workplan: RMASTER-WP-0022 establish reef-storage

Plan a storage reef for Scaleway object storage, distinct from
reef-railiance. Backup attributes will live there; the reef schema
must allow a substrate with no compute rail.

workplans/RMASTER-WP-0022-establish-reef-storage.md

@@ -0,0 +1,125 @@
+---
+id: RMASTER-WP-0022
+type: workplan
+title: "Establish reef-storage for Scaleway object storage"
+domain: financials
+repo: railiance-master
+status: proposed
+owner: grok
+topic_slug: railiance
+created: "2026-08-14"
+updated: "2026-08-14"
+related:
+  - RMASTER-WP-0017
+  - RMASTER-WP-0021
+  - RESOURCE-WP-0002
+  - RESOURCE-WP-0006
+state_hub_workstream_id: "b63b9d6b-deb5-4f13-b6db-12da6f7bd644"
+---
+
+# RMASTER-WP-0022 — establish reef-storage
+
+## Goal
+
+Create `reef-storage` as the reef that **operates** S3-compatible object
+storage (first instance: Scaleway, for postgres backup). This is a
+different substrate from `reef-railiance`. Backup will not be provided on
+top of the home compute reef.
+
+`resource-control` procures and costs the bucket. `reef-storage` owns the
+committed non-secret operating attributes (endpoint, bucket, region,
+prefix, lifecycle). `railiance-platform` holds the secret.
+`rapp-postgres` consumes a reviewed destination.
+
+Join convention: `resource-control/docs/operational-reference-convention.md`
+(`reef:storage/…#key`).
+
+## Why a new reef
+
+`docs/reef-substrate-model.md`: a reef is one durable operational
+boundary. Scaleway object storage has its own identity, access path,
+lifecycle, and failure domain (`provider:scaleway` / `region:nl-ams`).
+Putting a bucket “on” `reef-railiance` would mix a cloud object store into
+a Host Europe compute substrate and hide the independent failure domain
+the backup workplan requires.
+
+## Schema tension
+
+The current `reef.schema.json` requires `primary_rail` and
+`hosted_rails`. A storage reef does not host `rail-kubernetes`. This
+workplan must either:
+
+- allow a storage substrate with no rail (preferred), or
+- introduce a storage execution contract later, not as a fake rail.
+
+Do not list `rail-kubernetes` as hosted just to satisfy the schema.
+
+## Intended declaration (planned)
+
+```yaml
+kind: substrate-reef
+reef_id: reef-storage
+repo: reef-storage
+ownership_repo: railiance-platform
+substrate_kind: object-storage
+lifecycle_state: planned
+criticality: high
+# primary_rail / hosted_rails: omitted or schema-extended — see T01
+current_members: []   # fill with Scaleway project/bucket names after purchase
+```
+
+Non-secret attributes live under e.g.
+`substrate/object-stores/<resource-slug>.yaml` so resource-control can cite
+`reef:storage/substrate/object-stores/platform-audit-storage.yaml#endpoint`.
+
+## T01 — Extend the reef schema for storage substrates
+
+```task
+id: RMASTER-WP-0022-T01
+status: todo
+priority: high
+state_hub_task_id: "c222e439-795d-45bb-ba81-b94b2a571a1c"
+```
+
+Amend `schemas/reef.schema.json` and
+`docs/reef-substrate-model.md` so a reef may be an object-storage (or
+other provider-managed) substrate without hosting a compute rail.
+Document `substrate_kind: object-storage`. Keep `reef-railiance` valid.
+
+Done when a planned `reef-storage` declaration validates and
+`reef-railiance` still validates.
+
+## T02 — Bootstrap the reef-storage repo
+
+```task
+id: RMASTER-WP-0022-T02
+status: todo
+priority: high
+state_hub_task_id: "61617b38-27b5-4c44-be8a-244a2476f1eb"
+```
+
+Materialize `reef-storage` from the first-wave bootstrap contract:
+classification, INTENT, SCOPE, AGENTS, `declarations/reef.yaml`, empty
+attribute file layout, workplans. Register the remote. Do not create a
+Scaleway account in this task.
+
+Done when the repo exists, declares `lifecycle_state: planned`, and
+resource-control can name `reef:storage/…` paths that will be filled after
+purchase.
+
+## T03 — Attribute file contract for object stores
+
+```task
+id: RMASTER-WP-0022-T03
+status: todo
+priority: medium
+state_hub_task_id: "6ea318c4-33e5-4177-9f87-433670636304"
+```
+
+Define the committed YAML shape for one object-store: endpoint, region,
+bucket, prefix, versioning/lifecycle flags, provider project ref. No
+keys. Hand resource-control and `rapp-postgres` the path, not a chat
+paste.
+
+Done when a schema or documented example exists and WP-0002 T03 can cite
+it as the destination of non-secret attributes after buy.