coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record that the MAS backup IAM application exists.
All checks were successful
CCR intake gate / gate (push) Successful in 1m11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The founder created mas-evidence-backup-primary in the console. This
workstation still cannot read its id.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
This commit is contained in:
codex 2026-11-02 10:33:26 +01:00
parent 8d4d285643
commit 7c38de3309
3 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml
View file

@ -103,7 +103,7 @@
"endpoint": "https://s3.nl-ams.scw.cloud",
"bucket": "railiance-platform-pg-backup",
"prefix": "platform-pg/application-archives/mas/",
"identity": "not created; proposed IAM application mas-evidence-backup-primary is not provisioned and is not a key on an existing application",
"identity": "founder created IAM application mas-evidence-backup-primary in the console; application id is not recorded because this workstation has no Scaleway credential",
"retained_delete": false
},
"risk": {

11
docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md
View file

@ -22,7 +22,7 @@ local. It is not an offsite object.
| Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas |
| ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding |
| Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created |
| Provider identity | proposed application mas-evidence-backup-primary | not created; this workstation has no Scaleway credential |
| Provider identity | application mas-evidence-backup-primary | founder created it in the console; this workstation still cannot list it, so its id is not recorded |
Do not reuse the email-connect publisher or its node file. Object-storage IAM
is not prefix-scoped inside a project, so a later admission needs its own IAM
@ -37,10 +37,11 @@ and is not created here.
2. The policy and role are installed. The attended command finished at
2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission
stays false.
3. In the Scaleway console, create a new IAM application named
`mas-evidence-backup-primary`. Do not add a key to email-connect or to a
broad application. Then say that the application exists. This workstation
has no Scaleway credential, so it cannot create the application or its key.
3. The founder created IAM application `mas-evidence-backup-primary` in the
console. Its id is not recorded yet: `scw iam application list` still
reports no credentials on this workstation. The next record is that id,
then the three prefix statements. Do not add a key to email-connect or to
a broad application.
4. Add three bucket-policy statements for that application, limited to
`platform-pg/application-archives/mas/`, with no object delete. Prove sibling
denial, retained-delete denial, and no IAM or bucket administration.

7
workplans/RPF-WP-0070-mas-evidence-recovery.md
View file

@ -40,7 +40,7 @@ status: progress
priority: medium
needs_human: true
depends_on: [RPF-WP-0053-T05]
intervention_note: "CCR-2026-0062 is applied. The OpenBao policy and role were installed at 2026-11-02T09:02:50Z. Delivery admission stays false. The next founder act is to create IAM application mas-evidence-backup-primary in the Scaleway console. Age-identity escrow remains separate."
intervention_note: "CCR-2026-0062 is applied. The founder created IAM application mas-evidence-backup-primary. Its id is not recorded because this workstation has no Scaleway credential. Delivery admission stays false. Age-identity escrow remains separate."
state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8"
```
@ -66,8 +66,9 @@ mas-owner. ServiceAccount `backup-primary-delivery` now exists in
namespace `mas` with automount disabled and no RoleBinding. The binding
is confirmed. Delivery admission stays false. The OpenBao policy and
role were installed at 2026-11-02T09:02:50Z by the silent reader script.
No Scaleway credential is configured here, so IAM application
`mas-evidence-backup-primary` is not created. The KV pair and
The founder created IAM application `mas-evidence-backup-primary` in the
console. This workstation still has no Scaleway credential, so the
application id is not recorded here. The KV pair and
`/etc/mas-backup/primary.env` do not exist. Pair-custody lists still
name only coulomb-social and email-connect.
Design: `docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md`.