BINKY-WP-0005: OH/T05 runbook and lane-scaffold notes for Qonto MCP

Prepare first-pull path after DEC-2026-004: copy-paste founder provision,
CCR apply, catalog promote, and CostRunRate update steps. T05 still waits
on Red-lane API key provision.

OfficeHourQueue.md

@@ -59,7 +59,12 @@ prepared_material: ["2026-07-18: Qonto announced MCP integration (mailing) —
   organization ID, then bao kv put per the founder-provision block in
   integrations/qonto-mcp.md. Also note plan tier + monthly fee for
   finance/CostRunRate.md row 4. Unblocks BINKY-WP-0005-T05 (first
-  read-only pull)."]
+  read-only pull).",
+  "2026-07-21: Lane scaffolding ready — CCR-2026-0008 (draft) + policy HCL
+  in railiance-platform; ops-warden catalog binky-qonto-api (draft) +
+  playbook; copy-paste OH/T05 runbook in integrations/qonto-mcp.md and
+  officehour/2026-08-command-day-runbook.md. Only Red-lane provision +
+  CCR apply remain before first pull."]
 deadline_pressure: none
 ```
 

integrations/qonto-mcp.md

@@ -100,15 +100,73 @@ Rules:
 2. [x] OpenBao lane designed (`tenants/binky/qonto/api`)
 3. [x] DecisionQueue package prepared (DEC-2026-004)
 4. [x] DEC-2026-004 **approved** (founder, 2026-07-19)
-5. [ ] **Red lane — founder (next office hour, with OH-2026-003):** create
-       API key; `bao kv put` via `@file`
-6. [ ] Warden catalog `binky-qonto-api` draft → active after provision
-7. [ ] First read-only pull; update CostRunRate TBC rows (BINKY-WP-0005-T05)
-8. [ ] Wire Finance Steward recurring session (post-cutover, harness lane)
+5. [x] CCR-2026-0008 + policy HCL + agent-high-risk-boundary deny (railiance-platform)
+6. [x] ops-warden catalog `binky-qonto-api` **draft** + playbook
+       (`ops-warden/wiki/playbooks/binky-qonto-api.md`)
+7. [ ] **Red lane — founder (OH-2026-003):** create API key; `bao kv put` via `@file`
+       (see founder block below and `officehour/2026-08-command-day-runbook.md`)
+8. [ ] Apply CCR-2026-0008 metadata (policy + OIDC role) — platform-operator
+9. [ ] Capabilities-safe verify; promote catalog draft → active
+10. [ ] First read-only pull; update CostRunRate TBC rows (BINKY-WP-0005-T05)
+11. [ ] Wire Finance Steward recurring session (post-cutover, harness lane —
+        out of scope for BINKY-WP-0005 close; follow-on after T05)
+
+## OH-2026-003 / T05 runbook (copy-paste)
+
+### A. Founder Red lane (interactive human shell only)
+
+```bash
+# 1) Qonto dashboard (browser):
+#    - /settings/integrations → create API key
+#    - copy organization ID
+#    - note plan tier + monthly fee (CostRunRate row 4)
+#    - optional while there: recent HUB31 / desk-rent debit amount (row 1)
+
+# 2) OpenBao (private terminal — never paste key into chat/agent):
+bao login -method=oidc -path=netkingdom   # platform-admin or write-capable role
+umask 077
+# put key into /tmp/qonto.key and org id into /tmp/qonto.org (editor / paste)
+bao kv put tenants/binky/qonto/api \
+  QONTO_API_KEY=@/tmp/qonto.key \
+  QONTO_ORGANIZATION_ID=@/tmp/qonto.org
+shred -u /tmp/qonto.key /tmp/qonto.org
+```
+
+### B. Platform apply (after or before A — metadata only, no secret write)
+
+```bash
+cd ~/railiance-platform
+# after platform-operator approval recorded on CCR-2026-0008:
+python3 scripts/credential-change.py applier-dry-run CCR-2026-0008
+python3 scripts/credential-change.py applier-apply CCR-2026-0008
+# re-apply agent-high-risk-boundary if that policy is live-managed separately
+```
+
+### C. Promote + first pull (agent or human, Blue lane)
+
+```bash
