resource-control/workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
RESOURCE-WP-0006	workplan	Resource object model and reef operational references	financials	resource-control	finished	grok	railiance	2026-08-14	2026-08-15	RESOURCE-WP-0002 RESOURCE-WP-0003 RESOURCE-WP-0005 RMASTER-WP-0022	2108f67a-c1a9-4e53-b427-7011168b1fd2

RESOURCE-WP-0006 — resource object model and reef operational references

Goal

Make the inventory record a managed resource object with five facets:

1. description
2. decision
3. operational attribute references (reef:…)
4. credential handles (secret:…)
5. potential vs actual consumers

resource-control stays the procurement, consumption, usage, and cost plane. It does not operate the resource. Operating facts live on a reef. The convention is docs/operational-reference-convention.md.

reef-railiance is the compute substrate. S3-compatible backup storage is not added there. reef-storage (RMASTER-WP-0022) will operate Scaleway object storage and own the non-secret attributes this repo will cite.

Boundaries

• Secret values stay in OpenBao. This repo stores handles only.
• Reef attribute values stay in the reef repo. This repo stores references only.
• RESOURCE-WP-0002 procures the backup bucket against this model; it does not invent endpoints.
• RMASTER-WP-0022 materializes reef-storage. This workplan only defines the join.

T01 — Adopt the five-facet inventory schema

id: RESOURCE-WP-0006-T01
status: done
priority: high
state_hub_task_id: "55d3ebc2-51b7-49d1-8d0d-57ccc6379ae7"

Publish inventory schema v0.3 with first-class description, decision, operational_refs, credential_handles, and consumers.potential / consumers.actual. Keep v0.2 records valid until migrated, or migrate all live records in the same change. Decision is required before status ordered.

Done when validators reject an ordered resource without a decision, reject an inline secret or endpoint that should be a reef: / secret: ref, and accept the proposed backup record with an explicit attribute-ref gap until reef-storage exists.

Done 2026-08-15: schema accepts 0.2 and 0.3. v0.3 requires the five facets. portfolio.validate_record rejects inline s3:// / Scaleway endpoints and secret-looking strings. The live backup record is 0.3. Other inventory stays 0.2 until T03.

T02 — Reef views and the reef-railiance projection

id: RESOURCE-WP-0006-T02
status: done
priority: high
state_hub_task_id: "f2b38140-3d73-45a2-a2ff-fea12733e7b0"

Keep data/reefs/*.json as the cost/consumption view of a reef. Validate data/reefs/reef-railiance.json against schemas/reef-view.schema.json. Do not copy IPs, kubeconfig, or endpoints. Add a reef-storage view only after that repo exists.

Done when make test validates reef views, every resource_id in the reef-railiance view exists in inventory, and the view states that S3 backup is out of reef-railiance.

Started 2026-08-14: convention published; first reef-railiance view committed.

Done 2026-08-15: data/reefs/reef-railiance.json and reef-storage.json validate. Every cited resource_id exists in inventory. railiance view states S3 backup is out of that reef. reef-storage view exists now that the repo does.

T03 — Migrate live inventory to the five facets

id: RESOURCE-WP-0006-T03
status: done
priority: high
state_hub_task_id: "da959cf1-cbd2-492c-95ff-b9ab78c16697"

Backfill description, decision-or-gap, consumer potential/actual, and operational/credential refs or explicit gaps on every data/resources/ record. The proposed backup resource is the proving case: consumers potential = rapp-postgres; actual = empty until WAL flows; attribute refs wait on reef-storage; credential handle = secret:railiance-platform/backup once custody exists.

Done when no live record relies on undifferentiated workload_ids as the only consumer list.

Done 2026-08-15: all seven live inventory records are schema 0.3 with the five facets. Discovered hosts and workloads use decision.status: gap rather than a fake approval. Backup remains the only approved decision. Consumers are first-class on every record; workload_ids is no longer the only consumer list. Examples stay 0.2. Formal procurement write-ups for the six gap records are not this workplan.

T04 — Wire WP-0002 to the convention

id: RESOURCE-WP-0006-T04
status: done
priority: medium
state_hub_task_id: "a34fa806-ee34-4d3b-a823-2797fe260bbc"

Update RESOURCE-WP-0002 so T03+ produce a resource object, not a v0.2 card with a dangling endpoint. The decision record, reef-storage attribute refs, and the OpenBao handle are the procurement outputs. rapp-postgres remains a consumer, not the procurer.

Done when WP-0002 cites this convention and will not accept an inventory update that inlines Scaleway endpoint or keys.

Done 2026-08-15: WP-0002 goal cites the convention. The live inventory record is v0.3 with reef/secret refs; validators reject an inline Scaleway endpoint on that record.