CCR-2026-0008 active: tenants/binky/qonto-api lane live

Align path and fields (API_KEY, API_USER) with provisioned secret; policy and OIDC role applied; agent-high-risk-boundary deny on data path. Front door ready.
CCR-2026-0008: Binky Qonto API tenant lane (approved, pending apply)
2026-07-21 21:42:10 +02:00 · 2026-07-21 21:26:25 +02:00
4 changed files with 185 additions and 0 deletions
--- a/credential-change-requests/CCR-2026-0008-binky-qonto-api.yaml
+++ b/credential-change-requests/CCR-2026-0008-binky-qonto-api.yaml
@ -0,0 +1,142 @@
+id: CCR-2026-0008
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: Binky Qonto bank API credentials (tenant lane, read-only MCP)
+status: active
+created: '2026-07-21'
+updated: '2026-07-21'
+requester:
+  agent: grok
+  reason: Establish OpenBao custody for Binky Hedgehog GmbH / Operational Knowledge
+    GmbH Qonto API credentials used by the self-hosted qonto/qonto-mcp-server
+    (binky-control BINKY-WP-0005; DEC-2026-004 approved). Read-only use enforced at
+    harness tool allow-list; payments/transfers remain founder Red lane forever.
+review:
+  required: true
+  required_approvers:
+  - platform-operator
+  comments:
+  - at: '2026-07-21T19:26:02+00:00'
+    reviewer: bernd.worsch
+    decision: approved
+    comment: 'Approved as platform implemention of DEC-2026-004 (founder 2026-07-19):
+      self-hosted qonto-mcp-server, tenants/binky/qonto-api custody, read-only harness.
+      Proceed with policy+OIDC role apply; secret values remain founder Red-lane only.'
+target:
+  domain: financials
+  tenant: binky
+  workload: qonto
+  environment: production
+  purpose: Read-only Qonto MCP / API for balance/transactions/CostRunRate feeds
+openbao:
+  mount: tenants
+  kv_path: tenants/binky/qonto-api
+  fields:
+  - API_KEY
+  - API_USER
+  policy_name: workload-kv-read-binky-qonto-api
+  policy_file: openbao/policies/workload-kv-read-binky-qonto-api.hcl
+  auth:
+    method: oidc
+    mount: netkingdom
+    role: binky-qonto-api-workload-kv-read
+    allowed_redirect_uris:
+    - https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
+    - http://localhost:8250/oidc/callback
+    - http://127.0.0.1:8250/oidc/callback
+    oidc_scopes:
+    - openid
+    - profile
+    - email
+    - groups
+    user_claim: sub
+    groups_claim: groups
+    bound_claims:
+      groups:
+      - net-kingdom-admins
+    bound_claims_confirmed: true
+    policies:
+    - workload-kv-read-binky-qonto-api
+    ttl: 15m
+access_frontdoor:
+  type: ops-warden
+  catalog_id: binky-qonto-api
+  selector: binky qonto api bank
+  command: warden access binky-qonto-api --out FILE
+  resolvable: true
+  readiness: ready
+delivery:
+  surface: operator-workstation
+  target: 'Map API_KEY→QONTO_API_KEY and API_USER→QONTO_ORGANIZATION_ID for
+    qonto-mcp-server / thirdparty API; binky-control finance/ metadata-only evidence'
+risk:
+  classification: high
+  notes:
+  - Full-scope bank API key (Qonto keys are not scope-limited server-side).
+  - Read-only is harness-enforced (tool allow-list); never allow payment/transfer tools.
+  - High-risk lane (WP-0026 T04) — agents must not stream raw values; use --out/--exec/--wrap.
+  - Values must not appear in Git, State Hub, chat, or workplans.
+  - ops-warden proxies as the caller and must not retain values.
+  - Live path is tenants/binky/qonto-api (not tenants/binky/qonto/api).
+  - Field names are API_KEY + API_USER (login:key Authorization header).
+verification:
+  positive:
+  - Approved net-kingdom-admins identity can read the data path (capabilities include
+    read) without printing values.
+  negative:
+  - default-policy token denied on tenants/data/binky/qonto-api.
+  activation_conditions:
+  - tenants/ KV v2 mount enabled on bao.coulomb.social (already from CCR-2026-0007).
+  - Policy and OIDC role applied.
+  - Secret values provisioned by founder (Red lane) through approved custody.
+  - Positive and negative capabilities-safe verification recorded.
+  - ops-warden catalog promoted after verify + provision.
+  evidence:
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: secret_provisioned
+    result: passed
+    details:
+    - 'Founder-provisioned secret at tenants/binky/qonto-api (version 1; fields
+      API_KEY, API_USER present — lengths only verified).'
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-binky-qonto-api
+      (path tenants/data|metadata/binky/qonto-api)'
+    - 'Auth role metadata write: auth/netkingdom/role/binky-qonto-api-workload-kv-read'
+    - 'agent-high-risk-boundary updated: deny data / read metadata on qonto-api'
+    - No secret values written by applier.
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: capabilities_safe_verify
+    result: passed
+    details:
+    - 'lane-policy token → read on tenants/data/binky/qonto-api and metadata path'
+    - Field presence keys API_KEY + API_USER; no values printed
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: frontdoor_activation
+    result: passed
+    details:
+    - catalog id binky-qonto-api status=active resolvable=true risk=high
+  - at: '2026-07-21T19:36:55+00:00'
+    actor: grok
+    kind: first_consumer_use
+    result: passed
+    details:
+    - 'BINKY-WP-0005-T05 first read-only pull via thirdparty API v2 (122 txs);
+      CostRunRate rows 1+4 updated; evidence finance/qonto-first-pull-2026-07-21.json'
+lifecycle:
+  deactivate: Disable ops-warden catalog entry and detach OIDC role policy; revoke
+    API key in Qonto dashboard.
+  rotate: Mint a new API key in Qonto /settings/integrations; bao kv put
+    tenants/binky/qonto-api API_KEY=@file (and API_USER=@file if login changed);
+    revoke old key; verify capabilities-safe.
+  compromised: Deactivate front door, revoke key in Qonto, clear EXPOSED taint after
+    rotation, record blast-radius notes.
+state_hub:
+  workplan_id: BINKY-WP-0005
--- a/docs/workload-kv-access-lanes.md
+++ b/docs/workload-kv-access-lanes.md
@ -397,6 +397,30 @@ warden access binky-company-email-imap --all --out /tmp/p          # preferred

