retarget: T04 backup key is resource-control, not Barman

Handle becomes secret:railiance-platform/backup. IAM application is
resource-control; policy and API key are Scoped backup access.

data/resources/platform-audit-storage.json

@@ -29,7 +29,7 @@
     "reef:storage/substrate/object-stores/platform-audit-storage.yaml#provider_project_ref"
   ],
   "credential_handles": [
-    "secret:railiance-platform/platform-pg-backup-s3"
+    "secret:railiance-platform/backup"
   ],
   "consumers": {
     "potential": ["rapp-postgres"],

docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md

@@ -15,7 +15,7 @@ Object Storage policy attached, list/get succeeded. Private bucket
 owner-only. Live attributes are in
 `reef-storage/substrate/object-stores/platform-audit-storage.yaml`.
 Founder set a Scaleway billing alert (email). Scaleway has no euro
-hard-stop that refuses usage; that gap is accepted. Scoped Barman key
+hard-stop that refuses usage; that gap is accepted. Scoped backup key
 is T04.
 
 ## Recommendation
@@ -61,7 +61,7 @@ workload.
 - Cost alert: on the Scaleway project  
 - Owner in inventory: `resource-control`  
 - Attribute home: `reef-storage/substrate/object-stores/platform-audit-storage.yaml`  
-- Credential home (after T04): `secret:railiance-platform/platform-pg-backup-s3`  
+- Credential home (after T04): `secret:railiance-platform/backup`  
 - Consumer potential: `rapp-postgres`  
 - Consumer actual: none until WAL flows  
 

docs/operational-reference-convention.md

@@ -67,7 +67,7 @@ secret:<custody_repo>/<secret_id>
 Example already named by the backup split:
 
 ```text
-secret:railiance-platform/platform-pg-backup-s3
+secret:railiance-platform/backup
 ```
 
 The handle may also record `broker` (`openbao`) and `rotation` as non-secret
@@ -92,9 +92,9 @@ When a record needs more than a string:
 {
   "kind": "credential_handle",
   "custody_repo": "railiance-platform",
-  "secret_id": "platform-pg-backup-s3",
+  "secret_id": "backup",
   "broker": "openbao",
-  "ref": "secret:railiance-platform/platform-pg-backup-s3"
+  "ref": "secret:railiance-platform/backup"
 }
 ```
 

workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md

@@ -220,7 +220,7 @@ noncurrent lifecycle applied, ACL owner-only. Inventory is
 Operating facts live on
 `reef:storage/substrate/object-stores/platform-audit-storage.yaml`.
 Founder set a Scaleway billing alert (email). Scaleway has no
-euro hard-stop; that gap is accepted. Scoped Barman key remains T04.
+euro hard-stop; that gap is accepted. Scoped backup key remains T04.
 
 ## T04 — Establish credential custody and hand off to rapp-postgres
 
@@ -231,27 +231,33 @@ priority: high
 state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
 ```
 
-Route the scoped bucket credential to `railiance-platform` through the approved
+Route the scoped **backup** object-store credential to
-OpenBao/credential-broker lane. Permit only the bucket/prefix operations CNPG
+`railiance-platform` through the approved OpenBao/credential-broker
-requires. Keep credential values out of Git, State Hub, shell history, logs,
+lane. Principal is IAM application `resource-control`; API key and
-and chat.
+policy are `Scoped backup access`. Permit only the project-scoped
+object-store operations backup consumers need. Keep credential values
+out of Git, State Hub, shell history, logs, and chat.
 
-Hand the non-secret endpoint, bucket/prefix, region, CA/TLS requirements, and
+Hand the non-secret endpoint, bucket/prefix, region, CA/TLS
-retention parameters to `rapp-postgres`. Verify Barman's empty-WAL-archive check
+requirements, and retention parameters to `rapp-postgres` as the first
-before enabling continuous archiving.
+consumer. Verify the empty-WAL-archive check before enabling continuous
+archiving.
 
 Done when credential delivery is renewable/revocable, a negative credential
 cannot access the bucket, and `rapp-postgres` can perform the storage preflight
 without disclosing a value.
 
 Started 2026-08-14: bootstrap key cannot create IAM applications. Lane
-prepared — `CCR-2026-0012` (proposed), policy file, mason plan
+retargeted the same day to a general backup identity — `CCR-2026-0012`
-`platform-pg-backup-s3` (draft), founder put instructions, non-secret
+(proposed), mason plan `backup-object-storage` (draft), founder put
-destination handed at
+instructions, handle `secret:railiance-platform/backup`, first consumer
+projection Secret `platform-pg-backup-s3`. Non-secret destination
+handed at
 `rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`.
-Waiting on founder: approve the CCR, mint the project-scoped IAM
+Waiting on founder: approve the CCR, use IAM application
-application and key, put values in OpenBao, say “the Barman key is in
+`resource-control`, bind policy and key `Scoped backup access`, put
-bao.” Do not enable WAL yet.
+values in OpenBao, say “the backup key is in bao.” Do not enable WAL
+yet.
 
 ## T05 — Prove backup, full restore, and PITR
 

workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md

@@ -101,7 +101,7 @@ operational/credential refs or explicit gaps on every
 `data/resources/` record. The proposed backup resource is the proving
 case: consumers potential = `rapp-postgres`; actual = empty until WAL
 flows; attribute refs wait on `reef-storage`; credential handle =
-`secret:railiance-platform/platform-pg-backup-s3` once custody exists.
+`secret:railiance-platform/backup` once custody exists.
 
 Done when no live record relies on undifferentiated `workload_ids` as the
 only consumer list.