Record the MAS evidence supplier key path.

The founder stored the API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics. The workload pair and delivery admission stay unchanged.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd

credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml

@@ -103,7 +103,7 @@
     "endpoint": "https://s3.nl-ams.scw.cloud",
     "bucket": "railiance-platform-pg-backup",
     "prefix": "platform-pg/application-archives/mas/",
-    "identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174; no key stored; bucket policy source allows only platform-pg/application-archives/mas/ and withholds object delete",
+    "identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174; founder stored the API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics; this workload path has no pair; bucket policy source allows only platform-pg/application-archives/mas/ and withholds object delete",
     "retained_delete": false
   },
   "risk": {
@@ -138,6 +138,17 @@
           "Attended platform-admin login ran scripts/install-mas-backup-primary-reader.sh. The local receipt status is installed and the stage file is empty.",
           "Readback bound backup-primary-delivery in namespace mas, one policy workload-kv-read-mas-backup-primary, role mas-backup-primary-workload-kv-read, ttl 300, token_max_ttl 300, token_explicit_max_ttl 300, token_num_uses 4, token_no_default_policy true, token_type service."
         ]
+      },
+      {
+        "at": "2026-11-02T10:31:45Z",
+        "actor": "grok",
+        "kind": "supplier_path_recorded",
+        "result": "passed",
+        "details": [
+          "Founder stored the API key at platform/suppliers/scaleway/mas-evidence-backup-primary and bound it to preferred project mail-address-semantics.",
+          "ops-mason custody row and ops-warden catalog id scaleway-mas-evidence-backup-primary record that path. The value was not read. The workload pair remains empty and delivery admission stays false.",
+          "Metadata read of that path with the local token returned HTTP 403, so the version was not confirmed from this workstation."
+        ]
       }
     ],
     "activation_conditions": [

docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md

@@ -6,7 +6,10 @@ ServiceAccount `backup-primary-delivery` in namespace `mas`, which exists with
 automount disabled. Delivery admission is still false. The OpenBao policy
 and role were installed at 2026-11-02T09:02:50Z. IAM application
 `mas-evidence-backup-primary` is `25a4cbca-220e-40c0-9af5-6c7713000174`.
-No key, value, node file, offsite upload, or timer exists yet.
+The founder stored its API key at
+`platform/suppliers/scaleway/mas-evidence-backup-primary`, bound to preferred
+project `mail-address-semantics`. The local token cannot read that metadata.
+No workload pair, node file, offsite upload, or timer exists yet.
 
 The accepted shape is the email-connect ledger reader, CCR-2026-0037. The MAS
 prefix is `platform-pg/application-archives/mas/` in bucket
@@ -17,13 +20,14 @@ local. It is not an offsite object.
 | Item | Prepared value | Live state |
 | --- | --- | --- |
 | Reader request | CCR-2026-0062 | applied; delivery admission false |
+| Supplier key | platform/suppliers/scaleway/mas-evidence-backup-primary | founder-stored; preferred project mail-address-semantics; metadata not read here |
 | KV path | platform/workloads/mas/backup-primary | no value written |
 | Fields | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY | absent |
 | Policy | workload-kv-read-mas-backup-primary | installed; receipt status installed |
 | Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas |
 | ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding |
 | Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created |
-| Provider identity | application mas-evidence-backup-primary `25a4cbca-220e-40c0-9af5-6c7713000174` | id recorded; no API key stored |
+| Provider identity | application mas-evidence-backup-primary `25a4cbca-220e-40c0-9af5-6c7713000174` | id recorded; key at the supplier path above, not at the workload path |
 
 Do not reuse the email-connect publisher or its node file. Object-storage IAM
 is not prefix-scoped inside a project, so a later admission needs its own IAM
@@ -39,8 +43,10 @@ and is not created here.
    2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission
    stays false.
 3. IAM application `mas-evidence-backup-primary` is
-   `25a4cbca-220e-40c0-9af5-6c7713000174`. Do not add a key to email-connect
-   or to a broad application.
+   `25a4cbca-220e-40c0-9af5-6c7713000174`. The founder stored its API key at
+   `platform/suppliers/scaleway/mas-evidence-backup-primary`, preferred
+   project `mail-address-semantics`. Do not add a key to email-connect or
+   to a broad application, and do not copy this value onto the workload path.
 4. The source bucket policy has three statements for that application,
    limited to `platform-pg/application-archives/mas/`, with no object delete.
    The live merge did not run: the local OpenBao token cannot read the

workplans/RPF-WP-0070-mas-evidence-recovery.md

@@ -40,7 +40,7 @@ status: progress
 priority: medium
 needs_human: true
 depends_on: [RPF-WP-0053-T05]
-intervention_note: "CCR-2026-0062 is applied. IAM application mas-evidence-backup-primary is 25a4cbca-220e-40c0-9af5-6c7713000174. The source bucket policy names that id under platform-pg/application-archives/mas/ with no object delete. No API key is stored. Delivery admission stays false. Age-identity escrow remains separate."
+intervention_note: "CCR-2026-0062 is applied. IAM application mas-evidence-backup-primary is 25a4cbca-220e-40c0-9af5-6c7713000174. The founder stored its API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics. The source bucket policy names that id under platform-pg/application-archives/mas/ with no object delete. The workload pair is still empty. Delivery admission stays false. Age-identity escrow remains separate."
 state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8"
 ```
 
@@ -69,7 +69,11 @@ role were installed at 2026-11-02T09:02:50Z by the silent reader script.
 IAM application `mas-evidence-backup-primary` is
 `25a4cbca-220e-40c0-9af5-6c7713000174`. The source bucket policy allows
 that id only under `platform-pg/application-archives/mas/` and does not
-grant object delete. No API key is stored. The KV pair and
-`/etc/mas-backup/primary.env` do not exist. Pair-custody lists still
+grant object delete. The founder stored the API key at
+`platform/suppliers/scaleway/mas-evidence-backup-primary`, preferred
+project `mail-address-semantics`. ops-mason records that custody row and
+ops-warden routes it as `scaleway-mas-evidence-backup-primary`. The
+workload KV pair and `/etc/mas-backup/primary.env` do not exist.
+Pair-custody lists still
 name only coulomb-social and email-connect.
 Design: `docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md`.