docs: reef attribute refs and resource object workplan

Publish the operational reference convention (reef: and secret:
handles). Add a resource-control view of reef-railiance that excludes
S3. Open RESOURCE-WP-0006 for the five-facet inventory model.

tests/test_portfolio.py

@@ -77,5 +77,21 @@ class PortfolioTest(unittest.TestCase):
         )
 
 
+class ReefViewTest(unittest.TestCase):
+    def test_reef_railiance_view_cites_only_inventory_and_excludes_s3(self):
+        view = json.loads((ROOT / "data/reefs/reef-railiance.json").read_text())
+        inventory = {
+            json.loads(path.read_text())["id"]
+            for path in (ROOT / "data/resources").glob("*.json")
+        }
+        self.assertEqual("reef-railiance", view["reef_id"])
+        self.assertTrue(view["declaration_ref"].startswith("reef:"))
+        self.assertEqual("compute_substrate", view["role"])
+        for row in view["resources"]:
+            self.assertIn(row["resource_id"], inventory)
+        self.assertNotIn("resource:platform:audit-storage", {row["resource_id"] for row in view["resources"]})
+        self.assertTrue(any("reef-storage" in note for note in view["notes"]))
+
+
 if __name__ == "__main__":
     unittest.main()