coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0008 active: tenants/binky/qonto-api lane live
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Align path and fields (API_KEY, API_USER) with provisioned secret; policy and
OIDC role applied; agent-high-risk-boundary deny on data path. Front door ready.
This commit is contained in:
tegwick 2026-07-21 21:42:10 +02:00
parent 9f452f25be
commit 1cbaac7a73
4 changed files with 71 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/workload-kv-access-lanes.md
View file

@ -404,20 +404,18 @@ Onboarding playbook: `ops-warden/wiki/playbooks/tenant-secret-onboarding.md`.
| ops-warden catalog id | `binky-qonto-api` |
| Tenant | `binky` |
| Mount | `tenants` |
| OpenBao CLI path | `tenants/binky/qonto/api` |
| Fields | `QONTO_API_KEY`, `QONTO_ORGANIZATION_ID` |
| OpenBao CLI path | `tenants/binky/qonto-api` |
| Fields | `API_KEY`, `API_USER` (map to `QONTO_API_KEY` / `QONTO_ORGANIZATION_ID`) |
| Read policy | `workload-kv-read-binky-qonto-api` |
| Policy file | `openbao/policies/workload-kv-read-binky-qonto-api.hcl` |
| OIDC role | `binky-qonto-api-workload-kv-read` |
| Front-door readiness | draft until founder Red provision (DEC-2026-004 / BINKY-WP-0005-T05) |
| Front-door readiness | active, resolvable=true (provisioned + first pull 2026-07-21) |
| Risk | high |
| Consumer | self-hosted `qonto/qonto-mcp-server`; harness read-only tool allow-list |
| Consumer | thirdparty API / self-hosted `qonto/qonto-mcp-server`; harness read-only |
```bash
bao login -method=oidc -path=netkingdom role=binky-qonto-api-workload-kv-read
# after provision:
warden access binky-qonto-api --all --exec -- \
env | grep -E '^QONTO_' | sed 's/=.*/=<redacted>/' # lengths only in normal ops
warden access binky-qonto-api --all --out /tmp/k # primary field API_KEY
```
Design: `binky-control/integrations/qonto-mcp.md`.