seed: planned Scaleway backup store for WP-0002

Identity, topology, consumer bindings, and the planned attribute file
(region nl-ams, endpoint/bucket still null). Post-purchase fill is
REEF-STORAGE-WP-0002.

bindings/consumers.yaml

@@ -0,0 +1,13 @@
+reef_id: reef-storage
+consumers_potential:
+  - consumer_id: rapp-postgres
+    resource_id: resource:platform:audit-storage
+    purpose: WAL archive and physical base backups for platform-pg
+    readiness_state: declared
+    evidence:
+      - repo: resource-control
+        path: workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
+consumers_actual: []
+notes:
+  - Actual consumer is recorded only after WAL flows (RESOURCE-WP-0002-T05).
+  - rapp-postgres consumes a reviewed destination; it does not procure the bucket.

docs/post-purchase-seed.md

@@ -0,0 +1,25 @@
+# Fill reef-storage after Scaleway purchase
+
+Run only after human financial authority approves
+`resource-control/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md`.
+
+1. Create a Scaleway project on the Railiance (or GmbH) paying account.
+2. Create a **private** bucket in `nl-ams`, Standard Multi-AZ.
+3. Enable versioning. Set lifecycle to the 30-day recovery window.
+4. Create a key that can only list/get/put/delete on that bucket/prefix.
+5. Turn on a project cost alert.
+6. Write the non-secret facts into
+   `substrate/object-stores/platform-audit-storage.yaml`:
+   `endpoint`, `bucket`, `prefix`, `provider_project_ref`, `versioning`,
+   `lifecycle`. Status → `active`.
+7. Append the bucket/project to `declarations/reef.yaml` `current_members`
+   and `substrate/topology.yaml` `members`. Reef `lifecycle_state` may stay
+   `planned` until the first restore (T05), or become `active` when the
+   bucket exists — prefer `active` only after T05.
+8. Hand `secret:railiance-platform/platform-pg-backup-s3` to OpenBao (T04).
+   Do not commit the key.
+9. Tell resource-control: set inventory `decision.status: approved`,
+   `status: ordered`, `ordered_on`, `provider.provider_resource_id`.
+
+Do not paste endpoint or keys into chat as the source of truth. The YAML
+file is the source for `reef:storage/…` references.

schemas/object-store-attributes.schema.json

@@ -9,6 +9,7 @@
     "schema_version": {"const": "0.1"},
     "resource_id": {"type": "string", "pattern": "^resource:"},
     "provider": {"type": "string", "minLength": 1},
+    "product": {"type": ["string", "null"]},
     "status": {"enum": ["planned", "active", "retired"]},
     "endpoint": {"type": ["string", "null"]},
     "region": {"type": ["string", "null"]},
@@ -17,6 +18,7 @@
     "versioning": {"type": ["boolean", "null"]},
     "lifecycle": {"type": ["string", "null"]},
     "provider_project_ref": {"type": ["string", "null"]},
+    "intended": {"type": ["object", "null"]},
     "notes": {"type": "array", "items": {"type": "string"}}
   }
 }

substrate/identity.yaml

@@ -0,0 +1,14 @@
+reef_id: reef-storage
+display_name: Railiance delegated object storage
+substrate_kind: object-storage
+ownership_repo: railiance-platform
+lifecycle_state: planned
+criticality: high
+primary_rail: null
+current_members: []
+current_role: Provider-delegated S3-compatible store. Scaleway operates the capability; this reef names the boundary and non-secret attributes.
+source_of_truth:
+  repo: reef-storage
+  paths:
+    - declarations/reef.yaml
+    - substrate/object-stores/platform-audit-storage.yaml

substrate/object-stores/platform-audit-storage.yaml

@@ -1,15 +1,24 @@
-# Planned. Fill after RESOURCE-WP-0002 purchase. No secrets.
+# Planned primary for RESOURCE-WP-0002. Fill endpoint/bucket/prefix after purchase.
+# No secrets in this file.
 schema_version: "0.1"
 resource_id: resource:platform:audit-storage
 provider: Scaleway
+product: standard-multi-az
 status: planned
 endpoint: null
-region: null
+region: nl-ams
 bucket: null
 prefix: null
 versioning: null
 lifecycle: null
 provider_project_ref: null
+intended:
+  public_access: disabled
+  versioning: true
+  lifecycle: 30-day recovery window matching data/demand/platform-audit-storage.json
+  encryption_at_rest: provider-managed
+  identity: bucket-and-prefix scoped key only
 notes:
   - Destination for rapp-postgres WAL and base backups once procured.
   - resource-control cites reef:storage/substrate/object-stores/platform-audit-storage.yaml#<key>
+  - "Decision record: resource-control/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md"

substrate/topology.yaml

@@ -0,0 +1,21 @@
+reef_id: reef-storage
+membership_policy: Add a member when a purchased object-store (bucket/project) is live. Members are provider resources, not hosts.
+members: []
+intended_members:
+  - member_id: platform-audit-storage
+    role: primary-backup-object-store
+    provider: Scaleway
+    product: standard-multi-az
+    region: nl-ams
+    resource_id: resource:platform:audit-storage
+    status: planned
+    evidence:
+      - repo: resource-control
+        path: docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md
+access_surfaces:
+  - type: s3-https
+    note: Endpoint and bucket are filled after purchase in substrate/object-stores/platform-audit-storage.yaml. No rail.
+unresolved_questions:
+  - Scaleway project/organization id on the paying Railiance (or GmbH) account
+  - Exact bucket name and prefix after create
+  - Whether Host Europe Backup Storage or Nextcloud is the T06 second copy

workplans/REEF-STORAGE-WP-0002-fill-after-purchase.md

@@ -0,0 +1,34 @@
+---
+id: REEF-STORAGE-WP-0002
+type: workplan
+title: "Fill Scaleway attributes after purchase"
+domain: financials
+repo: reef-storage
+status: wait
+owner: grok
+topic_slug: railiance
+created: "2026-08-14"
+updated: "2026-08-14"
+related:
+  - RESOURCE-WP-0002
+---
+
+# REEF-STORAGE-WP-0002 — fill after purchase
+
+Wait for human approval of
+`resource-control/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md`
+and creation of the Scaleway project/bucket.
+
+Then follow `docs/post-purchase-seed.md`.
+
+## T01 — Write live non-secret attributes
+
+```task
+id: REEF-STORAGE-WP-0002-T01
+status: wait
+priority: high
+```
+
+Fill `substrate/object-stores/platform-audit-storage.yaml` endpoint,
+bucket, prefix, project ref, versioning, lifecycle. Promote topology
+members. No secrets.