feat: order Scaleway backup bucket for WP-0002 T03

Policy now allows Object Storage. Inventory moves proposed -> ordered
with provider_resource_id and reef-storage attribute refs. Cost alert
remains a founder console action; scoped Barman key is T04.

data/resources/platform-audit-storage.json

@@ -23,7 +23,10 @@
     "reef:storage/substrate/object-stores/platform-audit-storage.yaml",
     "reef:storage/substrate/object-stores/platform-audit-storage.yaml#endpoint",
     "reef:storage/substrate/object-stores/platform-audit-storage.yaml#bucket",
-    "reef:storage/substrate/object-stores/platform-audit-storage.yaml#region"
+    "reef:storage/substrate/object-stores/platform-audit-storage.yaml#region",
+    "reef:storage/substrate/object-stores/platform-audit-storage.yaml#prefix",
+    "reef:storage/substrate/object-stores/platform-audit-storage.yaml#lifecycle",
+    "reef:storage/substrate/object-stores/platform-audit-storage.yaml#provider_project_ref"
   ],
   "credential_handles": [
     "secret:railiance-platform/platform-pg-backup-s3"
@@ -33,13 +36,13 @@
     "actual": []
   },
   "resource_class": "storage",
-  "status": "proposed",
+  "status": "ordered",
   "management_model": "provider_managed",
   "provider": {
     "name": "Scaleway",
-    "account_ref": null,
+    "account_ref": "reef:storage/substrate/object-stores/platform-audit-storage.yaml#provider_project_ref",
     "product_ref": "scaleway-standard-multi-az",
-    "provider_resource_id": null
+    "provider_resource_id": "railiance-platform-pg-backup"
   },
   "service": {
     "name": "platform audit storage",
@@ -77,7 +80,7 @@
   },
   "lifecycle": {
     "proposed_on": "2026-08-10",
-    "ordered_on": null,
+    "ordered_on": "2026-08-14",
     "commissioned_on": null,
     "renews_on": null,
     "cancel_by": null,
@@ -93,6 +96,7 @@
     {"kind": "provider", "ref": "https://www.scaleway.com/en/pricing/storage/", "observed_at": "2026-08-10", "authority": "Scaleway"},
     {"kind": "provider", "ref": "https://www.scaleway.com/en/object-storage/", "observed_at": "2026-08-10", "authority": "Scaleway"},
     {"kind": "decision", "ref": "docs/evidence/RESOURCE-WP-0002-provider-due-diligence-2026-08-10.md", "observed_at": "2026-08-10", "authority": "resource-control"},
-    {"kind": "decision", "ref": "docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md", "observed_at": "2026-08-14", "authority": "resource-control"}
+    {"kind": "decision", "ref": "docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md", "observed_at": "2026-08-14", "authority": "resource-control"},
+    {"kind": "provider", "ref": "reef:storage/substrate/object-stores/platform-audit-storage.yaml", "observed_at": "2026-08-14", "authority": "reef-storage"}
   ]
 }

docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md

@@ -1,17 +1,22 @@
 # RESOURCE-WP-0002 T03 — primary object-store selection
 
 Date: 2026-08-14  
-Status: **approved — waiting on Scaleway bootstrap key in OpenBao**  
+Status: **approved and purchased — cost alert still human**  
 Resource: `resource:platform:audit-storage`  
 Procuring / consuming entity: `entity:railiance` (self-use, no 20 % markup)  
 Operating reef: `reef-storage` (not `reef-railiance`)
 
 Human financial authority approved the purchase in session 2026-08-14
-(“lets do it”, then “key into OpenBao first”). This file is no longer a
+(“lets do it”, then “key into OpenBao first”). Bootstrap key is in OpenBao
-recommendation-only draft. The bucket is **not** created until the
+(`platform/workloads/railiance/scaleway/bootstrap`, KV v2). After the
-bootstrap API key is in OpenBao
+Object Storage policy attached, list/get succeeded. Private bucket
-(`platform/workloads/railiance/scaleway/bootstrap`). See
+`railiance-platform-pg-backup` exists in `nl-ams` (created
-`reef-storage/docs/put-scaleway-bootstrap.md`.
+2026-08-14T16:21:56Z), versioning on, 30-day lifecycle applied, ACL
+owner-only. Live attributes are in
+`reef-storage/substrate/object-stores/platform-audit-storage.yaml`.
+The bootstrap key cannot `write billing_budgets`; founder still sets a
+€20 monthly project budget in the Scaleway console. Scoped Barman key is
+T04.
 
 ## Recommendation
 

tests/test_portfolio.py

@@ -39,6 +39,7 @@ class PortfolioTest(unittest.TestCase):
             r for _, r in self.records() if r["id"] == "resource:platform:audit-storage"
         ))
         record["status"] = "ordered"
+        record["decision"]["status"] = "draft"
         with self.assertRaisesRegex(ValueError, "approved decision"):
             validate_record(record)
         record["decision"]["status"] = "approved"

workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md

@@ -190,7 +190,7 @@ Barman preflight, contract review, and human approval.
 
 ```task
 id: RESOURCE-WP-0002-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "e4184350-dab2-4a0b-bee5-1a641e8a2df3"
 ```
@@ -210,21 +210,24 @@ renewal/cancellation dates, capacity model, owner, and cost-attribution key.
 Progress 2026-08-14: decision record written —
 `docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md`.
 Primary: Scaleway Multi-AZ `nl-ams`. Secondary copy: Host Europe Backup
-Storage or Nextcloud (T06). Inventory stays `proposed` with five-facet
+Storage or Nextcloud (T06). **Purchase approved 2026-08-14.** After the
-refs to `reef-storage`. Reef seeded (identity, topology, consumers,
+Object Storage policy attached, `scw object bucket list/get` succeeded.
-planned attribute file). **Purchase approved 2026-08-14.** Bootstrap key is in OpenBao (v2,
+Private bucket `railiance-platform-pg-backup` exists in `nl-ams`
-not placeholders). Bucket create returned **Access Denied** on S3
+(created 2026-08-14T16:21:56Z), versioning on, 30-day current and
-while Instances list succeeded — the key is valid but Object Storage
+noncurrent lifecycle applied, ACL owner-only. Inventory is
-is not permitted or not enabled on the project. Founder: in the
+`data/resources/platform-audit-storage.json` (`status: ordered`,
-Scaleway console open Object Storage once for that project and attach
+`ordered_on: 2026-08-14`, `provider_resource_id` = bucket name).
-`ObjectStorageFullAccess` (or equivalent) to the API key, then say
+Operating facts live on
-go again.
+`reef:storage/substrate/object-stores/platform-audit-storage.yaml`.
+Residual: founder must create a €20 monthly Scaleway budget in the
+console — this bootstrap key cannot `write billing_budgets`. Scoped
+Barman key remains T04.
 
 ## T04 — Establish credential custody and hand off to rapp-postgres
 
 ```task
 id: RESOURCE-WP-0002-T04
-status: wait
+status: todo
 priority: high
 state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
 ```