From 7c38de33091c18ff2937f6646f90ea3a8164349a Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 2 Nov 2026 10:33:26 +0100 Subject: [PATCH] Record that the MAS backup IAM application exists. The founder created mas-evidence-backup-primary in the console. This workstation still cannot read its id. Assistant: grok Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd --- .../CCR-2026-0062-mas-backup-primary.yaml | 2 +- .../mas-evidence-backup-grant-2026-11-02.md | 11 ++++++----- workplans/RPF-WP-0070-mas-evidence-recovery.md | 7 ++++--- 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml index 44974ed..4a6290c 100644 --- a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml +++ b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml @@ -103,7 +103,7 @@ "endpoint": "https://s3.nl-ams.scw.cloud", "bucket": "railiance-platform-pg-backup", "prefix": "platform-pg/application-archives/mas/", - "identity": "not created; proposed IAM application mas-evidence-backup-primary is not provisioned and is not a key on an existing application", + "identity": "founder created IAM application mas-evidence-backup-primary in the console; application id is not recorded because this workstation has no Scaleway credential", "retained_delete": false }, "risk": { diff --git a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md index a1ff30a..46b7a18 100644 --- a/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md +++ b/docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md @@ -22,7 +22,7 @@ local. It is not an offsite object. | Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas | | ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding | | Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created | -| Provider identity | proposed application mas-evidence-backup-primary | not created; this workstation has no Scaleway credential | +| Provider identity | application mas-evidence-backup-primary | founder created it in the console; this workstation still cannot list it, so its id is not recorded | Do not reuse the email-connect publisher or its node file. Object-storage IAM is not prefix-scoped inside a project, so a later admission needs its own IAM @@ -37,10 +37,11 @@ and is not created here. 2. The policy and role are installed. The attended command finished at 2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission stays false. -3. In the Scaleway console, create a new IAM application named - `mas-evidence-backup-primary`. Do not add a key to email-connect or to a - broad application. Then say that the application exists. This workstation - has no Scaleway credential, so it cannot create the application or its key. +3. The founder created IAM application `mas-evidence-backup-primary` in the + console. Its id is not recorded yet: `scw iam application list` still + reports no credentials on this workstation. The next record is that id, + then the three prefix statements. Do not add a key to email-connect or to + a broad application. 4. Add three bucket-policy statements for that application, limited to `platform-pg/application-archives/mas/`, with no object delete. Prove sibling denial, retained-delete denial, and no IAM or bucket administration. diff --git a/workplans/RPF-WP-0070-mas-evidence-recovery.md b/workplans/RPF-WP-0070-mas-evidence-recovery.md index 1b75d46..9538917 100644 --- a/workplans/RPF-WP-0070-mas-evidence-recovery.md +++ b/workplans/RPF-WP-0070-mas-evidence-recovery.md @@ -40,7 +40,7 @@ status: progress priority: medium needs_human: true depends_on: [RPF-WP-0053-T05] -intervention_note: "CCR-2026-0062 is applied. The OpenBao policy and role were installed at 2026-11-02T09:02:50Z. Delivery admission stays false. The next founder act is to create IAM application mas-evidence-backup-primary in the Scaleway console. Age-identity escrow remains separate." +intervention_note: "CCR-2026-0062 is applied. The founder created IAM application mas-evidence-backup-primary. Its id is not recorded because this workstation has no Scaleway credential. Delivery admission stays false. Age-identity escrow remains separate." state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8" ``` @@ -66,8 +66,9 @@ mas-owner. ServiceAccount `backup-primary-delivery` now exists in namespace `mas` with automount disabled and no RoleBinding. The binding is confirmed. Delivery admission stays false. The OpenBao policy and role were installed at 2026-11-02T09:02:50Z by the silent reader script. -No Scaleway credential is configured here, so IAM application -`mas-evidence-backup-primary` is not created. The KV pair and +The founder created IAM application `mas-evidence-backup-primary` in the +console. This workstation still has no Scaleway credential, so the +application id is not recorded here. The KV pair and `/etc/mas-backup/primary.env` do not exist. Pair-custody lists still name only coulomb-social and email-connect. Design: `docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md`.