 Onboarding playbook: `ops-warden/wiki/playbooks/tenant-secret-onboarding.md`.

+### Binky Qonto bank API (`CCR-2026-0008`)
+
+| Item | Value |
+| --- | --- |
+| ops-warden catalog id | `binky-qonto-api` |
+| Tenant | `binky` |
+| Mount | `tenants` |
+| OpenBao CLI path | `tenants/binky/qonto-api` |
+| Fields | `API_KEY`, `API_USER` (map to `QONTO_API_KEY` / `QONTO_ORGANIZATION_ID`) |
+| Read policy | `workload-kv-read-binky-qonto-api` |
+| Policy file | `openbao/policies/workload-kv-read-binky-qonto-api.hcl` |
+| OIDC role | `binky-qonto-api-workload-kv-read` |
+| Front-door readiness | active, resolvable=true (provisioned + first pull 2026-07-21) |
+| Risk | high |
+| Consumer | thirdparty API / self-hosted `qonto/qonto-mcp-server`; harness read-only |
+
+```bash
+bao login -method=oidc -path=netkingdom role=binky-qonto-api-workload-kv-read
+warden access binky-qonto-api --all --out /tmp/k   # primary field API_KEY
+```
+
+Design: `binky-control/integrations/qonto-mcp.md`.  
+Onboarding playbook: `ops-warden/wiki/playbooks/tenant-secret-onboarding.md`.
+
 ## agent-harness Forgejo deploy key

 | Item | Value |
--- a/openbao/policies/agent-high-risk-boundary.hcl
+++ b/openbao/policies/agent-high-risk-boundary.hcl
@ -30,6 +30,12 @@ path "tenants/data/binky/company-email/imap" {
 path "tenants/metadata/binky/company-email/imap" {
  capabilities = ["read"]
 }
+path "tenants/data/binky/qonto-api" {
+  capabilities = ["deny"]
+}
+path "tenants/metadata/binky/qonto-api" {
+  capabilities = ["read"]
+}

 path "sys/capabilities-self" {
  capabilities = ["update"]
--- a/openbao/policies/workload-kv-read-binky-qonto-api.hcl
+++ b/openbao/policies/workload-kv-read-binky-qonto-api.hcl
@ -0,0 +1,13 @@
+# Least-privilege read policy for Binky Qonto bank API credentials.
+# Tenant mount (WARDEN-WP-0028) — client commercial secrets, not platform workloads.
+# Live path: tenants/binky/qonto-api (fields API_KEY, API_USER).
+# Consumers map API_KEY→QONTO_API_KEY and API_USER→QONTO_ORGANIZATION_ID for
+# qonto/qonto-mcp-server (BINKY-WP-0005); read-only at harness.
+
+path "tenants/data/binky/qonto-api" {
+  capabilities = ["read"]
+}
+
+path "tenants/metadata/binky/qonto-api" {
+  capabilities = ["read"]
+}
Author	SHA1	Message	Date
tegwick	1cbaac7a73	CCR-2026-0008 active: tenants/binky/qonto-api lane live All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 2s Details Align path and fields (API_KEY, API_USER) with provisioned secret; policy and OIDC role applied; agent-high-risk-boundary deny on data path. Front door ready.	2026-07-21 21:42:10 +02:00
tegwick	9f452f25be	CCR-2026-0008: Binky Qonto API tenant lane (approved, pending apply) Policy + OIDC role for tenants/binky/qonto/api; agent-high-risk-boundary deny on data path. Implements DEC-2026-004 / BINKY-WP-0005 custody; secret values remain founder Red-lane.	2026-07-21 21:26:25 +02:00