BINKY-WP-0005: Qonto MCP integration — workplan registered, design + DEC-2026-004

- AWQ-010 promoted to workplan BINKY-WP-0005 (hub 6139db83, tasks T01-T05
  registered via fix-consistency C-06); queue item moved to Completed
- integrations/qonto-mcp.md: self-hosted qonto/qonto-mcp-server chosen over
  hosted mcp.qonto.com OAuth connector (no-native-integrations policy);
  OpenBao lane tenants/binky/qonto/api mirroring company-email custody;
  read-only via harness tool allow-list, payments Red lane forever;
  consumers: Finance Steward rhythm, CostRunRate TBC rows, OH-2026-003
- DEC-2026-004 prepared (founder Red lane: API key + bao kv put), hub
  decision a2a9de69

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

DecisionQueue.md

@@ -44,6 +44,32 @@ fallback_if_no_response: "cron bridge keeps running; no degradation, but
   workstation-independence milestone stalls"
 ```
 
+### DEC-2026-004 — Qonto MCP: create API key, provision OpenBao lane (read-only use)
+
+```yaml
+id: DEC-2026-004
+title: "Provision Qonto API credentials for the self-hosted Qonto MCP server (read-only harness lane)"
+lane: red
+status: prepared
+state_hub_decision_id: "a2a9de69-5bc1-434a-9a61-508ff3c12edf"
+created_at: "2026-07-19"
+needed_by: "soft — pairs naturally with OH-2026-003 (next Qonto dashboard visit)"
+attention_cost: "~10 min: approve design, create API key in Qonto /settings/integrations, one bao kv put"
+agent_recommendation: "approve — self-hosted qonto/qonto-mcp-server via
+  ops-warden/OpenBao (tenants/binky/qonto/api), NOT the hosted mcp.qonto.com
+  OAuth connector (violates no-native-integrations policy). Qonto API keys
+  are full-scope, so read-only is enforced by harness tool allow-list;
+  payments stay founder-only forever. While in the dashboard: note plan tier
+  + monthly cost and API prerequisites (OH-2026-003). Main accounting stays
+  DUO — this complements, does not replace, the StB lane."
+evidence:
+  - integrations/qonto-mcp.md
+  - workplans/BINKY-WP-0005-qonto-mcp-integration.md
+options: [approve, reject, revise, defer]
+fallback_if_no_response: "no degradation — CostRunRate TBC rows stay manual;
+  cost-vs-usage answer for OH-2026-003 stays unquantified"
+```
+
 ## Resolved decisions
 
 ### DEC-2026-002 — Agent harness: one shared runtime repo