catalog: draft binky-qonto-api lane + playbook (CCR-2026-0008)

Tenant Qonto bank API front door for binky-control read-only MCP; stays
draft until policy apply, founder provision, and capabilities-safe verify.

registry/routing/catalog.yaml

@@ -421,6 +421,35 @@ entries:
         - "Re-run email-connect read-only scan with warden access --exec / env inject; confirm metadata-only evidence under binky-control/mailmeta/."
         - "Verify capabilities-safe on tenants/data/binky/company-email/imap; if EXPOSED taint was set, clear custom_metadata after rotation."
 
+  - id: binky-qonto-api
+    title: Binky Qonto bank API credentials (read-only MCP)
+    need_keywords: [binky, qonto, bank, api, finance, cost-run-rate, mcp, organization]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + qonto-mcp-server
+    warden_executes: false
+    wiki_ref: wiki/playbooks/binky-qonto-api.md#worker-checklist
+    canon_ref: binky-control/integrations/qonto-mcp.md
+    reviewed: "2026-07-21"
+    status: draft
+    risk: high
+    # CCR-2026-0008: policy + OIDC role pending apply; founder Red provision
+    # (DEC-2026-004 / OH-2026-003) unblocks BINKY-WP-0005-T05 first read-only pull.
+    # Read-only is harness tool allow-list — Qonto keys are not scope-limited server-side.
+    auth_method: "caller's own OpenBao token (OIDC netkingdom role binky-qonto-api-workload-kv-read)"
+    path_template: "tenants/binky/qonto/api"
+    fetch_command: "bao kv get -field=QONTO_API_KEY tenants/binky/qonto/api"
+    exec_capable: true
+    lane: secret
+    rotation:
+      method: rotate
+      owner: binky-control
+      automatable: false
+      steps:
+        - "In the Qonto dashboard, revoke the old API key and mint a new one under /settings/integrations (do not paste it into chat or Git)."
+        - "`bao kv put tenants/binky/qonto/api QONTO_API_KEY=@file` (and QONTO_ORGANIZATION_ID=@file if the org id changed); shred the mode-0600 input file(s)."
+        - "Re-run qonto-mcp-server read-only pull with warden access --exec; update binky-control finance/CostRunRate.md metadata only."
+        - "Verify capabilities-safe on tenants/data/binky/qonto/api; if EXPOSED taint was set, clear custom_metadata after rotation."
+
   - id: agent-harness-forgejo-deploy
     title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
     need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance, binky-control, deploy-key]