Close RAILIANCE-WP-0015-T06 rapp credential-lane binding

Document the one recipe a new rapp uses to acquire runtime secrets:
standing KV secrets bind through a CCR target.rapp, leases through
grant rapp_id. Stamp the existing postgres grants and the qonto
workload CCR. Gate, delivery, and revocation are unchanged.

tests/test_credential_change.py

@@ -67,6 +67,23 @@ class CredentialChangeTests(unittest.TestCase):
                 _ccr, errors, _warnings = credential_change.validate_ccr(path)
                 self.assertEqual(errors, [])
 
+    def test_qonto_workload_ccr_binds_rapp(self) -> None:
+        path = (
+            REPO_DIR
+            / "credential-change-requests/CCR-2026-0009-qonto-assistant-workload-kv-read.yaml"
+        )
+        ccr, errors, _warnings = credential_change.validate_ccr(path)
+        self.assertEqual(errors, [])
+        self.assertEqual(ccr["target"]["rapp"], "rapp-qonto")
+
+    def test_target_rapp_rejects_non_slug(self) -> None:
+        path = self.unapproved_ccr()
+        data = credential_change.load_yaml(path)
+        data["target"]["rapp"] = "qonto"
+        credential_change.dump_yaml(path, data)
+        _ccr, errors, _warnings = credential_change.validate_ccr(path)
+        self.assertTrue(any("target.rapp" in error for error in errors))
+
     def test_render_summary_contains_review_fields(self) -> None:
         ccr, _errors, warnings = credential_change.validate_ccr(self.sample)
         rendered = credential_change.render_summary(ccr, warnings)

tests/test_credential_grants.py

@@ -0,0 +1,91 @@
+from __future__ import annotations
+
+import importlib.util
+import sys
+import unittest
+from pathlib import Path
+
+REPO_DIR = Path(__file__).resolve().parents[1]
+SPEC = importlib.util.spec_from_file_location(
+    "credential_grants_validate", REPO_DIR / "scripts/credential-grants-validate.py"
+)
+grants = importlib.util.module_from_spec(SPEC)
+assert SPEC.loader is not None
+sys.modules[SPEC.name] = grants
+SPEC.loader.exec_module(grants)
+
+
+class CredentialGrantBindTests(unittest.TestCase):
+    def test_catalog_validates(self) -> None:
+        errors: list[str] = []
+        catalog = grants.yaml.safe_load(
+            (REPO_DIR / "credential-grants/catalog.yaml").read_text()
+        )
+        for index, grant in enumerate(catalog["grants"]):
+            grants.validate_grant(grant, index, catalog, errors)
+        self.assertEqual(errors, [])
+
+    def test_postgres_grants_bind_rapp(self) -> None:
+        catalog = grants.yaml.safe_load(
+            (REPO_DIR / "credential-grants/catalog.yaml").read_text()
+        )
+        bound = {
+            grant["id"]: grant.get("rapp_id")
+            for grant in catalog["grants"]
+            if str(grant["id"]).startswith("rapp-")
+        }
+        self.assertEqual(
+            bound,
+            {
+                "rapp-postgres/audit-core-runtime": "rapp-postgres",
+                "rapp-postgres/audit-core-migration": "rapp-postgres",
+            },
+        )
+
+    def test_rapp_prefix_requires_matching_rapp_id(self) -> None:
+        errors: list[str] = []
+        grant = {
+            "id": "rapp-postgres/audit-core-runtime",
+            "title": "x",
+            "description": "x",
+            "status": "active",
+            "grant_class": "self-service",
+            "credential_type": "openbao-database-credential",
+            "issuer": "openbao",
+            "audience": "audit-core",
+            "openbao": {
+                "token_role": "audit-core-runtime-broker",
+                "issuer_policy": "credential-broker-audit-core-runtime-issuer",
+                "policies": ["credential-broker-audit-core-runtime"],
+                "disallowed_policies": ["root", "platform-admin"],
+                "mount_paths": ["database/creds/audit-core-runtime"],
+            },
+            "ttl": {"default": "15m", "max": "1h", "renewable": False},
+            "actors": {"allowed_types": ["human-operator"]},
+            "authorization": {
+                "flex_auth_required": False,
+                "purpose_required": True,
+            },
+            "delivery": {
+                "allowed": ["exec-env"],
+                "preferred": "exec-env",
+                "denied": [
+                    "chat",
+                    "state-hub-body",
+                    "git",
+                    "command-line-token-argument",
+                    "llm-prompt",
+                ],
+            },
+            "audit": {
+                "openbao_audit_required": True,
+                "record_secret_values": False,
+            },
+            "revocation": {"required": True, "by_accessor": True},
+        }
+        grants.validate_grant(grant, 0, {}, errors)
+        self.assertTrue(any("rapp_id is required" in error for error in errors))
+        errors.clear()
+        grant["rapp_id"] = "rapp-openbao"
+        grants.validate_grant(grant, 0, {}, errors)
+        self.assertTrue(any("must equal the grant id prefix" in error for error in errors))