From a6ac303d98c98226d2287e0b1b878f65635713d6 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 14 Aug 2026 18:28:27 +0200 Subject: [PATCH] feat: order Scaleway backup bucket for WP-0002 T03 Policy now allows Object Storage. Inventory moves proposed -> ordered with provider_resource_id and reef-storage attribute refs. Cost alert remains a founder console action; scoped Barman key is T04. --- ...posed.json => platform-audit-storage.json} | 16 +++++++----- ...CE-WP-0002-primary-selection-2026-08-14.md | 17 ++++++++----- tests/test_portfolio.py | 1 + ...WP-0002-procure-postgres-backup-storage.md | 25 +++++++++++-------- 4 files changed, 36 insertions(+), 23 deletions(-) rename data/resources/{platform-audit-storage.proposed.json => platform-audit-storage.json} (85%) diff --git a/data/resources/platform-audit-storage.proposed.json b/data/resources/platform-audit-storage.json similarity index 85% rename from data/resources/platform-audit-storage.proposed.json rename to data/resources/platform-audit-storage.json index 464614c..2b3c8b6 100644 --- a/data/resources/platform-audit-storage.proposed.json +++ b/data/resources/platform-audit-storage.json @@ -23,7 +23,10 @@ "reef:storage/substrate/object-stores/platform-audit-storage.yaml", "reef:storage/substrate/object-stores/platform-audit-storage.yaml#endpoint", "reef:storage/substrate/object-stores/platform-audit-storage.yaml#bucket", - "reef:storage/substrate/object-stores/platform-audit-storage.yaml#region" + "reef:storage/substrate/object-stores/platform-audit-storage.yaml#region", + "reef:storage/substrate/object-stores/platform-audit-storage.yaml#prefix", + "reef:storage/substrate/object-stores/platform-audit-storage.yaml#lifecycle", + "reef:storage/substrate/object-stores/platform-audit-storage.yaml#provider_project_ref" ], "credential_handles": [ "secret:railiance-platform/platform-pg-backup-s3" @@ -33,13 +36,13 @@ "actual": [] }, "resource_class": "storage", - "status": "proposed", + "status": "ordered", "management_model": "provider_managed", "provider": { "name": "Scaleway", - "account_ref": null, + "account_ref": "reef:storage/substrate/object-stores/platform-audit-storage.yaml#provider_project_ref", "product_ref": "scaleway-standard-multi-az", - "provider_resource_id": null + "provider_resource_id": "railiance-platform-pg-backup" }, "service": { "name": "platform audit storage", @@ -77,7 +80,7 @@ }, "lifecycle": { "proposed_on": "2026-08-10", - "ordered_on": null, + "ordered_on": "2026-08-14", "commissioned_on": null, "renews_on": null, "cancel_by": null, @@ -93,6 +96,7 @@ {"kind": "provider", "ref": "https://www.scaleway.com/en/pricing/storage/", "observed_at": "2026-08-10", "authority": "Scaleway"}, {"kind": "provider", "ref": "https://www.scaleway.com/en/object-storage/", "observed_at": "2026-08-10", "authority": "Scaleway"}, {"kind": "decision", "ref": "docs/evidence/RESOURCE-WP-0002-provider-due-diligence-2026-08-10.md", "observed_at": "2026-08-10", "authority": "resource-control"}, - {"kind": "decision", "ref": "docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md", "observed_at": "2026-08-14", "authority": "resource-control"} + {"kind": "decision", "ref": "docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md", "observed_at": "2026-08-14", "authority": "resource-control"}, + {"kind": "provider", "ref": "reef:storage/substrate/object-stores/platform-audit-storage.yaml", "observed_at": "2026-08-14", "authority": "reef-storage"} ] } diff --git a/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md b/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md index 903d0f2..026da81 100644 --- a/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md +++ b/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md @@ -1,17 +1,22 @@ # RESOURCE-WP-0002 T03 — primary object-store selection Date: 2026-08-14 -Status: **approved — waiting on Scaleway bootstrap key in OpenBao** +Status: **approved and purchased — cost alert still human** Resource: `resource:platform:audit-storage` Procuring / consuming entity: `entity:railiance` (self-use, no 20 % markup) Operating reef: `reef-storage` (not `reef-railiance`) Human financial authority approved the purchase in session 2026-08-14 -(“lets do it”, then “key into OpenBao first”). This file is no longer a -recommendation-only draft. The bucket is **not** created until the -bootstrap API key is in OpenBao -(`platform/workloads/railiance/scaleway/bootstrap`). See -`reef-storage/docs/put-scaleway-bootstrap.md`. +(“lets do it”, then “key into OpenBao first”). Bootstrap key is in OpenBao +(`platform/workloads/railiance/scaleway/bootstrap`, KV v2). After the +Object Storage policy attached, list/get succeeded. Private bucket +`railiance-platform-pg-backup` exists in `nl-ams` (created +2026-08-14T16:21:56Z), versioning on, 30-day lifecycle applied, ACL +owner-only. Live attributes are in +`reef-storage/substrate/object-stores/platform-audit-storage.yaml`. +The bootstrap key cannot `write billing_budgets`; founder still sets a +€20 monthly project budget in the Scaleway console. Scoped Barman key is +T04. ## Recommendation diff --git a/tests/test_portfolio.py b/tests/test_portfolio.py index 756dd2f..a4c0ae4 100644 --- a/tests/test_portfolio.py +++ b/tests/test_portfolio.py @@ -39,6 +39,7 @@ class PortfolioTest(unittest.TestCase): r for _, r in self.records() if r["id"] == "resource:platform:audit-storage" )) record["status"] = "ordered" + record["decision"]["status"] = "draft" with self.assertRaisesRegex(ValueError, "approved decision"): validate_record(record) record["decision"]["status"] = "approved" diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md index 8899806..f46ed55 100644 --- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md +++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md @@ -190,7 +190,7 @@ Barman preflight, contract review, and human approval. ```task id: RESOURCE-WP-0002-T03 -status: progress +status: done priority: high state_hub_task_id: "e4184350-dab2-4a0b-bee5-1a641e8a2df3" ``` @@ -210,21 +210,24 @@ renewal/cancellation dates, capacity model, owner, and cost-attribution key. Progress 2026-08-14: decision record written — `docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md`. Primary: Scaleway Multi-AZ `nl-ams`. Secondary copy: Host Europe Backup -Storage or Nextcloud (T06). Inventory stays `proposed` with five-facet -refs to `reef-storage`. Reef seeded (identity, topology, consumers, -planned attribute file). **Purchase approved 2026-08-14.** Bootstrap key is in OpenBao (v2, -not placeholders). Bucket create returned **Access Denied** on S3 -while Instances list succeeded — the key is valid but Object Storage -is not permitted or not enabled on the project. Founder: in the -Scaleway console open Object Storage once for that project and attach -`ObjectStorageFullAccess` (or equivalent) to the API key, then say -go again. +Storage or Nextcloud (T06). **Purchase approved 2026-08-14.** After the +Object Storage policy attached, `scw object bucket list/get` succeeded. +Private bucket `railiance-platform-pg-backup` exists in `nl-ams` +(created 2026-08-14T16:21:56Z), versioning on, 30-day current and +noncurrent lifecycle applied, ACL owner-only. Inventory is +`data/resources/platform-audit-storage.json` (`status: ordered`, +`ordered_on: 2026-08-14`, `provider_resource_id` = bucket name). +Operating facts live on +`reef:storage/substrate/object-stores/platform-audit-storage.yaml`. +Residual: founder must create a €20 monthly Scaleway budget in the +console — this bootstrap key cannot `write billing_budgets`. Scoped +Barman key remains T04. ## T04 — Establish credential custody and hand off to rapp-postgres ```task id: RESOURCE-WP-0002-T04 -status: wait +status: todo priority: high state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a" ```