Bootstrap qonto-assistant: intent, blueprint, research, workplans
Author INTENT and SCOPE; persist ArchitectureBlueprint under specs/ and MCP gateway research under research/. Register with State Hub (QONTO-WP- prefix); seed QONTO-WP-0001 (bootstrap, finished) and QONTO-WP-0002 (Phase 1 REST policy kernel, ready).
This commit is contained in:
parent
bae0734564
commit
e1ab23f83e
10 changed files with 1330 additions and 1 deletions
67
workplans/QONTO-WP-0001-statehub-bootstrap.md
Normal file
67
workplans/QONTO-WP-0001-statehub-bootstrap.md
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
---
|
||||
id: QONTO-WP-0001
|
||||
type: workplan
|
||||
title: "Bootstrap State Hub integration"
|
||||
domain: infotech
|
||||
repo: qonto-assistant
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: the-custodian
|
||||
created: "2026-07-21"
|
||||
updated: "2026-07-21"
|
||||
state_hub_workstream_id: "b2faddb4-2fdc-4e2a-b2df-9b6dd38faa86"
|
||||
---
|
||||
|
||||
# Bootstrap State Hub integration
|
||||
|
||||
Register and prime `qonto-assistant` for fleet agents: identity files, first
|
||||
workplans, hub consistency.
|
||||
|
||||
## Review Generated Integration Files
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0001-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "aab19eda-00ff-4e43-91c6-7272bd0422e5"
|
||||
```
|
||||
|
||||
Review `INTENT.md`, `SCOPE.md`, `AGENTS.md`, and `.custodian-brief.md`.
|
||||
Replace generated placeholders with repo-specific facts where needed.
|
||||
|
||||
**Done 2026-07-21:** INTENT authored from governed-assistant design; SCOPE
|
||||
refined; README points at specs/research; register generated AGENTS.md + brief.
|
||||
|
||||
## Verify Local Developer Workflow
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0001-T02
|
||||
status: wait
|
||||
priority: medium
|
||||
state_hub_task_id: "360f399a-36f8-44e6-af8a-55fb0d5732a3"
|
||||
```
|
||||
|
||||
Identify the repo's install, test, lint, build, and run commands. Add or refine
|
||||
those commands in the agent instructions so future coding sessions can verify
|
||||
changes confidently.
|
||||
|
||||
**Blocked on** runtime stack choice in QONTO-WP-0002-T01. Revisit after that task.
|
||||
|
||||
## Seed First Real Workplan
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0001-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "ee9a8125-ff00-4640-80bd-81567722bba6"
|
||||
```
|
||||
|
||||
Create the first implementation workplan for the repository's most important
|
||||
next change. After workplan file updates, run:
|
||||
|
||||
```bash
|
||||
statehub fix-consistency
|
||||
```
|
||||
|
||||
**Done 2026-07-21:** `workplans/QONTO-WP-0002-policy-kernel-and-rest.md` (Phase 1
|
||||
from ArchitectureBlueprint).
|
||||
145
workplans/QONTO-WP-0002-policy-kernel-and-rest.md
Normal file
145
workplans/QONTO-WP-0002-policy-kernel-and-rest.md
Normal file
|
|
@ -0,0 +1,145 @@
|
|||
---
|
||||
id: QONTO-WP-0002
|
||||
type: workplan
|
||||
title: "Phase 1 — policy kernel and read-only REST"
|
||||
domain: infotech
|
||||
repo: qonto-assistant
|
||||
status: ready
|
||||
owner: codex
|
||||
topic_slug: the-custodian
|
||||
created: "2026-07-21"
|
||||
updated: "2026-07-21"
|
||||
state_hub_workstream_id: "1540afc2-219e-4d95-96f5-4b45fc6a7aaa"
|
||||
---
|
||||
|
||||
# Phase 1 — policy kernel and read-only REST
|
||||
|
||||
Execute **Phase 1** of `specs/ArchitectureBlueprint.md`: a service skeleton
|
||||
with a shared `decide(tool, args, claims) → Allow|Deny` policy kernel and a
|
||||
minimal REST surface for org/accounts/transactions/snapshot. No MCP yet (Phase 2).
|
||||
No spend or volume-cost tools — default deny.
|
||||
|
||||
**Depends on:** live OpenBao path `tenants/binky/qonto-api` (BINKY-WP-0005 /
|
||||
CCR-2026-0008) — already provisioned.
