WORK-RECORDS.md

@@ -13,14 +13,14 @@
 | workplan | RESOURCE-WP-0003 | finished | — | workplans/RESOURCE-WP-0003-managed-infrastructure-portfolio-control.md |
 | workplan | RESOURCE-WP-0004 | finished | — | workplans/RESOURCE-WP-0004-financial-entity-procurement-terms.md |
 | workplan | RESOURCE-WP-0005 | finished | — | workplans/RESOURCE-WP-0005-resource-procurement-facility.md |
-| workplan | RESOURCE-WP-0006 | active | — | workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md |
+| workplan | RESOURCE-WP-0006 | ready | — | workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md |
 | task | RESOURCE-WP-0001-T01 | done | — | workplans/RESOURCE-WP-0001-statehub-bootstrap.md |
 | task | RESOURCE-WP-0001-T02 | done | — | workplans/RESOURCE-WP-0001-statehub-bootstrap.md |
 | task | RESOURCE-WP-0001-T03 | done | — | workplans/RESOURCE-WP-0001-statehub-bootstrap.md |
 | task | RESOURCE-WP-0002-T01 | progress | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
 | task | RESOURCE-WP-0002-T02 | progress | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
 | task | RESOURCE-WP-0002-T03 | done | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
-| task | RESOURCE-WP-0002-T04 | progress | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
+| task | RESOURCE-WP-0002-T04 | todo | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
 | task | RESOURCE-WP-0002-T05 | wait | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
 | task | RESOURCE-WP-0002-T06 | todo | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
 | task | RESOURCE-WP-0002-T07 | todo | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |

data/resources/platform-audit-storage.json

@@ -29,7 +29,7 @@
     "reef:storage/substrate/object-stores/platform-audit-storage.yaml#provider_project_ref"
   ],
   "credential_handles": [
-    "secret:railiance-platform/backup"
+    "secret:railiance-platform/platform-pg-backup-s3"
   ],
   "consumers": {
     "potential": ["rapp-postgres"],

docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md

@@ -15,7 +15,7 @@ Object Storage policy attached, list/get succeeded. Private bucket
 owner-only. Live attributes are in
 `reef-storage/substrate/object-stores/platform-audit-storage.yaml`.
 Founder set a Scaleway billing alert (email). Scaleway has no euro
-hard-stop that refuses usage; that gap is accepted. Scoped backup key
+hard-stop that refuses usage; that gap is accepted. Scoped Barman key
 is T04.
 
 ## Recommendation
@@ -61,7 +61,7 @@ workload.
 - Cost alert: on the Scaleway project  
 - Owner in inventory: `resource-control`  
 - Attribute home: `reef-storage/substrate/object-stores/platform-audit-storage.yaml`  
-- Credential home (after T04): `secret:railiance-platform/backup`  
+- Credential home (after T04): `secret:railiance-platform/platform-pg-backup-s3`  
 - Consumer potential: `rapp-postgres`  
 - Consumer actual: none until WAL flows  
 

docs/operational-reference-convention.md

@@ -67,7 +67,7 @@ secret:<custody_repo>/<secret_id>
 Example already named by the backup split:
 
 ```text
-secret:railiance-platform/backup
+secret:railiance-platform/platform-pg-backup-s3
 ```
 
 The handle may also record `broker` (`openbao`) and `rotation` as non-secret
@@ -92,9 +92,9 @@ When a record needs more than a string:
 {
   "kind": "credential_handle",
   "custody_repo": "railiance-platform",
-  "secret_id": "backup",
+  "secret_id": "platform-pg-backup-s3",
   "broker": "openbao",
-  "ref": "secret:railiance-platform/backup"
+  "ref": "secret:railiance-platform/platform-pg-backup-s3"
 }
 ```
 

workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md

@@ -220,7 +220,7 @@ noncurrent lifecycle applied, ACL owner-only. Inventory is
 Operating facts live on
 `reef:storage/substrate/object-stores/platform-audit-storage.yaml`.
 Founder set a Scaleway billing alert (email). Scaleway has no
-euro hard-stop; that gap is accepted. Scoped backup key remains T04.
+euro hard-stop; that gap is accepted. Scoped Barman key remains T04.
 
 ## T04 — Establish credential custody and hand off to rapp-postgres
 
@@ -231,33 +231,27 @@ priority: high
 state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
 ```
 
-Route the scoped **backup** object-store credential to
+Route the scoped bucket credential to `railiance-platform` through the approved
-`railiance-platform` through the approved OpenBao/credential-broker
+OpenBao/credential-broker lane. Permit only the bucket/prefix operations CNPG
-lane. Principal is IAM application `resource-control`; API key and
+requires. Keep credential values out of Git, State Hub, shell history, logs,
-policy are `Scoped backup access`. Permit only the project-scoped
+and chat.
-object-store operations backup consumers need. Keep credential values
-out of Git, State Hub, shell history, logs, and chat.
 
-Hand the non-secret endpoint, bucket/prefix, region, CA/TLS
+Hand the non-secret endpoint, bucket/prefix, region, CA/TLS requirements, and
-requirements, and retention parameters to `rapp-postgres` as the first
+retention parameters to `rapp-postgres`. Verify Barman's empty-WAL-archive check
-consumer. Verify the empty-WAL-archive check before enabling continuous
+before enabling continuous archiving.
-archiving.
 
 Done when credential delivery is renewable/revocable, a negative credential
 cannot access the bucket, and `rapp-postgres` can perform the storage preflight
 without disclosing a value.
 
 Started 2026-08-14: bootstrap key cannot create IAM applications. Lane
-retargeted the same day to a general backup identity — `CCR-2026-0012`
+prepared — `CCR-2026-0012` (proposed), policy file, mason plan
-(proposed), mason plan `backup-object-storage` (draft), founder put
+`platform-pg-backup-s3` (draft), founder put instructions, non-secret
-instructions, handle `secret:railiance-platform/backup`, first consumer
+destination handed at
-projection Secret `platform-pg-backup-s3`. Non-secret destination
-handed at
 `rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`.
-Waiting on founder: approve the CCR, use IAM application
+Waiting on founder: approve the CCR, mint the project-scoped IAM
-`resource-control`, bind policy and key `Scoped backup access`, put
+application and key, put values in OpenBao, say “the Barman key is in
-values in OpenBao, say “the backup key is in bao.” Do not enable WAL
+bao.” Do not enable WAL yet.
-yet.
 
 ## T05 — Prove backup, full restore, and PITR
 

workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md

@@ -101,7 +101,7 @@ operational/credential refs or explicit gaps on every
 `data/resources/` record. The proposed backup resource is the proving
 case: consumers potential = `rapp-postgres`; actual = empty until WAL
 flows; attribute refs wait on `reef-storage`; credential handle =
-`secret:railiance-platform/backup` once custody exists.
+`secret:railiance-platform/platform-pg-backup-s3` once custody exists.
 
 Done when no live record relies on undifferentiated `workload_ids` as the
 only consumer list.