BINKY-WP-0005 finished: first Qonto pull and CostRunRate v2

Live custody path tenants/binky/qonto-api (API_KEY/API_USER). First read-only
thirdparty pull (122 txs): desk 297.50 €/mo, Qonto plan 70.80 €/mo, main
balance 2185.94 €. Evidence under finance/; workplan status finished.

workplans/BINKY-WP-0005-qonto-mcp-integration.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Qonto MCP integration: bank account as agent-readable finance source"
 domain: infotech
 repo: binky-control
-status: active
+status: finished
 owner: codex
 topic_slug: the-custodian
 created: "2026-07-19"
@@ -13,16 +13,12 @@ state_hub_workstream_id: "6139db83-5d4b-4492-a77f-fc9550a0a4f9"
 ---
 
 Connect the company Qonto account to the agent infrastructure via the
-**self-hosted** `qonto/qonto-mcp-server` (API key + organization ID), read
+**self-hosted** `qonto/qonto-mcp-server` (API key + organization login), read
 scopes first — **payments/transfers are Red lane forever**. Originates from
-AWQ-010 (founder direction 2026-07-18: "integrations like this should help
-with the automated company approach a lot" — arrange soon). Credential lane
-via ops-warden/OpenBao (`tenants/binky/qonto`), same custody pattern as
-company-email (`integrations/company-email-openbao.md`); **no claude.ai
-native integrations** — harness/MCP lane only. Main accounting stays DATEV
-Unternehmen Online (DUO): Qonto MCP complements, does not replace, the
-DUO/StB lane. The working MCP is a substantive argument FOR keeping Qonto
-despite plan cost (OH-2026-003).
+AWQ-010 (founder direction 2026-07-18). Credential lane via ops-warden/OpenBao
+(`tenants/binky/qonto-api`, fields `API_KEY` + `API_USER`); **no claude.ai
+native integrations** — harness/MCP / thirdparty API lane only. Main accounting
+stays DATEV Unternehmen Online (DUO).
 
 ## Task: Qonto MCP capabilities and docs review
 
@@ -42,10 +38,9 @@ state_hub_task_id: "e066a222-1608-45ce-96a7-cbf191a39a9b"
 
 ## Task: Credential lane design — ops-warden/OpenBao custody
 
-Design the OpenBao lane `tenants/binky/qonto` (fields `QONTO_API_KEY`,
-`QONTO_ORGANIZATION_ID`), warden catalog entry, and the founder Red-lane
-provision procedure — mirroring the company-email-imap pattern. Metadata and
-design only; no secret values, provisioning is founder Red lane. Green lane.
+Design the OpenBao lane for Qonto API credentials, warden catalog entry, and
+the founder Red-lane provision procedure — mirroring company-email-imap.
+Metadata and design only; no secret values. Green lane.
 
 ```task
 id: BINKY-WP-0005-T02
@@ -73,8 +68,7 @@ state_hub_task_id: "6c4a475d-9db7-4488-8563-10c82fa78f51"
 
 Prepare the founder approval package: DEC entry covering API key creation in
 the Qonto dashboard, OpenBao provision, and the read-only boundary. Note the
-DUO complement (not replacement) and the OH-2026-003 tie-in (check API/plan
-prerequisites while in the dashboard). Green lane.
+DUO complement (not replacement) and the OH-2026-003 tie-in. Green lane.
 
 ```task
 id: BINKY-WP-0005-T04
@@ -90,15 +84,26 @@ first read-only balance/transaction pull through the harness lane, update
 `finance/CostRunRate.md` TBC rows (desk rent, Qonto plan) with verified
 figures, and log evidence metadata. Blue lane.
 
-**2026-07-21 prep (agent):** CCR-2026-0008 + policy + agent-high-risk-boundary
-deny path (railiance-platform); ops-warden catalog `binky-qonto-api` draft +
-playbook; OH/T05 copy-paste runbook in `integrations/qonto-mcp.md`. Still
-**blocked on founder Red-lane** (OH-2026-003): API key + `bao kv put`, then
-CCR metadata apply + first pull.
+**2026-07-21 done:** Secret at `tenants/binky/qonto-api` (`API_KEY`+`API_USER`).
+CCR-2026-0008 active (policy + OIDC role + agent-high-risk-boundary). Catalog
+`binky-qonto-api` active. First pull via thirdparty API v2 (122 txs): main
+balance 2 185,94 €; HUB31 desk **297,50 €/mo**; Qonto plan **70,80 €/mo**.
+Evidence: `finance/qonto-first-pull-2026-07-21.json`. CostRunRate v2.
 
 ```task
 id: BINKY-WP-0005-T05
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "e4b2119b-6f89-44d8-879d-73bf225307f7"
 ```
+
+## Closure review
+
+- **Scope complete:** design (T01–T03), DEC-2026-004 (T04), live lane + first
+  pull + CostRunRate (T05).
+- **Live path note:** custody is `tenants/binky/qonto-api` with fields
+  `API_KEY` / `API_USER` (not the earlier design draft `…/qonto/api` +
+  `QONTO_*` field names). Consumers map to MCP env names at use time.
+- **Out of scope / follow-on:** recurring Finance Steward harness session
+  wiring; Qonto *plan change* (OH-2026-003 data now available, decision Red);
+  DATEV/StB replacement still separate.