Complete Phase 1: policy kernel, REST service, and local smoke tooling

Implements QONTO-WP-0002 (policy-gated Qonto REST service with audit
logging, rate limiting, and credential handling) and the ADHOC-2026-07-21
follow-up (fixture-backed local smoke mode, repo classification metadata).
Marks QONTO-WP-0001/0002 and the ad-hoc workplan finished, and regenerates
WORK-RECORDS.md and the ADHOC workplan's state_hub_workstream_id via
fix-consistency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

workplans/ADHOC-2026-07-21.md

@@ -0,0 +1,51 @@
+---
+id: ADHOC-2026-07-21
+type: workplan
+title: "Post-Phase-1 cleanup and local smoke support"
+domain: infotech
+repo: qonto-assistant
+status: finished
+owner: codex
+topic_slug: the-custodian
+created: "2026-07-21"
+updated: "2026-07-21"
+state_hub_workstream_id: "65e254a7-4feb-4179-a4fe-4d5ede8ce963"
+---
+
+# Post-Phase-1 cleanup and local smoke support
+
+Low-risk follow-up after QONTO-WP-0002 completion:
+
+- add fixture-backed local Qonto source so the service can run without real bank credentials
+- add a real HTTP smoke script around the Phase 1 REST surface
+- add repo classification metadata so `fix-consistency` no longer warns about the missing file
+
+## Task: Fixture-backed local smoke mode
+
+```task
+id: ADHOC-2026-07-21-T01
+status: done
+priority: medium
+state_hub_task_id: "a6ee7d5c-8bfc-46ba-a951-32e8bbc41c96"
+```
+
+Add a local fixture-backed Qonto client path and a smoke script that starts the
+service against canned organization/transaction payloads, then verifies
+`/v1/health`, `/v1/accounts`, and `/v1/snapshot`.
+
+Done when: the service can be run locally without real Qonto credentials and a
+documented smoke path exists.
+
+## Task: Repo classification metadata
+
+```task
+id: ADHOC-2026-07-21-T02
+status: done
+priority: low
+state_hub_task_id: "6f1289bc-104e-4812-a50c-c8b5145df2b9"
+```
+
+Add `.repo-classification.yaml` for `qonto-assistant` so State Hub consistency
+checks no longer warn about the missing classification file.
+
+Done when: `fix-consistency` reports no classification-gap warning for this repo.

workplans/QONTO-WP-0001-statehub-bootstrap.md

@@ -36,7 +36,7 @@ refined; README points at specs/research; register generated AGENTS.md + brief.
 
 ```task
 id: QONTO-WP-0001-T02
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "360f399a-36f8-44e6-af8a-55fb0d5732a3"
 ```
@@ -45,7 +45,10 @@ Identify the repo's install, test, lint, build, and run commands. Add or refine
 those commands in the agent instructions so future coding sessions can verify
 changes confidently.
 
-**Blocked on** runtime stack choice in QONTO-WP-0002-T01. Revisit after that task.
+**Done 2026-07-21:** Runtime stack and commands are now documented. Local
+verification prefers `make install-dev`, `make test`, `make lint`, and
+`make run`; fallback verification for this workstation is documented in
+`AGENTS.md` and `docs/operator-runbook.md`.
 
 ## Seed First Real Workplan
 

workplans/QONTO-WP-0002-policy-kernel-and-rest.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Phase 1 — policy kernel and read-only REST"
 domain: infotech
 repo: qonto-assistant
-status: active
+status: finished
 owner: codex
 topic_slug: the-custodian
 created: "2026-07-21"
@@ -29,7 +29,7 @@ CCR-2026-0008) — already provisioned.
 
 ```task
 id: QONTO-WP-0002-T01
-status: progress
+status: done
 priority: high
 state_hub_task_id: "f9e129f3-5bd4-43e1-b7a0-281e4d3dec2a"
 ```
@@ -47,7 +47,7 @@ policy, qonto client, api, audit).
 
 ```task
 id: QONTO-WP-0002-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "552ff651-dc66-4e65-97fe-3ec26652bbdd"
 ```
@@ -69,7 +69,7 @@ Done when: policy tests pass in CI/local; no network required.
 
 ```task
 id: QONTO-WP-0002-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "be3aa7b6-f28c-4436-bd5d-d6940de6c2ce"
 ```
@@ -92,7 +92,7 @@ Done when: unit tests with mocked HTTP; optional live smoke behind a flag.
 
 ```task
 id: QONTO-WP-0002-T04
-status: progress
+status: done
 priority: high
 state_hub_task_id: "678b0b26-15af-4037-849f-d24d320588ac"
 ```
@@ -114,7 +114,7 @@ mapping is explicit and shared with future MCP.
 
 ```task
 id: QONTO-WP-0002-T05
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "4a42dff1-1281-4cc1-ba6a-24702bce7dc9"
 ```
@@ -131,7 +131,7 @@ Done when: tests assert secrets absent from log lines for a sample allow/deny.
 
 ```task
 id: QONTO-WP-0002-T06
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "7b7ca0f7-f523-473e-b3f6-fe0564f54ed5"
 ```
@@ -147,10 +147,14 @@ pasting keys into chat.
 
 ```task
 id: QONTO-WP-0002-T07
-status: todo
+status: done
 priority: low
 state_hub_task_id: "9b99ba05-99f2-4624-9044-89bf37055434"
 ```
 
-Mark workplan finished when T01–T06 done; note Phase 2 seed (MCP surface for
-all harnesses) in closure. Run `statehub fix-consistency`.
+**Done 2026-07-21:** Phase 1 landed in `src/qonto_assistant/` with a
+FastAPI-based REST service, policy YAML, Qonto client, audit layer, rate
+limits, concurrency bounds, and operator runbook. Verified with
+`PYTHONPATH=src ../state-hub/.venv/bin/python -m pytest` (`12 passed`) plus
+`python3 -m compileall src tests`. Phase 2 seed remains the MCP surface on the
+same capability core and policy engine. Run `statehub fix-consistency`.