Define Qonto runtime identity contract

docs/qonto-runtime-identity-contract.md

@@ -0,0 +1,59 @@
+# Qonto Runtime Identity Contract
+
+Date: 2026-07-26
+Status: Provisioning-ready; tenant canon decision and first issue remain open
+
+## Stable Names
+
+- runtime package/principal: `rapp-qonto`
+- service account: `rapp-qonto`
+- non-interactive caller client: `rapp-qonto-client`
+- OpenBao runtime role: `rapp-qonto`
+- existing bank credential reference: `tenants/binky/qonto-api`
+- tenant claim: `tenant:friendly:binky`, subject to the open NetKingdom canon
+  alignment already recorded in `KEY-WP-0004`
+
+Any identity or role named `qonto-assistant` is a migration bridge with an
+owner and expiry, not the steady-state contract.
+
+## Least-Privilege Contract
+
+The runtime client:
+
+- uses a non-interactive workload grant
+- receives only the Binky tenant claim and the minimum Qonto runtime scopes
+- receives no platform-root, other-tenant, or tenant-admin authority
+- uses short-lived tokens
+- is independently revocable
+
+The workload role may resolve only the Qonto runtime secret references required
+by the package. Positive access and unrelated-role denial must both be tested.
+
+## Automation And Custody
+
+Credential planning begins with `warden plan`.
+
+The 2026-07-26 plan result is:
+
+- Forgejo and deployment-key use can be autonomous through sanctioned
+  `warden access --exec`, `--out`, or `--wrap` transports.
+- First-time provisioning of a new OpenBao value remains one explicit founder
+  authority act through `warden desk`; agents must not replace it with a file
+  drop or captured stdout.
+- The existing Qonto bank credential lane is resolvable but high risk and must
+  never be streamed to an agent.
+
+After the first authority act, issuance tests, negative access, revocation,
+posture conformance, route discovery, and evidence reconciliation should be
+agent-executable and then scheduled where stable.
+
+## Required Non-Secret Evidence
+
+- client id, issuer, audiences, scopes, token TTL, and tenant claim
+- workload role and secret-reference path names
+- positive token exchange without token disclosure
+- wrong-tenant and excessive-scope denial
+- positive/negative OpenBao capability checks
+- revocation result
+- ops-warden route and conformance result
+- migration-bridge expiry, if used