coulomb/qonto-assistant
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
qonto-assistant/SCOPE.md
tegwick b9349782f4 feat(audit): publish sequenced heartbeat and reconciliation evidence 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ec5-7e2b-7743-ac08-719e1b0f42e2
2026-09-05 01:39:48 +02:00

2.1 KiB
Raw Blame History

SCOPE

Refined after statehub register (2026-07-21). Normative intent in INTENT.md; architecture in specs/ArchitectureBlueprint.md.

One-liner

Policy-governed Qonto domain REST + MCP assistant: sole bank-key consumer and default-deny no spend / no volume-cost policy for multi-harness finance awareness.

Core idea

All agents and harnesses talk to this service for Qonto. None of them hold the OpenBao bank secret. Policy is enforced here once, not reimplemented per client.

In scope

  • Dual surfaces: streamable-HTTP MCP and JSON REST with a shared policy kernel
  • Read capabilities: org/accounts/balances, transactions (bounded), CostRunRate hints / snapshot helpers
  • OpenBao consumption for tenants/<tenant>/qonto-api (dogfood: binky)
  • Authn of callers (OIDC / workload identity) and optional flex-auth checks
  • Audit metadata (actor, tool, allow/deny) without secret leakage
  • Tests for default-deny and spend/volume-cost rejection
  • Docs for harness client config (no bank secrets)

Out of scope (v1 and hard)

  • Payments, transfers, SEPA, card operations, invoicing create, plan changes
  • Hosting or recommending the hosted Qonto OAuth MCP connector
  • DATEV / StB / DUO bookkeeping replacement
  • LLM provider routing (llm-connect)
  • Agent scheduling (activity-core) or session runtime (agent-harness)
  • Generic multi-MCP fleet gateway (may sit in front later; not this repo’s job)
  • Storing bank credentials outside OpenBao

Current state

Artifact Status
INTENT / SCOPE / AGENTS present
Architecture blueprint specs/ArchitectureBlueprint.md
Research notes research/2026-07-21-…
Runtime implementation REST + MCP, policy/auth gates, audit reconciliation implemented (see workplans)
Upstream custody live in platform (binky-qonto-api, CCR-2026-0008)

Getting oriented

  1. INTENT.md — why / boundaries
  2. specs/ArchitectureBlueprint.md — how
  3. research/2026-07-21-mcp-gateway-and-governed-domain-assistant.md — why this shape
  4. workplans/ — what to do next
  5. AGENTS.md — State Hub protocol