catalog: promote binky-qonto-api to active (CCR-2026-0008)

Point at live tenants/binky/qonto-api fields API_KEY/API_USER; playbook and
CredentialRouting index updated after first BINKY-WP-0005 read-only pull.

registry/routing/catalog.yaml

@@ -430,14 +430,15 @@ entries:
     wiki_ref: wiki/playbooks/binky-qonto-api.md#worker-checklist
     canon_ref: binky-control/integrations/qonto-mcp.md
     reviewed: "2026-07-21"
-    status: draft
+    status: active
     risk: high
-    # CCR-2026-0008: policy + OIDC role pending apply; founder Red provision
-    # (DEC-2026-004 / OH-2026-003) unblocks BINKY-WP-0005-T05 first read-only pull.
+    # CCR-2026-0008: policy + OIDC role applied; secret at tenants/binky/qonto-api
+    # (fields API_KEY, API_USER). Map to QONTO_API_KEY / QONTO_ORGANIZATION_ID for
+    # qonto-mcp-server. First read-only pull 2026-07-21 (BINKY-WP-0005-T05).
     # Read-only is harness tool allow-list — Qonto keys are not scope-limited server-side.
     auth_method: "caller's own OpenBao token (OIDC netkingdom role binky-qonto-api-workload-kv-read)"
-    path_template: "tenants/binky/qonto/api"
-    fetch_command: "bao kv get -field=QONTO_API_KEY tenants/binky/qonto/api"
+    path_template: "tenants/binky/qonto-api"
+    fetch_command: "bao kv get -field=API_KEY tenants/binky/qonto-api"
     exec_capable: true
     lane: secret
     rotation:
@@ -446,9 +447,9 @@ entries:
       automatable: false
       steps:
         - "In the Qonto dashboard, revoke the old API key and mint a new one under /settings/integrations (do not paste it into chat or Git)."
-        - "`bao kv put tenants/binky/qonto/api QONTO_API_KEY=@file` (and QONTO_ORGANIZATION_ID=@file if the org id changed); shred the mode-0600 input file(s)."
-        - "Re-run qonto-mcp-server read-only pull with warden access --exec; update binky-control finance/CostRunRate.md metadata only."
-        - "Verify capabilities-safe on tenants/data/binky/qonto/api; if EXPOSED taint was set, clear custom_metadata after rotation."
+        - "`bao kv put tenants/binky/qonto-api API_KEY=@file` (and API_USER=@file if the login/org slug changed); shred the mode-0600 input file(s)."
+        - "Re-run read-only pull with warden access --exec (map API_KEY→QONTO_API_KEY, API_USER→QONTO_ORGANIZATION_ID); update binky-control finance/CostRunRate.md metadata only."
+        - "Verify capabilities-safe on tenants/data/binky/qonto-api; if EXPOSED taint was set, clear custom_metadata after rotation."
 
   - id: agent-harness-forgejo-deploy
     title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)

wiki/CredentialRouting.md

@@ -100,6 +100,7 @@ run the owner's tool as the caller and preserve owner custody.
 | `railiance-backup-offsite-lane` | "railiance-platform OpenBao KV for Nextcloud WebDAV + age recovery" | `warden access railiance-backup-offsite-lane --out FILE` (`risk: high`; agents: no raw stream) |
 | `forgejo-admin-api-token` | "railiance-platform OpenBao KV for Forgejo admin PAT" | `warden access forgejo-admin-api-token --out FILE` (`risk: high`) |
 | `binky-company-email-imap` | "tenant IMAP on `tenants/binky/company-email/imap` (IONOS)" | `warden access binky-company-email-imap --out FILE` (`risk: high`) |
+| `binky-qonto-api` | "tenant Qonto API on `tenants/binky/qonto-api` (API_KEY+API_USER)" | `warden access binky-qonto-api --out FILE` (`risk: high`) |
 
