Route rapp-qonto workload identity

examples/rapp-qonto-posture-conformance.yaml

@@ -0,0 +1,20 @@
+environments:
+  prod:
+    backend: openbao-sealed-shamir
+    real_values: generated-fresh-no-reuse
+    unseal: shamir-3-of-5-break-glass
+
+workloads:
+  - id: rapp-qonto
+    env_posture: prod
+    maturity: M3
+
+secret_requests:
+  - secret: binky-qonto-api
+    to_workload: rapp-qonto
+    required_maturity: M3
+    dataclass: restricted
+  - secret: rapp-qonto-keycape-client
+    to_workload: rapp-qonto
+    required_maturity: M3
+    dataclass: confidential

registry/routing/catalog.yaml

@@ -451,6 +451,31 @@ entries:
         - "Re-run read-only pull with warden access --exec (map API_KEY→QONTO_API_KEY, API_USER→QONTO_ORGANIZATION_ID); update binky-control finance/CostRunRate.md metadata only."
         - "Verify capabilities-safe on tenants/data/binky/qonto-api; if EXPOSED taint was set, clear custom_metadata after rotation."
 
+  - id: rapp-qonto-keycape-client
+    title: rapp-qonto KeyCape workload client
+    need_keywords: [rapp-qonto, qonto, keycape, oidc, client-credentials, service-token, workload-identity, binky]
+    owner_repo: key-cape
+    subsystem: KeyCape + OpenBao
+    warden_executes: false
+    wiki_ref: wiki/CredentialRouting.md#credential-routing-catalog
+    canon_ref: key-cape/docs/qonto-runtime-identity-contract.md
+    reviewed: "2026-07-27"
+    status: active
+    risk: high
+    auth_method: "OpenBao platform workload lane; KeyCape client_secret_basic exchange"
+    path_template: "platform/workloads/rapp-qonto/keycape-client"
+    fetch_command: "bao kv get -field=client_secret platform/workloads/rapp-qonto/keycape-client"
+    exec_capable: true
+    lane: secret
+    rotation:
+      method: rotate
+      owner: key-cape
+      automatable: true
+      steps:
+        - "Generate a fresh newline-free secret through an approved execution transport; never print it."
+        - "Write the same value to OpenBao and sso/keycape-rapp-qonto-client, then restart KeyCape."
+        - "Verify positive qonto:read exchange plus wrong-secret and excessive-scope denial without printing tokens."
+
   - id: agent-harness-forgejo-deploy
     title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
     need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance, binky-control, deploy-key]