coulomb/resource-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: coulomb:586e143abc873e3cd62954bee5e33d7f580923d9
Branches Tags
coulomb:main
...
compare: coulomb:155446dc51617223aa766498cea891081d2f90c4
Branches Tags
coulomb:main

4 commits
586e143abc ... 155446dc51

Author SHA1 Message Date
tegwick
155446dc51 progress: start WP-0002 T04 Barman credential lane 
Bootstrap key cannot create IAM. CCR, mason plan, and founder
put path are next; WAL stays disabled.
 2026-08-14 19:01:08 +02:00
tegwick
a78bfcd9d5 note: accept Scaleway email alert as spend backstop 
No euro hard-stop exists. Founder email billing alert is the
provider-native tripwire; T04 remains the scoped key.
 2026-08-14 18:53:56 +02:00
tegwick
89d921355c chore: unblock WP-0002 T04 now that the bucket exists 2026-08-14 18:29:53 +02:00
tegwick
8d5453fd6c chore: refresh WORK-RECORDS after WP-0002 T03 done 2026-08-14 18:29:40 +02:00
3 changed files with 17 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -19,8 +19,8 @@
| task | RESOURCE-WP-0001-T03 | done | — | workplans/RESOURCE-WP-0001-statehub-bootstrap.md |
| task | RESOURCE-WP-0002-T01 | progress | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
| task | RESOURCE-WP-0002-T02 | progress | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
| task | RESOURCE-WP-0002-T03 | wait | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
| task | RESOURCE-WP-0002-T04 | wait | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
| task | RESOURCE-WP-0002-T03 | done | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
| task | RESOURCE-WP-0002-T04 | todo | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
| task | RESOURCE-WP-0002-T05 | wait | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
| task | RESOURCE-WP-0002-T06 | todo | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
| task | RESOURCE-WP-0002-T07 | todo | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |

6
docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md
View file

@ -14,9 +14,9 @@ Object Storage policy attached, list/get succeeded. Private bucket
2026-08-14T16:21:56Z), versioning on, 30-day lifecycle applied, ACL
owner-only. Live attributes are in
`reef-storage/substrate/object-stores/platform-audit-storage.yaml`.
The bootstrap key cannot `write billing_budgets`; founder still sets a
€20 monthly project budget in the Scaleway console. Scoped Barman key is
T04.
Founder set a Scaleway billing alert (email). Scaleway has no euro
hard-stop that refuses usage; that gap is accepted. Scoped Barman key
is T04.
## Recommendation

16
workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
View file

@ -219,15 +219,14 @@ noncurrent lifecycle applied, ACL owner-only. Inventory is
`ordered_on: 2026-08-14`, `provider_resource_id` = bucket name).
Operating facts live on
`reef:storage/substrate/object-stores/platform-audit-storage.yaml`.
Residual: founder must create a €20 monthly Scaleway budget in the
console — this bootstrap key cannot `write billing_budgets`. Scoped
Barman key remains T04.
Founder set a Scaleway billing alert (email). Scaleway has no
euro hard-stop; that gap is accepted. Scoped Barman key remains T04.
## T04 — Establish credential custody and hand off to rapp-postgres
```task
id: RESOURCE-WP-0002-T04
status: wait
status: progress
priority: high
state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
```
@ -245,6 +244,15 @@ Done when credential delivery is renewable/revocable, a negative credential
cannot access the bucket, and `rapp-postgres` can perform the storage preflight
without disclosing a value.
Started 2026-08-14: bootstrap key cannot create IAM applications. Lane
prepared — `CCR-2026-0012` (proposed), policy file, mason plan
`platform-pg-backup-s3` (draft), founder put instructions, non-secret
destination handed at
`rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`.
Waiting on founder: approve the CCR, mint the project-scoped IAM
application and key, put values in OpenBao, say “the Barman key is in
bao.” Do not enable WAL yet.
## T05 — Prove backup, full restore, and PITR
```task