 Promotion criteria: `wiki/playbooks/catalog-lane-promotion.md`.  
 High-risk / agent boundary: `wiki/playbooks/agent-read-boundary.md`.  
@@ -112,7 +113,6 @@ EXPOSED taint: `wiki/playbooks/exposed-taint.md` · `warden taint <id>`.
 
 | Catalog `id` | Routing focus | Playbook |
 | --- | --- | --- |
-| `binky-qonto-api` | tenant Qonto API on `tenants/binky/qonto/api` (CCR-2026-0008) | `wiki/playbooks/binky-qonto-api.md` |
 | `object-storage-sts` | NK-WP-0007 STS vending path | `wiki/playbooks/object-storage-sts.md` |
 | `database-dynamic-credentials` | OpenBao database secrets engine | `wiki/playbooks/database-dynamic-credentials.md` |
 

wiki/playbooks/binky-qonto-api.md

@@ -1,13 +1,14 @@
 # Binky Qonto bank API
 
 Date: 2026-07-21  
-Catalog: `binky-qonto-api` (status `draft` until provision; `risk: high`)  
+Catalog: `binky-qonto-api` (status `active`, `resolvable: true`, `risk: high`)  
 Owner: `railiance-platform` (CCR-2026-0008) · consumer need: `binky-control`  
 Workplan: BINKY-WP-0005 · Decision: DEC-2026-004 (approved)
 
-API credentials for the company Qonto account so the self-hosted
-`qonto/qonto-mcp-server` can run **read-only** balance and transaction pulls for
-control-plane finance feeds (`finance/CostRunRate.md`, Finance Steward rhythm).
+API credentials for the company Qonto account so read-only balance and
+transaction pulls can feed control-plane finance (`finance/CostRunRate.md`,
+Finance Steward rhythm). Prefer self-hosted `qonto/qonto-mcp-server` or the
+Qonto thirdparty REST API with the same credentials.
 
 **Payments and transfers are Red lane forever** — never allow-list write/payment
 tools in the harness. Qonto API keys are not scope-limited server-side; read-only
@@ -20,20 +21,20 @@ is enforced at the harness tool allow-list.
 | Setting | Value |
 | --- | --- |
 | Dashboard | Qonto web app → `/settings/integrations` |
-| Auth shape | API key + organization ID |
+| Auth shape | login (`API_USER`) + secret (`API_KEY`) → `Authorization: login:key` |
+| MCP env map | `API_KEY`→`QONTO_API_KEY`, `API_USER`→`QONTO_ORGANIZATION_ID` |
 | MCP server | `qonto/qonto-mcp-server` (self-hosted; not the hosted OAuth connector) |
-| Env names only | `QONTO_API_KEY`, `QONTO_ORGANIZATION_ID` |
+| API host | `https://thirdparty.qonto.com` |
 
-Design (variant decision, read-only boundary, consumers):  
-`binky-control/integrations/qonto-mcp.md`
+Design: `binky-control/integrations/qonto-mcp.md`
 
 ## OpenBao pointers
 
 | Field | Value |
 | --- | --- |
 | Mount | `tenants` |
-| Path | `tenants/binky/qonto/api` |
-| Fields | `QONTO_API_KEY`, `QONTO_ORGANIZATION_ID` |
+| Path | `tenants/binky/qonto-api` |
+| Fields | `API_KEY`, `API_USER` |
 | Policy | `workload-kv-read-binky-qonto-api` |
 | OIDC role | `binky-qonto-api-workload-kv-read` (`groups=net-kingdom-admins`) |
 | Risk | `high` |
@@ -42,7 +43,7 @@ Design (variant decision, read-only boundary, consumers):
 
 ## Worker checklist
 
-1. Login as caller (after CCR-2026-0008 policy + role applied):
+1. Login as caller:
 
    ```bash
    bao login -method=oidc -path=netkingdom role=binky-qonto-api-workload-kv-read
@@ -51,26 +52,26 @@ Design (variant decision, read-only boundary, consumers):
 2. Fetch via sanctioned transport (never paste into chat):
 
