feat: vend platform-pg-backup-s3 via AppRole ESO

Policy and AppRole applied. Store Valid, ExternalSecret SecretSynced.
Prefix empty. WAL not enabled.

argocd/platform-addons/openbao-secretstore/openbao-backup-object-storage.clustersecretstore.yaml

@@ -1,11 +1,9 @@
-# DRAFT — CCR-2026-0012. Do not apply until the CCR is approved and the
-# KV values are real. Deploy on railiance01 (first consumer lives in
+# CCR-2026-0012. Deploy on railiance01 (first consumer lives in
 # databases), not the CoulombCore ArgoCD kustomization.
 #
-# Prereq: ESO can authenticate to OpenBao with policy
-# workload-kv-read-backup-object-storage. Interim railiance01 identity
-# may be AppRole or a child token; Kubernetes auth role
-# external-secrets-backup-object-storage is the CCR-declared steady state.
+# Prereq: Secret external-secrets/openbao-backup-object-storage-approle
+# (role-id, secret-id) for AppRole external-secrets-backup-object-storage.
+# Same-cluster Kubernetes auth remains the follow-up.
 # Add further namespace conditions when another backup consumer is bound.
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
@@ -22,12 +20,16 @@ spec:
       path: platform
       version: v2
       auth:
-        kubernetes:
-          mountPath: kubernetes
-          role: external-secrets-backup-object-storage
-          serviceAccountRef:
-            name: external-secrets
+        appRole:
+          path: approle
+          roleRef:
+            name: openbao-backup-object-storage-approle
             namespace: external-secrets
+            key: role-id
+          secretRef:
+            name: openbao-backup-object-storage-approle
+            namespace: external-secrets
+            key: secret-id
   conditions:
     - namespaces:
         - databases

credential-change-requests/CCR-2026-0012-backup-object-storage.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Scaleway scoped backup object-storage key
-status: approved
+status: applied
 created: '2026-08-14'
 updated: '2026-08-14'
 requester:
@@ -67,7 +67,7 @@ access_frontdoor:
   selector: resource-control scoped backup access
   command: warden access backup-object-storage --fetch ACCESS_KEY
   resolvable: false
-  readiness: approved-pending-apply
+  readiness: applied-pending-verify
 delivery:
   surface: external-secrets
   target: >-

docs/evidence/CCR-2026-0012-backup-key-verify-2026-08-14.md

@@ -1,7 +1,7 @@
 # CCR-2026-0012 — scoped backup key verification
 
 Date: 2026-08-14  
-Status: **key live in OpenBao; cluster Secret not vended**  
+Status: **applied — Secret `databases/platform-pg-backup-s3` synced**  
 CCR: approved in chat 2026-08-14  
 Path: `platform/workloads/railiance/backup/object-storage` (KV v2 version 1)
 
@@ -23,7 +23,9 @@ Distinct from the CCR-2026-0011 bootstrap key (`keys_differ=yes`).
 
 - `scw object bucket list` / `get railiance-platform-pg-backup` in `nl-ams` succeeded.
 - boto3 put/get/delete of a probe object under `platform-pg/` succeeded; probe deleted.
-- Sibling prefix write also succeeded: no bucket policy yet, so prefix isolation is not enforced.
+- Sibling prefix write is now denied (`AccessDenied`) after the
+  `resource-control-scoped-backup` bucket policy
+  (`BackupListPrefix`, `BackupObjectsUnderPrefix`) applied 2026-08-14.
 
 ## Negative
 
@@ -34,13 +36,12 @@ Distinct from the CCR-2026-0011 bootstrap key (`keys_differ=yes`).
 
 `instance` / `vpc` / `rdb` / `registry` / `lb` list returned empty success. That is consistent with a project that has no those resources; it is not a proven compute-write deny. Do not create a paid resource to prove it.
 
-## Not done
+## Cluster delivery (same day)
 
-- OpenBao policy `workload-kv-read-backup-object-storage` — this token cannot `sys/policies/acl` write (403).
-- ClusterSecretStore / ExternalSecret — railiance01 has no `platform-pg-backup-s3` yet; applying the draft store would fail without ESO auth.
-- Bucket policy — needs `APPLICATION_ID`.
-- WAL / `barmanObjectStore` on `platform-pg` — T05.
-
-## Next
-
-ops-mason (or a token that can write policies and ESO auth) applies the OpenBao policy and the `databases`-scoped store. Then ExternalSecret can project the Secret. After that, empty-WAL-archive preflight; still no continuous archiving until T05.
+- Policy `workload-kv-read-backup-object-storage` written.
+- AppRole `external-secrets-backup-object-storage` (15m/30m, 8 uses).
+- Secret `external-secrets/openbao-backup-object-storage-approle` applied; local delivery shredded.
+- ClusterSecretStore `openbao-backup-object-storage` Ready/Valid, condition `databases` only.
+- ExternalSecret `databases/platform-pg-backup-s3` SecretSynced. Keys `ACCESS_KEY_ID` (len 20) and `ACCESS_SECRET_KEY` (len 36). Values not read.
+- Prefix `platform-pg/` object count: 0.
+- `platform-pg` still has no `barmanObjectStore`. WAL is T05.