coulomb/qonto-assistant
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(consistency): write back QONTO-WP-0004 hub IDs

Browse source 
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-23 23:00:18 +02:00
parent dda9fdaf80
commit 21c98fc062
2 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
WORK-RECORDS.md
View file

@ -12,6 +12,7 @@
| workplan | QONTO-WP-0001 | finished | — | workplans/QONTO-WP-0001-statehub-bootstrap.md |
| workplan | QONTO-WP-0002 | finished | — | workplans/QONTO-WP-0002-policy-kernel-and-rest.md |
| workplan | QONTO-WP-0003 | finished | — | workplans/QONTO-WP-0003-mcp-surface.md |
| workplan | QONTO-WP-0004 | active | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
| task | ADHOC-2026-07-21-T01 | done | — | workplans/ADHOC-2026-07-21.md |
| task | ADHOC-2026-07-21-T02 | done | — | workplans/ADHOC-2026-07-21.md |
| task | QONTO-WP-0001-T01 | done | — | workplans/QONTO-WP-0001-statehub-bootstrap.md |
@ -31,3 +32,10 @@
| task | QONTO-WP-0003-T05 | done | — | workplans/QONTO-WP-0003-mcp-surface.md |
| task | QONTO-WP-0003-T06 | done | — | workplans/QONTO-WP-0003-mcp-surface.md |
| task | QONTO-WP-0003-T07 | done | — | workplans/QONTO-WP-0003-mcp-surface.md |
| task | QONTO-WP-0004-T01 | done | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
| task | QONTO-WP-0004-T02 | done | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
| task | QONTO-WP-0004-T03 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
| task | QONTO-WP-0004-T04 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
| task | QONTO-WP-0004-T05 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
| task | QONTO-WP-0004-T06 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
| task | QONTO-WP-0004-T07 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |

8
workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md
View file

@ -9,6 +9,7 @@ owner: claude
topic_slug: the-custodian
created: "2026-07-23"
updated: "2026-07-23"
state_hub_workstream_id: "81a476ac-06d5-4e98-a2ed-1518b16863aa"
---
# Security hardening and scale-to-zero facade for internet exposure
@ -31,6 +32,7 @@ dependencies are tracked explicitly per task rather than assumed away; the
id: QONTO-WP-0004-T01
status: done
priority: high
state_hub_task_id: "e93b2027-dd28-464b-8ea3-f7540f91caad"
```
**2026-07-23:** `specs/security-genome.yaml` written per
@ -52,6 +54,7 @@ schema; no code changes required for this task.
id: QONTO-WP-0004-T02
status: done
priority: high
state_hub_task_id: "3b10dd59-b03f-4d2b-8164-aa2a1c8c06c4"
```
**2026-07-23:** `src/qonto_assistant/security_watch.py::DenyEscalationTracker`
@ -79,6 +82,7 @@ proven not to affect ordinary policy-deny traffic.
id: QONTO-WP-0004-T03
status: todo
priority: high
state_hub_task_id: "f02b1cc0-4afc-44e5-b71d-545a13a3e12b"
```
Verify `key-cape`-issued IAM Profile tokens at the request boundary (facade
@ -102,6 +106,7 @@ already documents as the intended boundary.
id: QONTO-WP-0004-T04
status: todo
priority: high
state_hub_task_id: "fce7bf0e-674a-461f-8f2f-42d7dde3a722"
```
Register `finance.qonto.read` as a `flex-auth` resource. Call `flex-auth`
@ -127,6 +132,7 @@ allow and the newly-live-checked deny path.
id: QONTO-WP-0004-T05
status: todo
priority: high
state_hub_task_id: "e8a87292-488d-4871-be3e-59a5b6a38694"
```
Per `docs/SecurityPractice.md` §2/§6: a thin, always-on facade is the only
@ -157,6 +163,7 @@ cold-start; the backend scales back to 0 after the configured idle window.
id: QONTO-WP-0004-T06
status: todo
priority: medium
state_hub_task_id: "7cd52269-ca0a-4b09-ab51-f02ed71604f2"
```
Per `docs/SecurityPractice.md` §7: request I1 "Reinforced" (dedicated node
@ -179,6 +186,7 @@ now, revisit before going live") and referenced back into this workplan.
id: QONTO-WP-0004-T07
status: todo
priority: low
state_hub_task_id: "2a2da206-d182-4a72-aea4-56e58ae74c76"
```
Close when T03–T06 land or are explicitly deferred with a recorded reason.