# RESOURCE-WP-0002 T03 — primary object-store selection

Date: 2026-08-14  
Status: **approved and purchased — cost alert still human**  
Resource: `resource:platform:audit-storage`  
Procuring / consuming entity: `entity:railiance` (self-use, no 20 % markup)  
Operating reef: `reef-storage` (not `reef-railiance`)

Human financial authority approved the purchase in session 2026-08-14
(“lets do it”, then “key into OpenBao first”). Bootstrap key is in OpenBao
(`platform/workloads/railiance/scaleway/bootstrap`, KV v2). After the
Object Storage policy attached, list/get succeeded. Private bucket
`railiance-platform-pg-backup` exists in `nl-ams` (created
2026-08-14T16:21:56Z), versioning on, 30-day lifecycle applied, ACL
owner-only. Live attributes are in
`reef-storage/substrate/object-stores/platform-audit-storage.yaml`.
Founder set a Scaleway billing alert (email). Scaleway has no euro
hard-stop that refuses usage; that gap is accepted. Scoped backup key
is T04.

## Recommendation

| Role | Choice | Why |
| --- | --- | --- |
| **Primary** | Scaleway Object Storage, Standard Multi-AZ, region `nl-ams` (NL, EU) | Only A/B/C candidate that is orderable, S3/SigV4 documented, Multi-AZ, published durability, **managed encryption at rest**, and an independent failure domain from Host Europe `railiance01`. Lowest comparable 320 GB running cost among managed options that meet acceptance. |
| **Independent secondary copy** | Host Europe Backup Storage (SFTP/SCP) or the existing governed Nextcloud lane (T06) | Not S3; not a Barman primary. Keeps a second copy off Scaleway and off the same API credential. |

Do **not** put the primary bucket on `reef-railiance`. S3 is a
provider-delegated capability; `reef-storage` is the substrate.

## Ranking (A / B / C)

Evidence: demand/cost model 2026-08-10, expanded comparison 2026-08-10,
due diligence 2026-08-10. Labor €60/h. Tax excluded. Running totals at
the normalized 320 GB + 5 GB restore-drill point.

| Criterion | A Host Europe Cloud Storage | B Scaleway Multi-AZ `nl-ams` | C Hetzner Object Storage |
| --- | --- | --- | --- |
| Total cost (320 GB) | unknown (no current S3 quote) | **€65.14**/mo (€5.14 infra + €60 labor) | €96.49/mo (€6.49 min + €90 labor) |
| Compatibility (CNPG/Barman S3) | unknown / not orderable on evidence | documented S3 + SigV4; live preflight still required | documented S3; live preflight still required |
| Resilience | same provider as compute | **different provider**; Multi-AZ; 99.999999999% durability claim | different provider; no quantified storage SLA |
| Sovereignty | DE if it existed | NL / EU | DE / EU |
| Operational effort | unknown | 1 h/mo planned; no rail to run | 1.5 h/mo; SSE-C custody if we accept no default at-rest encryption |
| Exit cost | unknown | egress €0.01/GB after 75 GB free + 4 h labor | inside 1 TB included until quota exceeded |
| Blocking gap | current S3 **not confirmed orderable** | live Barman preflight; contract/tax on the paying account | **no default at-rest encryption** (SSE-C only) |

Self-managed Garage on 2–3 VMs is €240–€336/mo at 320 GB and fails closed
before month-12 base volume. It is not a primary candidate at this
workload.

## What we are buying (if approved)

- Product: Scaleway Standard Multi-AZ Object Storage  
- Region: `nl-ams`  
- Commitment: **none** (usage-based)  
- Payer: Railiance (`entity:railiance`); transfer price = delivered cost  
- Public access: disabled  
- Identity: narrowest key, bucket/prefix only  
- Versioning: on  
- Lifecycle: 30-day recovery window (match demand)  
- Cost alert: on the Scaleway project  
- Owner in inventory: `resource-control`  
- Attribute home: `reef-storage/substrate/object-stores/platform-audit-storage.yaml`  
- Credential home (after T04): `secret:railiance-platform/backup`  
- Consumer potential: `rapp-postgres`  
- Consumer actual: none until WAL flows  

## What human financial authority must approve

1. Create or reuse a Scaleway project paid as Railiance (or GmbH Hauptkonto
   until the Railiance account exists).  
2. Accept Scaleway’s contract/tax treatment for that account.  
3. Accept that Host Europe S3 stays out of the race until written
   orderability exists.  
4. Accept Hetzner only as a price comparator unless SSE-C custody is
   explicitly chosen later.  
5. Spend: expected **~€3–€10/mo infrastructure** at current size, plus
   ~1 h operator labor; not a committed term.

After **yes**: create private bucket, scoped key, versioning/lifecycle,
cost alert; fill `reef-storage` attributes (endpoint, bucket, prefix,
project ref); flip inventory `proposed → ordered`; then T04/T05.

After **no**: write the rejection on this record; do not invent another
primary without a new decision.

## Authority

Recommended by: resource-control (this file)  
Approved by: human financial authority (Bernd Worsch, chat 2026-08-14)  
Approved on: 2026-08-14