id: CCR-2026-0008
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Binky Qonto bank API credentials (tenant lane, read-only MCP)
status: active
created: '2026-07-21'
updated: '2026-07-21'
requester:
  agent: grok
  reason: Establish OpenBao custody for Binky Hedgehog GmbH / Operational Knowledge
    GmbH Qonto API credentials used by the self-hosted qonto/qonto-mcp-server
    (binky-control BINKY-WP-0005; DEC-2026-004 approved). Read-only use enforced at
    harness tool allow-list; payments/transfers remain founder Red lane forever.
review:
  required: true
  required_approvers:
  - platform-operator
  comments:
  - at: '2026-07-21T19:26:02+00:00'
    reviewer: bernd.worsch
    decision: approved
    comment: 'Approved as platform implemention of DEC-2026-004 (founder 2026-07-19):
      self-hosted qonto-mcp-server, tenants/binky/qonto-api custody, read-only harness.
      Proceed with policy+OIDC role apply; secret values remain founder Red-lane only.'
target:
  domain: financials
  tenant: binky
  workload: qonto
  environment: production
  purpose: Read-only Qonto MCP / API for balance/transactions/CostRunRate feeds
openbao:
  mount: tenants
  kv_path: tenants/binky/qonto-api
  fields:
  - API_KEY
  - API_USER
  policy_name: workload-kv-read-binky-qonto-api
  policy_file: openbao/policies/workload-kv-read-binky-qonto-api.hcl
  auth:
    method: oidc
    mount: netkingdom
    role: binky-qonto-api-workload-kv-read
    allowed_redirect_uris:
    - https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
    - http://localhost:8250/oidc/callback
    - http://127.0.0.1:8250/oidc/callback
    oidc_scopes:
    - openid
    - profile
    - email
    - groups
    user_claim: sub
    groups_claim: groups
    bound_claims:
      groups:
      - net-kingdom-admins
    bound_claims_confirmed: true
    policies:
    - workload-kv-read-binky-qonto-api
    ttl: 15m
access_frontdoor:
  type: ops-warden
  catalog_id: binky-qonto-api
  selector: binky qonto api bank
  command: warden access binky-qonto-api --out FILE
  resolvable: true
  readiness: ready
delivery:
  surface: operator-workstation
  target: 'Map API_KEY→QONTO_API_KEY and API_USER→QONTO_ORGANIZATION_ID for
    qonto-mcp-server / thirdparty API; binky-control finance/ metadata-only evidence'
risk:
  classification: high
  notes:
  - Full-scope bank API key (Qonto keys are not scope-limited server-side).
  - Read-only is harness-enforced (tool allow-list); never allow payment/transfer tools.
  - High-risk lane (WP-0026 T04) — agents must not stream raw values; use --out/--exec/--wrap.
  - Values must not appear in Git, State Hub, chat, or workplans.
  - ops-warden proxies as the caller and must not retain values.
  - Live path is tenants/binky/qonto-api (not tenants/binky/qonto/api).
  - Field names are API_KEY + API_USER (login:key Authorization header).
verification:
  positive:
  - Approved net-kingdom-admins identity can read the data path (capabilities include
    read) without printing values.
  negative:
  - default-policy token denied on tenants/data/binky/qonto-api.
  activation_conditions:
  - tenants/ KV v2 mount enabled on bao.coulomb.social (already from CCR-2026-0007).
  - Policy and OIDC role applied.
  - Secret values provisioned by founder (Red lane) through approved custody.
  - Positive and negative capabilities-safe verification recorded.
  - ops-warden catalog promoted after verify + provision.
  evidence:
  - at: '2026-07-21T19:36:55+00:00'
    actor: grok
    kind: secret_provisioned
    result: passed
    details:
    - 'Founder-provisioned secret at tenants/binky/qonto-api (version 1; fields
      API_KEY, API_USER present — lengths only verified).'
  - at: '2026-07-21T19:36:55+00:00'
    actor: grok
    kind: delegated_metadata_apply
    result: passed
    details:
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-binky-qonto-api
      (path tenants/data|metadata/binky/qonto-api)'
    - 'Auth role metadata write: auth/netkingdom/role/binky-qonto-api-workload-kv-read'
    - 'agent-high-risk-boundary updated: deny data / read metadata on qonto-api'
    - No secret values written by applier.
  - at: '2026-07-21T19:36:55+00:00'
    actor: grok
    kind: capabilities_safe_verify
    result: passed
    details:
    - 'lane-policy token → read on tenants/data/binky/qonto-api and metadata path'
    - Field presence keys API_KEY + API_USER; no values printed
  - at: '2026-07-21T19:36:55+00:00'
    actor: grok
    kind: frontdoor_activation
    result: passed
    details:
    - catalog id binky-qonto-api status=active resolvable=true risk=high
  - at: '2026-07-21T19:36:55+00:00'
    actor: grok
    kind: first_consumer_use
    result: passed
    details:
    - 'BINKY-WP-0005-T05 first read-only pull via thirdparty API v2 (122 txs);
      CostRunRate rows 1+4 updated; evidence finance/qonto-first-pull-2026-07-21.json'
lifecycle:
  deactivate: Disable ops-warden catalog entry and detach OIDC role policy; revoke
    API key in Qonto dashboard.
  rotate: Mint a new API key in Qonto /settings/integrations; bao kv put
    tenants/binky/qonto-api API_KEY=@file (and API_USER=@file if login changed);
    revoke old key; verify capabilities-safe.
  compromised: Deactivate front door, revoke key in Qonto, clear EXPOSED taint after
    rotation, record blast-radius notes.
state_hub:
  workplan_id: BINKY-WP-0005