+# capabilities-safe (never bao kv get for deny tests)
+LANE=$(bao token create -policy=workload-kv-read-binky-qonto-api -ttl=2m -field=token)
+bao token capabilities "$LANE" tenants/data/binky/qonto/api   # expect read
+bao token revoke "$LANE"
+
+# promote ops-warden catalog entry status: draft → active (see playbook)
+# then:
+warden access binky-qonto-api --all --exec -- \
+  qonto-mcp-server   # read tools only: org, accounts, transactions
+
+# Update finance/CostRunRate.md rows 1 + 4 with verified amounts;
+# log evidence metadata (dates, counterparties, amounts) — no bulk statements in git.
+```
+
+**Harness read-only allow-list (enforce at session wire-up):** organization,
+accounts, transactions, statements metadata, attachments metadata, labels.
+Never: cards, invoicing, payment requests, transfers.
 
 ## See also
 
 - `integrations/company-email-openbao.md` — custody pattern being mirrored
 - `AutopilotWorkQueue.md` AWQ-010 (origin), `OfficeHourQueue.md` OH-2026-003
+- `railiance-platform` CCR-2026-0008 · `ops-warden` catalog `binky-qonto-api`
 - Qonto docs: <https://docs.qonto.com/mcp/overview>,
   <https://github.com/qonto/qonto-mcp-server>

officehour/2026-08-command-day-runbook.md

@@ -17,8 +17,23 @@
 2. **OH-2026-002 — DUO Belegablage**: log in, assess receipt backlog size,
    photograph/upload missing receipts, confirm access continuity through the
    mandate transition.
-3. **OH-2026-003 — Qonto**: verify access works, pull current plan + monthly
-   fee, note cheaper plan options (decision itself can wait — data only).
+3. **OH-2026-003 — Qonto** (DEC-2026-004 approved — **also Red-lane provision**):
+   - Verify dashboard access works.
+   - Note plan tier + monthly fee → `finance/CostRunRate.md` row 4.
+   - Note cheaper plan options (plan *change* itself can wait — data only).
+   - **Provision API key for MCP (unblocks BINKY-WP-0005-T05):**
+     1. `/settings/integrations` → create API key; note organization ID.
+     2. Private terminal only (never chat/agent):
+        ```bash
+        umask 077
+        # key → /tmp/qonto.key, org id → /tmp/qonto.org
+        bao kv put tenants/binky/qonto/api \
+          QONTO_API_KEY=@/tmp/qonto.key \
+          QONTO_ORGANIZATION_ID=@/tmp/qonto.org
+        shred -u /tmp/qonto.key /tmp/qonto.org
+        ```
+     3. Full procedure: `integrations/qonto-mcp.md` (OH/T05 runbook).
+     4. After provision: agent runs first read-only pull + CostRunRate update.
 4. **OH-2026-004 — Handelsregister**: pull current HR excerpt
    (handelsregister.de), verify registered address and GF details, download
    articles of association if retrievable; file everything in `2binky/`.

workplans/BINKY-WP-0005-qonto-mcp-integration.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: the-custodian
 created: "2026-07-19"
-updated: "2026-07-19"
+updated: "2026-07-21"
 state_hub_workstream_id: "6139db83-5d4b-4492-a77f-fc9550a0a4f9"
 ---
 
@@ -90,6 +90,12 @@ first read-only balance/transaction pull through the harness lane, update
 `finance/CostRunRate.md` TBC rows (desk rent, Qonto plan) with verified
 figures, and log evidence metadata. Blue lane.
 
+**2026-07-21 prep (agent):** CCR-2026-0008 + policy + agent-high-risk-boundary
+deny path (railiance-platform); ops-warden catalog `binky-qonto-api` draft +
+playbook; OH/T05 copy-paste runbook in `integrations/qonto-mcp.md`. Still
+**blocked on founder Red-lane** (OH-2026-003): API key + `bao kv put`, then
+CCR metadata apply + first pull.
+
 ```task
 id: BINKY-WP-0005-T05
 status: wait