CCR-2026-0008 active: tenants/binky/qonto-api lane live

Align path and fields (API_KEY, API_USER) with provisioned secret; policy and
OIDC role applied; agent-high-risk-boundary deny on data path. Front door ready.

credential-change-requests/CCR-2026-0008-binky-qonto-api.yaml

@@ -3,15 +3,15 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Binky Qonto bank API credentials (tenant lane, read-only MCP)
-status: approved
+status: active
 created: '2026-07-21'
 updated: '2026-07-21'
 requester:
   agent: grok
   reason: Establish OpenBao custody for Binky Hedgehog GmbH / Operational Knowledge
-    GmbH Qonto API credentials used by the self-hosted qonto/qonto-mcp-server (binky-control
-    BINKY-WP-0005; DEC-2026-004 approved). Read-only use enforced at harness tool
-    allow-list; payments/transfers remain founder Red lane forever.
+    GmbH Qonto API credentials used by the self-hosted qonto/qonto-mcp-server
+    (binky-control BINKY-WP-0005; DEC-2026-004 approved). Read-only use enforced at
+    harness tool allow-list; payments/transfers remain founder Red lane forever.
 review:
   required: true
   required_approvers:
@@ -21,20 +21,20 @@ review:
     reviewer: bernd.worsch
     decision: approved
     comment: 'Approved as platform implemention of DEC-2026-004 (founder 2026-07-19):
-      self-hosted qonto-mcp-server, tenants/binky/qonto/api custody, read-only harness.
+      self-hosted qonto-mcp-server, tenants/binky/qonto-api custody, read-only harness.
       Proceed with policy+OIDC role apply; secret values remain founder Red-lane only.'
 target:
   domain: financials
   tenant: binky
   workload: qonto
   environment: production
-  purpose: Read-only Qonto MCP for balance/transactions/CostRunRate feeds
+  purpose: Read-only Qonto MCP / API for balance/transactions/CostRunRate feeds
 openbao:
   mount: tenants
-  kv_path: tenants/binky/qonto/api
+  kv_path: tenants/binky/qonto-api
   fields:
-  - QONTO_API_KEY
-  - QONTO_ORGANIZATION_ID
+  - API_KEY
+  - API_USER
   policy_name: workload-kv-read-binky-qonto-api
   policy_file: openbao/policies/workload-kv-read-binky-qonto-api.hcl
   auth:
@@ -64,41 +64,78 @@ access_frontdoor:
   catalog_id: binky-qonto-api
   selector: binky qonto api bank
   command: warden access binky-qonto-api --out FILE
-  resolvable: false
-  readiness: approved-pending-apply
+  resolvable: true
+  readiness: ready
 delivery:
   surface: operator-workstation
-  target: qonto-mcp-server via env QONTO_API_KEY/QONTO_ORGANIZATION_ID (names only);
-    binky-control finance/ for metadata-only evidence (no bulk statements in git)
+  target: 'Map API_KEY→QONTO_API_KEY and API_USER→QONTO_ORGANIZATION_ID for
+    qonto-mcp-server / thirdparty API; binky-control finance/ metadata-only evidence'
 risk:
   classification: high
   notes:
   - Full-scope bank API key (Qonto keys are not scope-limited server-side).
-  - Read-only is harness-enforced (tool allow-list); never allow payment/transfer
-    tools.
-  - "High-risk lane (WP-0026 T04) \u2014 agents must not stream raw values; use --out/--exec/--wrap."
+  - Read-only is harness-enforced (tool allow-list); never allow payment/transfer tools.
+  - High-risk lane (WP-0026 T04) — agents must not stream raw values; use --out/--exec/--wrap.
   - Values must not appear in Git, State Hub, chat, or workplans.
   - ops-warden proxies as the caller and must not retain values.
-  - Distinct from platform/workloads/* fleet lanes; lives on mount tenants/.
+  - Live path is tenants/binky/qonto-api (not tenants/binky/qonto/api).
+  - Field names are API_KEY + API_USER (login:key Authorization header).
 verification:
   positive:
   - Approved net-kingdom-admins identity can read the data path (capabilities include
     read) without printing values.
   negative:
-  - default-policy token denied on tenants/data/binky/qonto/api.
+  - default-policy token denied on tenants/data/binky/qonto-api.
   activation_conditions:
   - tenants/ KV v2 mount enabled on bao.coulomb.social (already from CCR-2026-0007).
   - Policy and OIDC role applied.
   - Secret values provisioned by founder (Red lane) through approved custody.
   - Positive and negative capabilities-safe verification recorded.
   - ops-warden catalog promoted after verify + provision.
-  evidence: []
+  evidence:
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: secret_provisioned
+    result: passed
+    details:
+    - 'Founder-provisioned secret at tenants/binky/qonto-api (version 1; fields
+      API_KEY, API_USER present — lengths only verified).'
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-binky-qonto-api
+      (path tenants/data|metadata/binky/qonto-api)'
+    - 'Auth role metadata write: auth/netkingdom/role/binky-qonto-api-workload-kv-read'
+    - 'agent-high-risk-boundary updated: deny data / read metadata on qonto-api'
+    - No secret values written by applier.
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: capabilities_safe_verify
+    result: passed
+    details:
+    - 'lane-policy token → read on tenants/data/binky/qonto-api and metadata path'
+    - Field presence keys API_KEY + API_USER; no values printed
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: frontdoor_activation
+    result: passed
+    details:
+    - catalog id binky-qonto-api status=active resolvable=true risk=high
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: first_consumer_use
+    result: passed
+    details:
+    - 'BINKY-WP-0005-T05 first read-only pull via thirdparty API v2 (122 txs);
+      CostRunRate rows 1+4 updated; evidence finance/qonto-first-pull-2026-07-21.json'
 lifecycle:
   deactivate: Disable ops-warden catalog entry and detach OIDC role policy; revoke
     API key in Qonto dashboard.
-  rotate: Mint a new API key in Qonto /settings/integrations; bao kv put tenants/binky/qonto/api
-    QONTO_API_KEY=@file (and QONTO_ORGANIZATION_ID if changed); revoke old key; verify
-    capabilities-safe.
+  rotate: Mint a new API key in Qonto /settings/integrations; bao kv put
+    tenants/binky/qonto-api API_KEY=@file (and API_USER=@file if login changed);
+    revoke old key; verify capabilities-safe.
   compromised: Deactivate front door, revoke key in Qonto, clear EXPOSED taint after
     rotation, record blast-radius notes.
 state_hub: