From 155446dc51617223aa766498cea891081d2f90c4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 14 Aug 2026 19:01:08 +0200 Subject: [PATCH] progress: start WP-0002 T04 Barman credential lane Bootstrap key cannot create IAM. CCR, mason plan, and founder put path are next; WAL stays disabled. --- ...ESOURCE-WP-0002-procure-postgres-backup-storage.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md index f9f03fd..1a27aa1 100644 --- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md +++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md @@ -226,7 +226,7 @@ euro hard-stop; that gap is accepted. Scoped Barman key remains T04. ```task id: RESOURCE-WP-0002-T04 -status: todo +status: progress priority: high state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a" ``` @@ -244,6 +244,15 @@ Done when credential delivery is renewable/revocable, a negative credential cannot access the bucket, and `rapp-postgres` can perform the storage preflight without disclosing a value. +Started 2026-08-14: bootstrap key cannot create IAM applications. Lane +prepared β€” `CCR-2026-0012` (proposed), policy file, mason plan +`platform-pg-backup-s3` (draft), founder put instructions, non-secret +destination handed at +`rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`. +Waiting on founder: approve the CCR, mint the project-scoped IAM +application and key, put values in OpenBao, say β€œthe Barman key is in +bao.” Do not enable WAL yet. + ## T05 β€” Prove backup, full restore, and PITR ```task