docs: reef attribute refs and resource object workplan

Publish the operational reference convention (reef: and secret:
handles). Add a resource-control view of reef-railiance that excludes
S3. Open RESOURCE-WP-0006 for the five-facet inventory model.

workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md

@@ -69,6 +69,13 @@ This workplan owns requirements, comparison, procurement evidence, resource
 registration, cost/utilization monitoring, and proof that the purchased
 resource works.
 
+The purchased object is a five-facet resource (`RESOURCE-WP-0006`):
+description, decision, `reef:` attribute refs, `secret:` handles, and
+potential vs actual consumers. Non-secret operating attributes (endpoint,
+bucket, region) will be owned by `reef-storage` (`RMASTER-WP-0022`), not
+inlined here and not placed on `reef-railiance`. See
+`docs/operational-reference-convention.md`.
+
 - Human financial authority approves purchase and accepts contractual terms.
 - `railiance-platform` owns provider credential custody and the approved
   Kubernetes Secret/credential-broker delivery.

workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md

@@ -0,0 +1,124 @@
+---
+id: RESOURCE-WP-0006
+type: workplan
+title: "Resource object model and reef operational references"
+domain: financials
+repo: resource-control
+status: ready
+owner: grok
+topic_slug: railiance
+created: "2026-08-14"
+updated: "2026-08-14"
+related:
+  - RESOURCE-WP-0002
+  - RESOURCE-WP-0003
+  - RESOURCE-WP-0005
+  - RMASTER-WP-0022
+state_hub_workstream_id: "2108f67a-c1a9-4e53-b427-7011168b1fd2"
+---
+
+# RESOURCE-WP-0006 — resource object model and reef operational references
+
+## Goal
+
+Make the inventory record a **managed resource object** with five facets:
+
+1. description
+2. decision
+3. operational attribute **references** (`reef:…`)
+4. credential **handles** (`secret:…`)
+5. potential vs actual consumers
+
+`resource-control` stays the procurement, consumption, usage, and cost
+plane. It does not operate the resource. Operating facts live on a reef.
+The convention is `docs/operational-reference-convention.md`.
+
+`reef-railiance` is the compute substrate. S3-compatible backup storage is
+**not** added there. `reef-storage` (RMASTER-WP-0022) will operate Scaleway
+object storage and own the non-secret attributes this repo will cite.
+
+## Boundaries
+
+- Secret values stay in OpenBao. This repo stores handles only.
+- Reef attribute values stay in the reef repo. This repo stores references
+  only.
+- `RESOURCE-WP-0002` procures the backup bucket against this model; it does
+  not invent endpoints.
+- `RMASTER-WP-0022` materializes `reef-storage`. This workplan only defines
+  the join.
+
+## T01 — Adopt the five-facet inventory schema
+
+```task
+id: RESOURCE-WP-0006-T01
+status: todo
+priority: high
+state_hub_task_id: "55d3ebc2-51b7-49d1-8d0d-57ccc6379ae7"
+```
+
+Publish inventory schema v0.3 with first-class description, decision,
+`operational_refs`, `credential_handles`, and `consumers.potential` /
+`consumers.actual`. Keep v0.2 records valid until migrated, or migrate all
+live records in the same change. Decision is required before status
+`ordered`.
+
+Done when validators reject an `ordered` resource without a decision, reject
+an inline secret or endpoint that should be a `reef:` / `secret:` ref, and
+accept the proposed backup record with an explicit attribute-ref gap until
+`reef-storage` exists.
+
+## T02 — Reef views and the reef-railiance projection
+
+```task
+id: RESOURCE-WP-0006-T02
+status: progress
+priority: high
+state_hub_task_id: "f2b38140-3d73-45a2-a2ff-fea12733e7b0"
+```
+
+Keep `data/reefs/*.json` as the cost/consumption view of a reef. Validate
+`data/reefs/reef-railiance.json` against
+`schemas/reef-view.schema.json`. Do not copy IPs, kubeconfig, or endpoints.
+Add a `reef-storage` view only after that repo exists.
+
+Done when `make test` validates reef views, every `resource_id` in the
+reef-railiance view exists in inventory, and the view states that S3 backup
+is out of `reef-railiance`.
+
+Started 2026-08-14: convention published; first reef-railiance view committed.
+
+## T03 — Migrate live inventory to the five facets
+
+```task
+id: RESOURCE-WP-0006-T03
+status: todo
+priority: high
+state_hub_task_id: "da959cf1-cbd2-492c-95ff-b9ab78c16697"
+```
+
+Backfill description, decision-or-gap, consumer potential/actual, and
+operational/credential refs or explicit gaps on every
+`data/resources/` record. The proposed backup resource is the proving
+case: consumers potential = `rapp-postgres`; actual = empty until WAL
+flows; attribute refs wait on `reef-storage`; credential handle =
+`secret:railiance-platform/platform-pg-backup-s3` once custody exists.
+
+Done when no live record relies on undifferentiated `workload_ids` as the
+only consumer list.
+
+## T04 — Wire WP-0002 to the convention
+
+```task
+id: RESOURCE-WP-0006-T04
+status: todo
+priority: medium
+state_hub_task_id: "a34fa806-ee34-4d3b-a823-2797fe260bbc"
+```
+
+Update `RESOURCE-WP-0002` so T03+ produce a resource object, not a v0.2
+card with a dangling endpoint. The decision record, reef-storage attribute
+refs, and the OpenBao handle are the procurement outputs. `rapp-postgres`
+remains a consumer, not the procurer.
+
+Done when WP-0002 cites this convention and will not accept an inventory
+update that inlines Scaleway endpoint or keys.