coulomb/resource-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: order Scaleway backup bucket for WP-0002 T03

Browse source 
Policy now allows Object Storage. Inventory moves proposed -> ordered
with provider_resource_id and reef-storage attribute refs. Cost alert
remains a founder console action; scoped Barman key is T04.
This commit is contained in:
tegwick 2026-08-14 18:28:27 +02:00
parent 1a9daf93ef
commit a6ac303d98
4 changed files with 36 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

16
data/resources/platform-audit-storage.proposed.json → data/resources/platform-audit-storage.json
View file

@ -23,7 +23,10 @@
"reef:storage/substrate/object-stores/platform-audit-storage.yaml",
"reef:storage/substrate/object-stores/platform-audit-storage.yaml#endpoint",
"reef:storage/substrate/object-stores/platform-audit-storage.yaml#bucket",
"reef:storage/substrate/object-stores/platform-audit-storage.yaml#region"
"reef:storage/substrate/object-stores/platform-audit-storage.yaml#region",
"reef:storage/substrate/object-stores/platform-audit-storage.yaml#prefix",
"reef:storage/substrate/object-stores/platform-audit-storage.yaml#lifecycle",
"reef:storage/substrate/object-stores/platform-audit-storage.yaml#provider_project_ref"
],
"credential_handles": [
"secret:railiance-platform/platform-pg-backup-s3"
@ -33,13 +36,13 @@
"actual": []
},
"resource_class": "storage",
"status": "proposed",
"status": "ordered",
"management_model": "provider_managed",
"provider": {
"name": "Scaleway",
"account_ref": null,
"account_ref": "reef:storage/substrate/object-stores/platform-audit-storage.yaml#provider_project_ref",
"product_ref": "scaleway-standard-multi-az",
"provider_resource_id": null
"provider_resource_id": "railiance-platform-pg-backup"
},
"service": {
"name": "platform audit storage",
@ -77,7 +80,7 @@
},
"lifecycle": {
"proposed_on": "2026-08-10",
"ordered_on": null,
"ordered_on": "2026-08-14",
"commissioned_on": null,
"renews_on": null,
"cancel_by": null,
@ -93,6 +96,7 @@
{"kind": "provider", "ref": "https://www.scaleway.com/en/pricing/storage/", "observed_at": "2026-08-10", "authority": "Scaleway"},
{"kind": "provider", "ref": "https://www.scaleway.com/en/object-storage/", "observed_at": "2026-08-10", "authority": "Scaleway"},
{"kind": "decision", "ref": "docs/evidence/RESOURCE-WP-0002-provider-due-diligence-2026-08-10.md", "observed_at": "2026-08-10", "authority": "resource-control"},
{"kind": "decision", "ref": "docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md", "observed_at": "2026-08-14", "authority": "resource-control"}
{"kind": "decision", "ref": "docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md", "observed_at": "2026-08-14", "authority": "resource-control"},
{"kind": "provider", "ref": "reef:storage/substrate/object-stores/platform-audit-storage.yaml", "observed_at": "2026-08-14", "authority": "reef-storage"}
]
}

17
docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md
View file

@ -1,17 +1,22 @@
# RESOURCE-WP-0002 T03 — primary object-store selection
Date: 2026-08-14
Status: **approved — waiting on Scaleway bootstrap key in OpenBao**
Status: **approved and purchased — cost alert still human**
Resource: `resource:platform:audit-storage`
Procuring / consuming entity: `entity:railiance` (self-use, no 20 % markup)
Operating reef: `reef-storage` (not `reef-railiance`)
Human financial authority approved the purchase in session 2026-08-14
(“lets do it”, then “key into OpenBao first”). This file is no longer a
recommendation-only draft. The bucket is **not** created until the
bootstrap API key is in OpenBao
(`platform/workloads/railiance/scaleway/bootstrap`). See
`reef-storage/docs/put-scaleway-bootstrap.md`.
(“lets do it”, then “key into OpenBao first”). Bootstrap key is in OpenBao
(`platform/workloads/railiance/scaleway/bootstrap`, KV v2). After the
Object Storage policy attached, list/get succeeded. Private bucket
`railiance-platform-pg-backup` exists in `nl-ams` (created
2026-08-14T16:21:56Z), versioning on, 30-day lifecycle applied, ACL
owner-only. Live attributes are in
`reef-storage/substrate/object-stores/platform-audit-storage.yaml`.
The bootstrap key cannot `write billing_budgets`; founder still sets a
€20 monthly project budget in the Scaleway console. Scoped Barman key is
T04.
## Recommendation

1
tests/test_portfolio.py
View file

@ -39,6 +39,7 @@ class PortfolioTest(unittest.TestCase):
r for _, r in self.records() if r["id"] == "resource:platform:audit-storage"
))
record["status"] = "ordered"
record["decision"]["status"] = "draft"
with self.assertRaisesRegex(ValueError, "approved decision"):
validate_record(record)
record["decision"]["status"] = "approved"

25
workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
View file

@ -190,7 +190,7 @@ Barman preflight, contract review, and human approval.
```task
id: RESOURCE-WP-0002-T03
status: progress
status: done
priority: high
state_hub_task_id: "e4184350-dab2-4a0b-bee5-1a641e8a2df3"
```
@ -210,21 +210,24 @@ renewal/cancellation dates, capacity model, owner, and cost-attribution key.
Progress 2026-08-14: decision record written —
`docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md`.
Primary: Scaleway Multi-AZ `nl-ams`. Secondary copy: Host Europe Backup
Storage or Nextcloud (T06). Inventory stays `proposed` with five-facet
refs to `reef-storage`. Reef seeded (identity, topology, consumers,
planned attribute file). **Purchase approved 2026-08-14.** Bootstrap key is in OpenBao (v2,
not placeholders). Bucket create returned **Access Denied** on S3
while Instances list succeeded — the key is valid but Object Storage
is not permitted or not enabled on the project. Founder: in the
Scaleway console open Object Storage once for that project and attach
`ObjectStorageFullAccess` (or equivalent) to the API key, then say
go again.
Storage or Nextcloud (T06). **Purchase approved 2026-08-14.** After the
Object Storage policy attached, `scw object bucket list/get` succeeded.
Private bucket `railiance-platform-pg-backup` exists in `nl-ams`
(created 2026-08-14T16:21:56Z), versioning on, 30-day current and
noncurrent lifecycle applied, ACL owner-only. Inventory is
`data/resources/platform-audit-storage.json` (`status: ordered`,
`ordered_on: 2026-08-14`, `provider_resource_id` = bucket name).
Operating facts live on
`reef:storage/substrate/object-stores/platform-audit-storage.yaml`.
Residual: founder must create a €20 monthly Scaleway budget in the
console — this bootstrap key cannot `write billing_budgets`. Scoped
Barman key remains T04.
## T04 — Establish credential custody and hand off to rapp-postgres
```task
id: RESOURCE-WP-0002-T04
status: wait
status: todo
priority: high
state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
```