|
||||
|
||||
## Task: Choose runtime skeleton and layout
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0002-T01
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "f9e129f3-5bd4-43e1-b7a0-281e4d3dec2a"
|
||||
```
|
||||
|
||||
Pick implementation stack (recommendation: Python 3.12 + FastAPI unless a
|
||||
fleet standard dictates otherwise). Scaffold package layout, `pyproject.toml`
|
||||
(or equivalent), Makefile targets (`test`, `lint`, `run`), and document
|
||||
commands in `AGENTS.md` / complete QONTO-WP-0001-T02.
|
||||
|
||||
Done when: `make test` (or documented equivalent) runs an empty/smoke suite;
|
||||
layout matches blueprint components (policy, qonto client, api, audit).
|
||||
|
||||
## Task: Policy kernel — default-deny no-spend / no-volume-cost
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0002-T02
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "552ff651-dc66-4e65-97fe-3ec26652bbdd"
|
||||
```
|
||||
|
||||
Implement declarative policy (YAML or equivalent) + pure decision function:
|
||||
|
||||
- default **deny**
|
||||
- allow only v1 read capability ids (`org_summary`, `list_transactions`,
|
||||
`cost_run_rate_hints` / snapshot)
|
||||
- hard deny classes: `spend`, `volume_cost`, `credential_exfil`
|
||||
- unit tests: allow known reads; deny transfer/card/invoice-shaped tools and
|
||||
suspicious args even if somehow invoked
|
||||
|
||||
Done when: policy tests pass in CI/local; no network required.
|
||||
|
||||
## Task: Qonto REST client (credential inject, no secret log)
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0002-T03
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "be3aa7b6-f28c-4436-bd5d-d6940de6c2ce"
|
||||
```
|
||||
|
||||
Implement thirdparty client using `Authorization: login:key` (fields
|
||||
`API_USER`/`API_KEY` from env or OpenBao fetch helper). Map:
|
||||
|
||||
- organization + bank accounts
|
||||
- paginated transactions with hard caps
|
||||
- never log Authorization or key material
|
||||
|
||||
Support env inject for tests (`QONTO_API_KEY`/`QONTO_ORGANIZATION_ID` or
|
||||
`API_KEY`/`API_USER`) and document OpenBao fetch for operators.
|
||||
|
||||
Done when: unit tests with mocked HTTP; optional live smoke behind a flag.
|
||||
|
||||
## Task: REST API surface
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0002-T04
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "678b0b26-15af-4037-849f-d24d320588ac"
|
||||
```
|
||||
|
||||
Expose JSON endpoints that all run through the policy kernel:
|
||||
|
||||
| Method | Path | Capability |
|
||||
| --- | --- | --- |
|
||||
| GET | `/v1/health` | no bank call |
|
||||
| GET | `/v1/accounts` | org_summary |
|
||||
| GET | `/v1/transactions` | list_transactions (capped) |
|
||||
| GET | `/v1/snapshot` | cost/run-rate oriented summary |
|
||||
|
||||
Done when: OpenAPI or documented curl examples; integration test with mock
|
||||
client; deny paths return 403 with stable error code.
|
||||
|
||||
## Task: Audit metadata (no secrets)
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0002-T05
|
||||
status: todo
|
||||
priority: medium
|
||||
state_hub_task_id: "4a42dff1-1281-4cc1-ba6a-24702bce7dc9"
|
||||
```
|
||||
|
||||
Log or emit structured audit events: actor (if present), capability, decision,
|
||||
deny_reason, latency, upstream HTTP status. Never secret fields. Prefer
|
||||
stdout JSON + optional State Hub progress for dogfood runs.
|
||||
|
||||
Done when: tests assert secrets absent from log lines for a sample allow/deny.
|
||||
|
||||
## Task: Operator runbook + CostRunRate refresh path
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0002-T06
|
||||
status: todo
|
||||
priority: medium
|
||||
state_hub_task_id: "7b7ca0f7-f523-473e-b3f6-fe0564f54ed5"
|
||||
```
|
||||
|
||||
Document how binky-control refreshes `finance/CostRunRate.md` via
|
||||
`GET /v1/snapshot` (or equivalent) with OpenBao-backed service start. Link from
|
||||
README. Optional thin script under `scripts/`.
|
||||
|
||||
Done when: runbook in `docs/` or README section; dry-run instructions without
|
||||
pasting keys into chat.
|
||||
|
||||
## Task: Closure review
|
||||
|
||||
```task
|
||||
id: QONTO-WP-0002-T07
|
||||
status: todo
|
||||
priority: low
|
||||
state_hub_task_id: "9b99ba05-99f2-4624-9044-89bf37055434"
|
||||
```
|
||||
|
||||
Mark workplan finished when T01–T06 done; note Phase 2 seed (MCP surface for
|
||||
all harnesses) in closure. Run `statehub fix-consistency`.
|
||||
Loading…
Add table
Add a link
Reference in a new issue