BINKY-WP-0005: OH/T05 runbook and lane-scaffold notes for Qonto MCP

Prepare first-pull path after DEC-2026-004: copy-paste founder provision,
CCR apply, catalog promote, and CostRunRate update steps. T05 still waits
on Red-lane API key provision.

integrations/qonto-mcp.md

@@ -100,15 +100,73 @@ Rules:
 2. [x] OpenBao lane designed (`tenants/binky/qonto/api`)
 3. [x] DecisionQueue package prepared (DEC-2026-004)
 4. [x] DEC-2026-004 **approved** (founder, 2026-07-19)
-5. [ ] **Red lane — founder (next office hour, with OH-2026-003):** create
-       API key; `bao kv put` via `@file`
-6. [ ] Warden catalog `binky-qonto-api` draft → active after provision
-7. [ ] First read-only pull; update CostRunRate TBC rows (BINKY-WP-0005-T05)
-8. [ ] Wire Finance Steward recurring session (post-cutover, harness lane)
+5. [x] CCR-2026-0008 + policy HCL + agent-high-risk-boundary deny (railiance-platform)
+6. [x] ops-warden catalog `binky-qonto-api` **draft** + playbook
+       (`ops-warden/wiki/playbooks/binky-qonto-api.md`)
+7. [ ] **Red lane — founder (OH-2026-003):** create API key; `bao kv put` via `@file`
+       (see founder block below and `officehour/2026-08-command-day-runbook.md`)
+8. [ ] Apply CCR-2026-0008 metadata (policy + OIDC role) — platform-operator
+9. [ ] Capabilities-safe verify; promote catalog draft → active
+10. [ ] First read-only pull; update CostRunRate TBC rows (BINKY-WP-0005-T05)
+11. [ ] Wire Finance Steward recurring session (post-cutover, harness lane —
+        out of scope for BINKY-WP-0005 close; follow-on after T05)
+
+## OH-2026-003 / T05 runbook (copy-paste)
+
+### A. Founder Red lane (interactive human shell only)
+
+```bash
+# 1) Qonto dashboard (browser):
+#    - /settings/integrations → create API key
+#    - copy organization ID
+#    - note plan tier + monthly fee (CostRunRate row 4)
+#    - optional while there: recent HUB31 / desk-rent debit amount (row 1)
+
+# 2) OpenBao (private terminal — never paste key into chat/agent):
+bao login -method=oidc -path=netkingdom   # platform-admin or write-capable role
+umask 077
+# put key into /tmp/qonto.key and org id into /tmp/qonto.org (editor / paste)
+bao kv put tenants/binky/qonto/api \
+  QONTO_API_KEY=@/tmp/qonto.key \
+  QONTO_ORGANIZATION_ID=@/tmp/qonto.org
+shred -u /tmp/qonto.key /tmp/qonto.org
+```
+
+### B. Platform apply (after or before A — metadata only, no secret write)
+
+```bash
+cd ~/railiance-platform
+# after platform-operator approval recorded on CCR-2026-0008:
+python3 scripts/credential-change.py applier-dry-run CCR-2026-0008
+python3 scripts/credential-change.py applier-apply CCR-2026-0008
+# re-apply agent-high-risk-boundary if that policy is live-managed separately
+```
+
+### C. Promote + first pull (agent or human, Blue lane)
+
+```bash
+# capabilities-safe (never bao kv get for deny tests)
+LANE=$(bao token create -policy=workload-kv-read-binky-qonto-api -ttl=2m -field=token)
+bao token capabilities "$LANE" tenants/data/binky/qonto/api   # expect read
+bao token revoke "$LANE"
+
+# promote ops-warden catalog entry status: draft → active (see playbook)
+# then:
+warden access binky-qonto-api --all --exec -- \
+  qonto-mcp-server   # read tools only: org, accounts, transactions
+
+# Update finance/CostRunRate.md rows 1 + 4 with verified amounts;
+# log evidence metadata (dates, counterparties, amounts) — no bulk statements in git.
+```
+
+**Harness read-only allow-list (enforce at session wire-up):** organization,
+accounts, transactions, statements metadata, attachments metadata, labels.
+Never: cards, invoicing, payment requests, transfers.
 
 ## See also
 
 - `integrations/company-email-openbao.md` — custody pattern being mirrored
 - `AutopilotWorkQueue.md` AWQ-010 (origin), `OfficeHourQueue.md` OH-2026-003
+- `railiance-platform` CCR-2026-0008 · `ops-warden` catalog `binky-qonto-api`
 - Qonto docs: <https://docs.qonto.com/mcp/overview>,
   <https://github.com/qonto/qonto-mcp-server>