approve: CCR-2026-0012; verify scoped backup key in OpenBao

Founder put ACCESS_KEY/SECRET_KEY. S3 prefix CRUD works. IAM write
and ESO apply remain gated. WAL not enabled.

docs/evidence/CCR-2026-0012-backup-key-verify-2026-08-14.md

@@ -0,0 +1,46 @@
+# CCR-2026-0012 — scoped backup key verification
+
+Date: 2026-08-14  
+Status: **key live in OpenBao; cluster Secret not vended**  
+CCR: approved in chat 2026-08-14  
+Path: `platform/workloads/railiance/backup/object-storage` (KV v2 version 1)
+
+No secret values in this file.
+
+## What is in OpenBao
+
+| Field | Present |
+| --- | --- |
+| `ACCESS_KEY` | yes (len 20, `SCW…`) |
+| `SECRET_KEY` | yes |
+| `DEFAULT_ORGANIZATION_ID` | yes |
+| `DEFAULT_PROJECT_ID` | yes |
+| `APPLICATION_ID` | no (bucket policy deferred) |
+
+Distinct from the CCR-2026-0011 bootstrap key (`keys_differ=yes`).
+
+## Positive
+
+- `scw object bucket list` / `get railiance-platform-pg-backup` in `nl-ams` succeeded.
+- boto3 put/get/delete of a probe object under `platform-pg/` succeeded; probe deleted.
+- Sibling prefix write also succeeded: no bucket policy yet, so prefix isolation is not enforced.
+
+## Negative
+
+- Bogus secret against the same access key: `SignatureDoesNotMatch`.
+- `scw iam application list` / `user list` / `api-key get`: insufficient permissions.
+- `scw billing budget list`: not allowed.
+- `scw k8s cluster list`: insufficient permissions.
+
+`instance` / `vpc` / `rdb` / `registry` / `lb` list returned empty success. That is consistent with a project that has no those resources; it is not a proven compute-write deny. Do not create a paid resource to prove it.
+
+## Not done
+
+- OpenBao policy `workload-kv-read-backup-object-storage` — this token cannot `sys/policies/acl` write (403).
+- ClusterSecretStore / ExternalSecret — railiance01 has no `platform-pg-backup-s3` yet; applying the draft store would fail without ESO auth.
+- Bucket policy — needs `APPLICATION_ID`.
+- WAL / `barmanObjectStore` on `platform-pg` — T05.
+
+## Next
+
+ops-mason (or a token that can write policies and ESO auth) applies the OpenBao policy and the `databases`-scoped store. Then ExternalSecret can project the Secret. After that, empty-WAL-archive preflight; still no continuous archiving until T05.

docs/put-backup-object-storage.md

@@ -51,15 +51,18 @@ On this host, with a token that can write the `platform` mount:
 
 ```bash
 bao kv put platform/workloads/railiance/backup/object-storage \
-  ACCESS_KEY_ID='SCWxxxxxxxx' \
-  ACCESS_SECRET_KEY='xxxxxxxx' \
-  APPLICATION_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
+  ACCESS_KEY='SCWxxxxxxxx' \
+  SECRET_KEY='xxxxxxxx' \
+  DEFAULT_ORGANIZATION_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' \
+  DEFAULT_PROJECT_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
 ```
 
-Or replace the `xxx` placeholders in the OpenBao UI on that same path.
+Same four field names as the bootstrap path. External Secrets projects
+`ACCESS_KEY` / `SECRET_KEY` to Kubernetes `ACCESS_KEY_ID` /
+`ACCESS_SECRET_KEY`.
 
-`APPLICATION_ID` is the `resource-control` IAM application UUID (not a
-secret). It is needed later for the bucket policy.
+Optional later field: `APPLICATION_ID` (the `resource-control` IAM
+application UUID, not a secret) so we can attach a bucket policy.
 
 ## 4. Confirm without printing values