id: CCR-2026-0011
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Scaleway bootstrap API key for reef-storage / WP-0002 bucket create
status: in_flight
created: '2026-08-14'
updated: '2026-08-14'
in_flight:
  missing_fields:
  - openbao.policy_file
  - openbao.auth
  blocking_reason: Founder bootstrap API key and final operator authentication design
    are pending; do not invent metadata or fill placeholders.
  owner: platform-operator
requester:
  agent: grok
  reason: >-
    RESOURCE-WP-0002 T03 is human-approved to create a private Scaleway
    Multi-AZ bucket in nl-ams. This session has no Scaleway CLI profile.
    Founder will provision a bootstrap org/project API key into OpenBao;
    the agent reads it only to create the bucket and then writes the
    scoped bucket key to a separate path. Values must not appear in Git
    or chat.
review:
  required: true
  required_approvers:
  - platform-operator
  comments:
  - at: '2026-08-14T00:00:00+00:00'
    reviewer: bernd.worsch
    decision: approved
    comment: >-
      Approved in chat (Grok session): put Scaleway bootstrap key in
      OpenBao first, then create the bucket.
target:
  domain: financials
  tenant: railiance
  workload: scaleway-bootstrap
  environment: production
  purpose: Create reef-storage object-store members; not the Barman runtime key
openbao:
  mount: platform
  kv_path: platform/workloads/railiance/scaleway/bootstrap
  fields:
  - ACCESS_KEY
  - SECRET_KEY
  - DEFAULT_ORGANIZATION_ID
  - DEFAULT_PROJECT_ID
  policy_name: operator-kv-scaleway-bootstrap
access_frontdoor:
  type: operator-local
  catalog_id: scaleway-bootstrap
  selector: scaleway bootstrap api
  command: bao kv put platform/workloads/railiance/scaleway/bootstrap
  resolvable: false
  readiness: approved-pending-apply
delivery:
  surface: operator-workstation
  target: reef-storage/tools/create-platform-audit-bucket.sh (reads, never prints)
risk:
  classification: high
  notes:
  - Bootstrap key can create projects/buckets; rotate or delete after scoped key exists.
  - Scoped backup key is a different path: platform/workloads/railiance/backup/object-storage
  - Values must not appear in Git, State Hub, or chat.
verification:
  positive:
  - Field names present on the KV path; values not printed.
  negative:
  - default-policy token denied on the data path.
  activation_conditions:
  - Founder supplies the bootstrap credential through attended custody outside Git,
    chat, argv, and State Hub.
  - Platform operator records the exact policy artifact and authentication method
    before the request leaves in_flight status.
lifecycle:
  deactivate: Delete bootstrap key at Scaleway after the scoped bucket key works.
  rotate: Put a new bootstrap key; do not reuse the scoped backup key.
  compromised: Revoke both Scaleway keys; rotate bucket policy.