coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

catalog: promote binky-qonto-api to active (CCR-2026-0008)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Point at live tenants/binky/qonto-api fields API_KEY/API_USER; playbook and
CredentialRouting index updated after first BINKY-WP-0005 read-only pull.
This commit is contained in:
tegwick 2026-07-21 21:42:10 +02:00
parent 5d30220cc5
commit cb6e9a73f4
3 changed files with 40 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

17
registry/routing/catalog.yaml
View file

@ -430,14 +430,15 @@ entries:
wiki_ref: wiki/playbooks/binky-qonto-api.md#worker-checklist
canon_ref: binky-control/integrations/qonto-mcp.md
reviewed: "2026-07-21"
status: draft
status: active
risk: high
# CCR-2026-0008: policy + OIDC role pending apply; founder Red provision
# (DEC-2026-004 / OH-2026-003) unblocks BINKY-WP-0005-T05 first read-only pull.
# CCR-2026-0008: policy + OIDC role applied; secret at tenants/binky/qonto-api
# (fields API_KEY, API_USER). Map to QONTO_API_KEY / QONTO_ORGANIZATION_ID for
# qonto-mcp-server. First read-only pull 2026-07-21 (BINKY-WP-0005-T05).
# Read-only is harness tool allow-list — Qonto keys are not scope-limited server-side.
auth_method: "caller's own OpenBao token (OIDC netkingdom role binky-qonto-api-workload-kv-read)"
path_template: "tenants/binky/qonto/api"
fetch_command: "bao kv get -field=QONTO_API_KEY tenants/binky/qonto/api"
path_template: "tenants/binky/qonto-api"
fetch_command: "bao kv get -field=API_KEY tenants/binky/qonto-api"
exec_capable: true
lane: secret
rotation:
@ -446,9 +447,9 @@ entries:
automatable: false
steps:
- "In the Qonto dashboard, revoke the old API key and mint a new one under /settings/integrations (do not paste it into chat or Git)."
- "`bao kv put tenants/binky/qonto/api QONTO_API_KEY=@file` (and QONTO_ORGANIZATION_ID=@file if the org id changed); shred the mode-0600 input file(s)."
- "Re-run qonto-mcp-server read-only pull with warden access --exec; update binky-control finance/CostRunRate.md metadata only."
- "Verify capabilities-safe on tenants/data/binky/qonto/api; if EXPOSED taint was set, clear custom_metadata after rotation."
- "`bao kv put tenants/binky/qonto-api API_KEY=@file` (and API_USER=@file if the login/org slug changed); shred the mode-0600 input file(s)."
- "Re-run read-only pull with warden access --exec (map API_KEY→QONTO_API_KEY, API_USER→QONTO_ORGANIZATION_ID); update binky-control finance/CostRunRate.md metadata only."
- "Verify capabilities-safe on tenants/data/binky/qonto-api; if EXPOSED taint was set, clear custom_metadata after rotation."
- id: agent-harness-forgejo-deploy
title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)