, transactional, smtp, ionos, starttls, ingest, invitation, verification, EMAIL_CONNECT_SMTP_PASSWORD, EMAIL_CONNECT_INGEST_TOKEN]
@@ -675,3 +692,31 @@ entries:
         - "`bao kv put platform/workloads/email-connect/transactional EMAIL_CONNECT_SMTP_PASSWORD=@file` (and USERNAME/INGEST_TOKEN if those rotate); shred mode-0600 files."
         - "ESO re-syncs email-connect/email-connect-runtime; roll email-connect. If INGEST_TOKEN changed, update user-engine runtime and roll user-engine."
         - "Verify capabilities-safe on platform/data/workloads/email-connect/transactional; confirm /healthz Ready without printing secret values."
+
+  - id: scaleway-bootstrap
+    title: Scaleway org/project API key for reef-storage bucket create
+    need_keywords: [scaleway, s3, object-storage, bootstrap, reef-storage, backup, nl-ams]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + Scaleway
+    warden_executes: false
+    wiki_ref: wiki/playbooks/scaleway-bootstrap.md#worker-checklist
+    canon_ref: ops-mason/plans/reef-storage-scaleway-bootstrap.md
+    reviewed: "2026-08-14"
+    status: draft
+    risk: high
+    # CCR-2026-0011. Values via founder paste-once or local tfvars ingest.
+    # Not the Barman runtime key (platform-pg-backup-s3).
+    auth_method: "caller's own OpenBao token (founder / operator workstation)"
+    path_template: "platform/workloads/railiance/scaleway/bootstrap"
+    fetch_command: "bao kv metadata get platform/workloads/railiance/scaleway/bootstrap"
+    exec_capable: false
+    resolvable: false
+    lane: secret
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "In Scaleway IAM, revoke the bootstrap API key after the scoped bucket key exists."
+        - "Delete or overwrite platform/workloads/railiance/scaleway/bootstrap; do not copy values into chat."
+        - "Confirm metadata gone or version bumped; capabilities-safe only."

wiki/playbooks/audit-core-senders.md

@@ -0,0 +1,19 @@
+# audit-core sender registry
+
+## Worker checklist
+
+This file is a pointer only. ops-warden does not issue sender tokens and
+does not duplicate the operating procedure.
+
+- Construction plan: `ops-mason/plans/audit-core-openbao-runtime-custody.md`
+- Package and operator runbook: `audit-core/docs/operator-runbook.md`
+- Database leases (separate lane): `warden route show database-dynamic-credentials`
+- Authoritative senders shape: `audit-core/docs/senders.example.json` (placeholders only)
+
+First deploy mints sender tokens in-cluster into Secret
+`audit-core/audit-core-senders`. The OpenBao path
+`platform/workloads/audit-core/senders` is the later authority, filled by a
+Mason wrap-migrate — not by a founder `bao kv put`.
+
+Never place a sender token, bearer, or `senders.json` value in Git, State
+Hub, logs, or chat.

wiki/playbooks/scaleway-bootstrap.md

@@ -0,0 +1,34 @@
+# Scaleway bootstrap API key
+
+Date: 2026-08-14  
+Catalog: `scaleway-bootstrap` (status `draft`)  
+Owner: `railiance-platform` (CCR-2026-0011) · consumer: `reef-storage`  
+Plan: `ops-mason/plans/reef-storage-scaleway-bootstrap.md`
+
+Org/project API key used only to create the WP-0002 backup bucket.
+Not the Barman runtime key.
+
+## OpenBao pointers
+
+| Field | Value |
+| --- | --- |
+| Mount | `platform` |
+| Path | `platform/workloads/railiance/scaleway/bootstrap` |
+| Fields | `ACCESS_KEY`, `SECRET_KEY`, `DEFAULT_ORGANIZATION_ID`, `DEFAULT_PROJECT_ID` |
+| Terraform map | `access_key`, `secret_key`, `organization_id`, `project_id` |
+
+## Worker checklist
+
+1. Confirm metadata exists (no values):  
+   `bao kv metadata get platform/workloads/railiance/scaleway/bootstrap`
+2. Create the bucket with  
+   `reef-storage/tools/create-platform-audit-bucket.sh`  
+   (reads OpenBao, never prints keys).
+3. Commit only non-secret YAML under `reef-storage/substrate/object-stores/`.
+4. After T04 scoped key works, ask the founder to revoke this bootstrap key.
+
+## Founder provision
+
+Preferred: four paste-once desk writes (one field each), or one local ingest
+of an existing `scaleway.auto.tfvars` — see the mason plan. Never paste
+values into chat.