    ```bash
+   # lengths / presence only when debugging
    warden access binky-qonto-api --all --no-policy --exec -- \
-     qonto-mcp-server
-   # or dual-field inject when wiring a harness session:
-   # warden access binky-qonto-api --all --no-policy --exec -- \
-   #   env | grep -E '^QONTO_' | sed 's/=.*/=<set>/'
+     sh -c 'export QONTO_API_KEY="$API_KEY" QONTO_ORGANIZATION_ID="$API_USER";
+            # then: qonto-mcp-server or curl thirdparty with Authorization login:key
+            :'
    ```
 
-   Until catalog is `active` and resolvable, use bao as caller with files:
+   Dual-field inject via bao (files mode 0600):
 
    ```bash
    umask 077
-   bao kv get -field=QONTO_API_KEY tenants/binky/qonto/api > /tmp/qonto.key
-   bao kv get -field=QONTO_ORGANIZATION_ID tenants/binky/qonto/api > /tmp/qonto.org
-   chmod 600 /tmp/qonto.key /tmp/qonto.org
+   bao kv get -field=API_KEY tenants/binky/qonto-api > /tmp/qonto.key
+   bao kv get -field=API_USER tenants/binky/qonto-api > /tmp/qonto.user
+   chmod 600 /tmp/qonto.key /tmp/qonto.user
    export QONTO_API_KEY="$(cat /tmp/qonto.key)"
-   export QONTO_ORGANIZATION_ID="$(cat /tmp/qonto.org)"
-   shred -u /tmp/qonto.key /tmp/qonto.org
+   export QONTO_ORGANIZATION_ID="$(cat /tmp/qonto.user)"
+   shred -u /tmp/qonto.key /tmp/qonto.user
    ```
 
-3. Run **read-only** MCP tools only (organization, accounts, transactions,
+3. Run **read-only** tools only (organization, accounts, transactions,
    statements metadata). Do **not** invoke card, invoicing, request, or transfer
    tools.
 
@@ -86,11 +87,11 @@ Agents (`WARDEN_AGENT_ID` set): raw value stream refused (exit 7). Use `--out` /
 
 ```bash
 LANE=$(bao token create -policy=workload-kv-read-binky-qonto-api -ttl=2m -field=token)
-bao token capabilities "$LANE" tenants/data/binky/qonto/api   # read
+bao token capabilities "$LANE" tenants/data/binky/qonto-api   # read
 bao token revoke "$LANE"
 
 DEFAULT=$(bao token create -policy=default -ttl=2m -field=token)  # deny of create is also pass
-bao token capabilities "$DEFAULT" tenants/data/binky/qonto/api  # deny
+bao token capabilities "$DEFAULT" tenants/data/binky/qonto-api  # deny
 bao token revoke "$DEFAULT"
 ```
 
@@ -101,22 +102,14 @@ Never use `bao kv get` for deny tests.
 ## Founder provision (Red lane)
 
 ```bash
-# In Qonto dashboard: /settings/integrations → create API key, note organization ID
-# values only in mode-0600 files, never argv/chat
+# In Qonto dashboard: /settings/integrations → create API key, note login/org slug
 umask 077
-# key into /tmp/qonto.key, org id into /tmp/qonto.org — private terminal only
-bao kv put tenants/binky/qonto/api \
-  QONTO_API_KEY=@/tmp/qonto.key \
-  QONTO_ORGANIZATION_ID=@/tmp/qonto.org
-shred -u /tmp/qonto.key /tmp/qonto.org
+bao kv put tenants/binky/qonto-api \
+  API_KEY=@/tmp/qonto.key \
+  API_USER=@/tmp/qonto.user
+shred -u /tmp/qonto.key /tmp/qonto.user
 ```
 
-Also note **plan tier + monthly fee** for `binky-control/finance/CostRunRate.md`
-row 4 (and desk-rent amount for row 1 from recent debits when first pull runs).
-
-Then re-verify capabilities, promote catalog to `active`, set CCR
-`access_frontdoor.resolvable: true` / `readiness: ready`.
-
 ## Rotation
 
 ```bash