feat: record live Scaleway backup bucket attributes

Bucket railiance-platform-pg-backup is private in nl-ams with versioning
and a 30-day lifecycle. Fill reef attributes and topology. Create script
is idempotent. Billing budget still needs a console click.

declarations/reef.yaml

@@ -5,7 +5,8 @@ ownership_repo: railiance-platform
 substrate_kind: object-storage
 lifecycle_state: planned
 criticality: high
-current_members: []
+current_members:
+  - railiance-platform-pg-backup
 source_documents:
   - repo: railiance-master
     path: docs/reef-substrate-model.md

substrate/identity.yaml

@@ -5,7 +5,8 @@ ownership_repo: railiance-platform
 lifecycle_state: planned
 criticality: high
 primary_rail: null
-current_members: []
+current_members:
+  - railiance-platform-pg-backup
 current_role: Provider-delegated S3-compatible store. Scaleway operates the capability; this reef names the boundary and non-secret attributes.
 source_of_truth:
   repo: reef-storage

substrate/object-stores/platform-audit-storage.yaml

@@ -1,17 +1,16 @@
-# Planned primary for RESOURCE-WP-0002. Fill endpoint/bucket/prefix after purchase.
-# No secrets in this file.
+# Live attributes for RESOURCE-WP-0002. No secrets in this file.
 schema_version: "0.1"
 resource_id: resource:platform:audit-storage
 provider: Scaleway
 product: standard-multi-az
-status: planned
-endpoint: null
+status: active
+endpoint: https://s3.nl-ams.scw.cloud
 region: nl-ams
-bucket: null
-prefix: null
-versioning: null
-lifecycle: null
-provider_project_ref: null
+bucket: railiance-platform-pg-backup
+prefix: platform-pg/
+versioning: true
+lifecycle: 30-day current and noncurrent expiration
+provider_project_ref: e1a0dd0e-04b8-4ea9-8b30-d53f8c35c688
 intended:
   public_access: disabled
   versioning: true
@@ -22,3 +21,5 @@ notes:
   - Destination for rapp-postgres WAL and base backups once procured.
   - resource-control cites reef:storage/substrate/object-stores/platform-audit-storage.yaml#<key>
   - "Decision record: resource-control/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md"
+  - Created 2026-08-14. Versioning enabled. ACL owner-only FULL_CONTROL.
+  - Cost alert not set via API. Bootstrap key lacks write billing_budgets. Founder must create a 20 EUR monthly budget in the Scaleway console.

substrate/topology.yaml

@@ -1,21 +1,22 @@
 reef_id: reef-storage
 membership_policy: Add a member when a purchased object-store (bucket/project) is live. Members are provider resources, not hosts.
-members: []
-intended_members:
+members:
   - member_id: platform-audit-storage
     role: primary-backup-object-store
     provider: Scaleway
     product: standard-multi-az
     region: nl-ams
+    bucket: railiance-platform-pg-backup
     resource_id: resource:platform:audit-storage
-    status: planned
+    status: live
     evidence:
       - repo: resource-control
         path: docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md
+      - path: substrate/object-stores/platform-audit-storage.yaml
+intended_members: []
 access_surfaces:
   - type: s3-https
-    note: Endpoint and bucket are filled after purchase in substrate/object-stores/platform-audit-storage.yaml. No rail.
+    note: Endpoint and bucket live in substrate/object-stores/platform-audit-storage.yaml. No rail.
 unresolved_questions:
-  - Scaleway project/organization id on the paying Railiance (or GmbH) account
-  - Exact bucket name and prefix after create
   - Whether Host Europe Backup Storage or Nextcloud is the T06 second copy
+  - Founder must create a 20 EUR monthly Scaleway budget. This API key cannot write billing_budgets.

tools/create-platform-audit-bucket.sh

@@ -63,8 +63,12 @@ PY
 
 export SCW_DEFAULT_REGION="$REGION"
 
-echo "creating private bucket $BUCKET in $REGION (versioning on)"
-scw object bucket create "$BUCKET" region="$REGION" acl=private enable-versioning=true -o json
+if scw object bucket get "$BUCKET" region="$REGION" -o json >/dev/null 2>&1; then
+  echo "bucket $BUCKET already exists in $REGION; skipping create"
+else
+  echo "creating private bucket $BUCKET in $REGION (versioning on)"
+  scw object bucket create "$BUCKET" region="$REGION" acl=private enable-versioning=true -o json
+fi
 
 echo "applying 30-day lifecycle (current + noncurrent versions)"
 VENV="${TMPDIR:-/tmp}/reef-storage-boto3"

workplans/REEF-STORAGE-WP-0002-fill-after-purchase.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Fill Scaleway attributes after purchase"
 domain: financials
 repo: reef-storage
-status: wait
+status: active
 owner: grok
 topic_slug: railiance
 created: "2026-08-14"
@@ -15,20 +15,22 @@ related:
 
 # REEF-STORAGE-WP-0002 — fill after purchase
 
-Wait for human approval of
-`resource-control/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md`
-and creation of the Scaleway project/bucket.
-
-Then follow `docs/post-purchase-seed.md`.
+Purchase happened 2026-08-14. Follow `docs/post-purchase-seed.md`.
 
 ## T01 — Write live non-secret attributes
 
 ```task
 id: REEF-STORAGE-WP-0002-T01
-status: wait
+status: done
 priority: high
 ```
 
 Fill `substrate/object-stores/platform-audit-storage.yaml` endpoint,
 bucket, prefix, project ref, versioning, lifecycle. Promote topology
 members. No secrets.
+
+Done 2026-08-14: bucket `railiance-platform-pg-backup` in `nl-ams` is
+live (versioning on, 30-day current and noncurrent expiration, owner-only
+ACL). Attributes, topology member, and declaration `current_members`
+written. Reef `lifecycle_state` stays `planned` until RESOURCE-WP-0002-T05.
+Cost alert is not set: bootstrap key lacks `write billing_budgets`.