workplan: RMASTER-WP-0022 establish reef-storage

Plan a storage reef for Scaleway object storage, distinct from
reef-railiance. Backup attributes will live there; the reef schema
must allow a substrate with no compute rail.

WORK-RECORDS.md

@@ -14,6 +14,7 @@
 | workplan | RMASTER-WP-0019 | finished | — | workplans/RMASTER-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
 | workplan | RMASTER-WP-0020 | backlog | — | workplans/RMASTER-WP-0020-openbao-migration-to-reef-railiance.md |
 | workplan | RMASTER-WP-0021 | finished | — | workplans/RMASTER-WP-0021-rapp-declaration-schema.md |
+| workplan | RMASTER-WP-0022 | proposed | — | workplans/RMASTER-WP-0022-establish-reef-storage.md |
 | task | ADHOC-2026-07-30-T01 | done | — | workplans/ADHOC-2026-07-30.md |
 | task | RMASTER-WP-0017-T01 | done | — | workplans/RMASTER-WP-0017-rail-rapp-reef-repo-separation.md |
 | task | RMASTER-WP-0017-T02 | done | — | workplans/RMASTER-WP-0017-rail-rapp-reef-repo-separation.md |
@@ -55,3 +56,6 @@
 | task | RMASTER-WP-0021-T07 | done | — | workplans/RMASTER-WP-0021-rapp-declaration-schema.md |
 | task | RMASTER-WP-0021-T08 | done | — | workplans/RMASTER-WP-0021-rapp-declaration-schema.md |
 | task | RMASTER-WP-0021-T09 | done | — | workplans/RMASTER-WP-0021-rapp-declaration-schema.md |
+| task | RMASTER-WP-0022-T01 | todo | — | workplans/RMASTER-WP-0022-establish-reef-storage.md |
+| task | RMASTER-WP-0022-T02 | todo | — | workplans/RMASTER-WP-0022-establish-reef-storage.md |
+| task | RMASTER-WP-0022-T03 | todo | — | workplans/RMASTER-WP-0022-establish-reef-storage.md |

docs/repo-family-bootstrap-contract.md

@@ -96,8 +96,10 @@ reefs it is placed on; that field is the source of a reef's `bound_rapps`.
 
 `runtime_dependencies` names capabilities, not the resources that satisfy
 them. Who provisions a capability (for example the postgres backup object
-store) is owned outside the rapp: the bucket by `resource-control`, the
-credential by `railiance-platform`. The rapp consumes a reviewed destination.
+store) is owned outside the rapp: procurement and cost by
+`resource-control`, operation and non-secret attributes by the reef
+(`reef-storage` for S3, not `reef-railiance`), the credential by
+`railiance-platform`. The rapp consumes a reviewed destination.
 
 ### `reef-*`
 

workplans/RMASTER-WP-0022-establish-reef-storage.md

@@ -0,0 +1,125 @@
+---
+id: RMASTER-WP-0022
+type: workplan
+title: "Establish reef-storage for Scaleway object storage"
+domain: financials
+repo: railiance-master
+status: proposed
+owner: grok
+topic_slug: railiance
+created: "2026-08-14"
+updated: "2026-08-14"
+related:
+  - RMASTER-WP-0017
+  - RMASTER-WP-0021
+  - RESOURCE-WP-0002
+  - RESOURCE-WP-0006
+state_hub_workstream_id: "b63b9d6b-deb5-4f13-b6db-12da6f7bd644"
+---
+
+# RMASTER-WP-0022 — establish reef-storage
+
+## Goal
+
+Create `reef-storage` as the reef that **operates** S3-compatible object
+storage (first instance: Scaleway, for postgres backup). This is a
+different substrate from `reef-railiance`. Backup will not be provided on
+top of the home compute reef.
+
+`resource-control` procures and costs the bucket. `reef-storage` owns the
+committed non-secret operating attributes (endpoint, bucket, region,
+prefix, lifecycle). `railiance-platform` holds the secret.
+`rapp-postgres` consumes a reviewed destination.
+
+Join convention: `resource-control/docs/operational-reference-convention.md`
+(`reef:storage/…#key`).
+
+## Why a new reef
+
+`docs/reef-substrate-model.md`: a reef is one durable operational
+boundary. Scaleway object storage has its own identity, access path,
+lifecycle, and failure domain (`provider:scaleway` / `region:nl-ams`).
+Putting a bucket “on” `reef-railiance` would mix a cloud object store into
+a Host Europe compute substrate and hide the independent failure domain
+the backup workplan requires.
+
+## Schema tension
+
+The current `reef.schema.json` requires `primary_rail` and
+`hosted_rails`. A storage reef does not host `rail-kubernetes`. This
+workplan must either:
+
+- allow a storage substrate with no rail (preferred), or
+- introduce a storage execution contract later, not as a fake rail.
+
+Do not list `rail-kubernetes` as hosted just to satisfy the schema.
+
+## Intended declaration (planned)
+
+```yaml
+kind: substrate-reef
+reef_id: reef-storage
+repo: reef-storage
+ownership_repo: railiance-platform
+substrate_kind: object-storage
+lifecycle_state: planned
+criticality: high
+# primary_rail / hosted_rails: omitted or schema-extended — see T01
+current_members: []   # fill with Scaleway project/bucket names after purchase
+```
+
+Non-secret attributes live under e.g.
+`substrate/object-stores/<resource-slug>.yaml` so resource-control can cite
+`reef:storage/substrate/object-stores/platform-audit-storage.yaml#endpoint`.
+
+## T01 — Extend the reef schema for storage substrates
+
+```task
+id: RMASTER-WP-0022-T01
+status: todo
+priority: high
+state_hub_task_id: "c222e439-795d-45bb-ba81-b94b2a571a1c"
+```
+
+Amend `schemas/reef.schema.json` and
+`docs/reef-substrate-model.md` so a reef may be an object-storage (or
+other provider-managed) substrate without hosting a compute rail.
+Document `substrate_kind: object-storage`. Keep `reef-railiance` valid.
+
+Done when a planned `reef-storage` declaration validates and
+`reef-railiance` still validates.
+
+## T02 — Bootstrap the reef-storage repo
+
+```task
+id: RMASTER-WP-0022-T02
+status: todo
+priority: high
+state_hub_task_id: "61617b38-27b5-4c44-be8a-244a2476f1eb"
+```
+
+Materialize `reef-storage` from the first-wave bootstrap contract:
+classification, INTENT, SCOPE, AGENTS, `declarations/reef.yaml`, empty
+attribute file layout, workplans. Register the remote. Do not create a
+Scaleway account in this task.
+
+Done when the repo exists, declares `lifecycle_state: planned`, and
+resource-control can name `reef:storage/…` paths that will be filled after
+purchase.
+
+## T03 — Attribute file contract for object stores
+
+```task
+id: RMASTER-WP-0022-T03
+status: todo
+priority: medium
+state_hub_task_id: "6ea318c4-33e5-4177-9f87-433670636304"
+```
+
+Define the committed YAML shape for one object-store: endpoint, region,
+bucket, prefix, versioning/lifecycle flags, provider project ref. No
+keys. Hand resource-control and `rapp-postgres` the path, not a chat
+paste.
+
+Done when a schema or documented example exists and WP-0002 T03 can cite
+it as the destination of non-secret attributes after buy.