# Security Genome record for qonto-assistant.
#
# Schema per kings-guard/specs/NetKingdomImmuneArchitecture.md §9.1
# ("Minimum Genome Record"). Kings Guard does not exist as a running system
# yet — this record is written now so no rework is needed once an admission
# or posture-assessment consumer does exist. See docs/SecurityPractice.md.

security_genome_record:
  id: kg:genome:qonto-assistant
  version: 0.1.0

  ownership:
    tenant_id: binky
    accountable_owner: bernd.worsch
    operational_owner: qonto-assistant

  purpose:
    intent: >
      Sole holder of the company Qonto bank API credential; exposes
      read-only finance capabilities (org summary, transactions,
      CostRunRate hints) to authorized agent harnesses and operators via a
      governed REST + MCP surface, so no client ever holds the bank key
      directly.
    criticality: high

  identities:
    workload_identity: "TBD — pending key-cape/workload-identity integration (QONTO-WP-0004)"
    deployment_identity: "TBD — pending Railiance placement decision"

  capabilities:
    provides:
      - finance.qonto.read
    consumes:
      - openbao-secret.read           # tenants/binky/qonto-api
      - qonto-thirdparty-api.read

  communication:
    ingress:
      - caller: facade-activator      # not yet built — see docs/SecurityPractice.md §6
        protocol: https
    egress:
      - destination: openbao
        protocol: https
      - destination: qonto-thirdparty-api
        protocol: https
    # No other egress is expected or permitted. Any additional outbound
    # destination observed at runtime is, by definition, a deviation from
    # this genome.

  data:
    classifications:
      - tenant-confidential
      - financial
    persistence: ephemeral
    export_allowed: false

  provenance:
    signed_artifact_required: false   # not yet implemented fleet-wide
    approved_registry: "TBD"
    sbom_required: false              # not yet implemented; tracked as a gap
    reproducible_build_preferred: true

  expected_behavior:
    max_request_rate: "per QONTO_RATE_LIMIT_REQUESTS / QONTO_RATE_LIMIT_WINDOW_SECONDS (config.py)"
    external_network_access: false    # beyond the two declared egress destinations
    interactive_shell: prohibited
    privilege_escalation: prohibited

  recovery:
    redeployable: true
    maximum_recovery_time: PT5M       # stateless; cold-start dominated by scale-to-zero wake latency
    maximum_data_loss: PT0S           # no persisted state

  tolerances:
    - id: local-dev-shared-secret-auth
      description: >
        QONTO_ASSISTANT_MCP_TOKEN shared-secret bearer auth is tolerated
        only for fixture-backed local development, never for a deployment
        holding real Qonto credentials.
      expires_at: null                # revisit once key-cape integration (QONTO-WP-0004) lands
    - id: self-asserted-actor-claims
      description: >
        X-Actor-* headers are self-asserted, not yet cryptographically
        bound to verified identity. Tolerated until key-cape/flex-auth
        integration (QONTO-WP-0004) closes this.
      expires_at: null