coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the MAS evidence supplier key path.
All checks were successful
CCR intake gate / gate (push) Successful in 1m11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
The founder stored the API key at platform/suppliers/scaleway/mas-evidence-backup-primary, preferred project mail-address-semantics. The workload pair and delivery admission stay unchanged.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
This commit is contained in:
codex 2026-11-02 11:33:10 +01:00
parent 363e63562b
commit 814469944c
3 changed files with 29 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md
View file

@ -6,7 +6,10 @@ ServiceAccount `backup-primary-delivery` in namespace `mas`, which exists with
automount disabled. Delivery admission is still false. The OpenBao policy
and role were installed at 2026-11-02T09:02:50Z. IAM application
`mas-evidence-backup-primary` is `25a4cbca-220e-40c0-9af5-6c7713000174`.
No key, value, node file, offsite upload, or timer exists yet.
The founder stored its API key at
`platform/suppliers/scaleway/mas-evidence-backup-primary`, bound to preferred
project `mail-address-semantics`. The local token cannot read that metadata.
No workload pair, node file, offsite upload, or timer exists yet.
The accepted shape is the email-connect ledger reader, CCR-2026-0037. The MAS
prefix is `platform-pg/application-archives/mas/` in bucket
@ -17,13 +20,14 @@ local. It is not an offsite object.
| Item | Prepared value | Live state |
| --- | --- | --- |
| Reader request | CCR-2026-0062 | applied; delivery admission false |
| Supplier key | platform/suppliers/scaleway/mas-evidence-backup-primary | founder-stored; preferred project mail-address-semantics; metadata not read here |
| KV path | platform/workloads/mas/backup-primary | no value written |
| Fields | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY | absent |
| Policy | workload-kv-read-mas-backup-primary | installed; receipt status installed |
| Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas |
| ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding |
| Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created |
| Provider identity | application mas-evidence-backup-primary `25a4cbca-220e-40c0-9af5-6c7713000174` | id recorded; no API key stored |
| Provider identity | application mas-evidence-backup-primary `25a4cbca-220e-40c0-9af5-6c7713000174` | id recorded; key at the supplier path above, not at the workload path |
Do not reuse the email-connect publisher or its node file. Object-storage IAM
is not prefix-scoped inside a project, so a later admission needs its own IAM
@ -39,8 +43,10 @@ and is not created here.
2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission
stays false.
3. IAM application `mas-evidence-backup-primary` is
`25a4cbca-220e-40c0-9af5-6c7713000174`. Do not add a key to email-connect
or to a broad application.
`25a4cbca-220e-40c0-9af5-6c7713000174`. The founder stored its API key at
`platform/suppliers/scaleway/mas-evidence-backup-primary`, preferred
project `mail-address-semantics`. Do not add a key to email-connect or
to a broad application, and do not copy this value onto the workload path.
4. The source bucket policy has three statements for that application,
limited to `platform-pg/application-archives/mas/`, with no object delete.
The live merge did not run: the local OpenBao token cannot read the