Seeded intent and initial workplan

workplans/QONTO-WP-0002-policy-kernel-and-rest.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Phase 1 — policy kernel and read-only REST"
 domain: infotech
 repo: qonto-assistant
-status: ready
+status: active
 owner: codex
 topic_slug: the-custodian
 created: "2026-07-21"
@@ -15,9 +15,12 @@ state_hub_workstream_id: "1540afc2-219e-4d95-96f5-4b45fc6a7aaa"
 # Phase 1 — policy kernel and read-only REST
 
 Execute **Phase 1** of `specs/ArchitectureBlueprint.md`: a service skeleton
-with a shared `decide(tool, args, claims) → Allow|Deny` policy kernel and a
-minimal REST surface for org/accounts/transactions/snapshot. No MCP yet (Phase 2).
-No spend or volume-cost tools — default deny.
+with a protocol-neutral capability core and shared
+`decide(request, claims) → Allow|Deny` policy kernel plus a minimal REST
+surface for org/accounts/transactions/snapshot. No MCP yet (Phase 2). No
+spend or volume-cost tools — default deny. Baseline guardrails ship in this
+phase: bounded pagination/timeouts, basic rate limiting, bounded concurrency,
+and redaction tests.
 
 **Depends on:** live OpenBao path `tenants/binky/qonto-api` (BINKY-WP-0005 /
 CCR-2026-0008) — already provisioned.
@@ -26,7 +29,7 @@ CCR-2026-0008) — already provisioned.
 
 ```task
 id: QONTO-WP-0002-T01
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "f9e129f3-5bd4-43e1-b7a0-281e4d3dec2a"
 ```
@@ -37,13 +40,14 @@ fleet standard dictates otherwise). Scaffold package layout, `pyproject.toml`
 commands in `AGENTS.md` / complete QONTO-WP-0001-T02.
 
 Done when: `make test` (or documented equivalent) runs an empty/smoke suite;
-layout matches blueprint components (policy, qonto client, api, audit).
+layout matches blueprint components (protocol adapters, capability core,
+policy, qonto client, api, audit).
 
 ## Task: Policy kernel — default-deny no-spend / no-volume-cost
 
 ```task
 id: QONTO-WP-0002-T02
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "552ff651-dc66-4e65-97fe-3ec26652bbdd"
 ```
@@ -52,8 +56,10 @@ Implement declarative policy (YAML or equivalent) + pure decision function:
 
 - default **deny**
 - allow only v1 read capability ids (`org_summary`, `list_transactions`,
-  `cost_run_rate_hints` / snapshot)
+  `cost_run_rate_hints`, `snapshot_bundle`)
 - hard deny classes: `spend`, `volume_cost`, `credential_exfil`
+- stable deny reasons for authz, tenant scope, argument constraint, and
+  credential exfil cases
 - unit tests: allow known reads; deny transfer/card/invoice-shaped tools and
   suspicious args even if somehow invoked
 
@@ -63,7 +69,7 @@ Done when: policy tests pass in CI/local; no network required.
 
 ```task
 id: QONTO-WP-0002-T03
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "be3aa7b6-f28c-4436-bd5d-d6940de6c2ce"
 ```
@@ -73,10 +79,12 @@ Implement thirdparty client using `Authorization: login:key` (fields
 
 - organization + bank accounts
 - paginated transactions with hard caps
+- bounded timeouts and conservative retry behavior
 - never log Authorization or key material
 
 Support env inject for tests (`QONTO_API_KEY`/`QONTO_ORGANIZATION_ID` or
-`API_KEY`/`API_USER`) and document OpenBao fetch for operators.
+`API_KEY`/`API_USER`) and document OpenBao fetch for operators. Production
+path fetches through a dedicated assistant runtime role only.
 
 Done when: unit tests with mocked HTTP; optional live smoke behind a flag.
 
@@ -84,7 +92,7 @@ Done when: unit tests with mocked HTTP; optional live smoke behind a flag.
 
 ```task
 id: QONTO-WP-0002-T04
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "678b0b26-15af-4037-849f-d24d320588ac"
 ```
@@ -96,23 +104,26 @@ Expose JSON endpoints that all run through the policy kernel:
 | GET | `/v1/health` | no bank call |
 | GET | `/v1/accounts` | org_summary |
 | GET | `/v1/transactions` | list_transactions (capped) |
-| GET | `/v1/snapshot` | cost/run-rate oriented summary |
+| GET | `/v1/snapshot` | snapshot_bundle (composed allowed reads) |
 
 Done when: OpenAPI or documented curl examples; integration test with mock
-client; deny paths return 403 with stable error code.
+client; deny paths return 403 with stable error code; route-to-capability
+mapping is explicit and shared with future MCP.
 
 ## Task: Audit metadata (no secrets)
 
 ```task
 id: QONTO-WP-0002-T05
-status: todo
+status: progress
 priority: medium
 state_hub_task_id: "4a42dff1-1281-4cc1-ba6a-24702bce7dc9"
 ```
 
 Log or emit structured audit events: actor (if present), capability, decision,
-deny_reason, latency, upstream HTTP status. Never secret fields. Prefer
-stdout JSON + optional State Hub progress for dogfood runs.
+deny_reason, latency, upstream HTTP status, and policy version. Never secret
+fields. Prefer structured stdout JSON (or equivalent sink) on the hot path;
+State Hub progress stays optional roll-up evidence for dogfood runs, not
+per-call audit storage.
 
 Done when: tests assert secrets absent from log lines for a sample allow/deny.
 
@@ -120,7 +131,7 @@ Done when: tests assert secrets absent from log lines for a sample allow/deny.
 
 ```task
 id: QONTO-WP-0002-T06
-status: todo
+status: progress
 priority: medium
 state_hub_task_id: "7b7ca0f7-f523-473e-b3f6-fe0564f54ed5"
 ```