Bootstrap qonto-assistant: intent, blueprint, research, workplans

Author INTENT and SCOPE; persist ArchitectureBlueprint under specs/ and MCP
gateway research under research/. Register with State Hub (QONTO-WP- prefix);
seed QONTO-WP-0001 (bootstrap, finished) and QONTO-WP-0002 (Phase 1 REST
policy kernel, ready).

SCOPE.md

@@ -0,0 +1,55 @@
+# SCOPE
+
+> Refined after `statehub register` (2026-07-21). Normative intent in
+> `INTENT.md`; architecture in `specs/ArchitectureBlueprint.md`.
+
+## One-liner
+
+Policy-governed Qonto domain **REST + MCP** assistant: sole bank-key consumer
+and default-deny **no spend / no volume-cost** policy for multi-harness finance
+awareness.
+
+## Core idea
+
+All agents and harnesses talk to **this service** for Qonto. None of them hold
+the OpenBao bank secret. Policy is enforced here once, not reimplemented per
+client.
+
+## In scope
+
+- Dual surfaces: streamable-HTTP MCP and JSON REST with a **shared policy kernel**
+- Read capabilities: org/accounts/balances, transactions (bounded), CostRunRate
+  hints / snapshot helpers
+- OpenBao consumption for `tenants/<tenant>/qonto-api` (dogfood: binky)
+- Authn of callers (OIDC / workload identity) and optional flex-auth checks
+- Audit metadata (actor, tool, allow/deny) without secret leakage
+- Tests for default-deny and spend/volume-cost rejection
+- Docs for harness client config (no bank secrets)
+
+## Out of scope (v1 and hard)
+
+- Payments, transfers, SEPA, card operations, invoicing create, plan changes
+- Hosting or recommending the hosted Qonto OAuth MCP connector
+- DATEV / StB / DUO bookkeeping replacement
+- LLM provider routing (llm-connect)
+- Agent scheduling (activity-core) or session runtime (agent-harness)
+- Generic multi-MCP fleet gateway (may sit *in front* later; not this repo’s job)
+- Storing bank credentials outside OpenBao
+
+## Current state
+
+| Artifact | Status |
+| --- | --- |
+| INTENT / SCOPE / AGENTS | present |
+| Architecture blueprint | `specs/ArchitectureBlueprint.md` |
+| Research notes | `research/2026-07-21-…` |
+| Runtime implementation | not started (see workplans) |
+| Upstream custody | live in platform (`binky-qonto-api`, CCR-2026-0008) |
+
+## Getting oriented
+
+1. `INTENT.md` — why / boundaries  
+2. `specs/ArchitectureBlueprint.md` — how  
+3. `research/2026-07-21-mcp-gateway-and-governed-domain-assistant.md` — why this shape  
+4. `workplans/` — what to do next  
+5. `AGENTS.md` — State Hub protocol