feat: VpEngOps identity + SBOM/GLPI plans wired into lifecycle [#834]

Commits now authored as VpEngOps (vault: creds/vpengops-vpentops);
reachableceo is the human personal account. grind-stack gains `sbom`
(CycloneDX via pinned syft container, run before sweep) per #834;
GLPI catalog entries planned in #835 gated on #801 write access.
AGENTS.md packaging steps extended; questions-v1.md opened for the
founder (netbird scope, SigNoz reopen, SBOM format).

AGENTS.md

@@ -138,12 +138,26 @@ auth app.
 2. Write `Dockerfile` + `CloudronManifest.json` (+ `start.sh` if runtime setup needed).
 3. Verify with the grind lifecycle (below): `scripts/grind-stack.sh up <pkg-dir>`
    → `curl` / `logs` → `down`.
-4. Write `README.md` + `CHANGELOG.md` + `logo.png` (+ `.env.example`).
-5. Commit as `feat: add <app> Cloudron package (<Category>)`, push.
-6. Run the gardening protocol above (update STATUS / README / JOURNAL).
-7. `scripts/grind-stack.sh sweep <pkg-dir>` — drop the test image + dangling
+4. Generate the SBOM ([#834](https://projects.knownelement.com/issues/834)):
+   `scripts/grind-stack.sh sbom <pkg-dir>` → commits
+   `sbom.cyclonedx.json` beside the package (syft via pinned container).
+5. GLPI software catalog entry ([#835](https://projects.knownelement.com/issues/835)):
+   staged on the ticket until #801 grants agent write access, then
+   `mglpi software create` per package.
+6. Write `README.md` + `CHANGELOG.md` + `logo.png` (+ `.env.example`).
+7. Commit as `feat: add <app> Cloudron package (<Category>)`, push.
+8. Run the gardening protocol above (update STATUS / README / JOURNAL).
+9. `scripts/grind-stack.sh sweep <pkg-dir>` — drop the test image + dangling
    build cache so disk usage stays flat across the grind.
 
+**Agent identity (MANDATORY, 2026-09-06):** commits from this repo are authored
+as **VpEngOps** `<tsgstaff-coo-vpengops@turnsys.com>` (repo-local git config;
+identity fields vaulted at `creds/vpengops-vpentops` in the TSGCOO Bitwarden
+vault via `sm`). NEVER commit as the `reachableceo` personal account — that
+account is the human's. Global git config stays the human's; set repo-local
+identity in every repo the agent works. Cloudron-side logins use the
+`vpentops` platform account (same vault item).
+
 **Grind lifecycle** ([`scripts/grind-stack.sh`](scripts/grind-stack.sh)): serial
 verify-stack harness. `up` builds the image under `ukrrs-batch.slice` and starts
 ephemeral postgres/redis/mysql matching the manifest's addons, plus the app

STATUS.md

@@ -3,14 +3,21 @@
 > **Human read-only. Agents maintain this file automatically after each work
 > session.** Do not edit by hand — the next agent run will overwrite it.
 >
-> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — rathole REMOVED by founder
-> ruling ("we will use netbird for all enterprise network access"): package dir
-> deleted, GitUrlList 46→40, completed count 19→18. Landed tickets sit in
-> **Feedback** (awaiting live-Cloudron UAT); builds ON HOLD pending the
-> founder's queue review. Standing policies: no-Node, no-open-core, no-SSO-tax,
-> netbird for network access, RustFS makes S3 a non-blocker,
-> ClickHouse + ActiveMQ available on infra (CH/MQ reqs = not blockers;
+> **Last updated:** 2026-09-06 by VpEngOps agent (ZCode/GLM-5.3) — rathole
+> REMOVED by founder ruling ("we will use netbird for all enterprise network
+> access"): package dir deleted, GitUrlList 46→40, completed count 19→18.
+> Landed tickets sit in **Feedback** (awaiting live-Cloudron UAT); builds ON
+> HOLD pending the founder's queue review. Standing policies: no-Node,
+> no-open-core, no-SSO-tax, netbird for network access, RustFS makes S3 a
+> non-blocker, ClickHouse + ActiveMQ on infra (CH/MQ reqs = not blockers;
 > verify protocol compat per app). Killed tickets Closed at founder direction.
+>
+> IDENTITY (2026-09-06): agent commits now authored as **VpEngOps**
+> <tsgstaff-coo-vpengops@turnsys.com> (vault item `creds/vpengops-vpentops`);
+> `reachableceo` is the human's personal account and is no longer used by
+> agents. Cloudron-side logins use the `vpentops` platform account.
+> Plans filed: SBOMs **#834**, GLPI software catalog **#835** (gated on
+> #801 write access). Open questions for the founder: questions-v1.md.
 
 ## Current State: STABLE (packaging phase, ongoing)
 

questions-v1.md

@@ -0,0 +1,23 @@
+# Questions — TSYSDevStack-SupportStack-Cloudron
+
+> Agent-authored questions for the founder. Answers inline, newest round at
+> the top; version up per round (questions-v2.md on the next round).
+
+## Round 1 — 2026-09-06 (VpEngOps)
+
+1. ~~**OAM chat access**~~ ANSWERED in ZCode 2026-09-06: "OAM chat" meant the
+   OAM context here in ZCode — no Matrix credential needed. Identity source =
+   vault item `creds/vpengops-vpentops`; commits now authored as VpEngOps.
+
+2. **NetBird ruling scope** — #650 killed rathole ("netbird for all
+   enterprise network access"). Do **Database-Gateway** (#639, landed:
+   HTTPS DB-access proxy) and **Easy-Gate** (#651, landed: briefing-page
+   gateway) fall inside that ruling, or are they distinct enough to keep?
+
+3. **SigNoz reopen?** — with ClickHouse coming to the infra, SigNoz #666's
+   storage blocker dissolves, but its OSS auth is still local-only (SSO is
+   enterprise-gated = SSO-tax kill). Stay closed, or reopen under an
+   explicit local-auth acceptance?
+
+4. **SBOM format** — defaulting to CycloneDX JSON (syft). If the org
+   standard is SPDX, or both formats are wanted, say so on #834.

scripts/grind-stack.sh

@@ -129,6 +129,23 @@ cmd_sweep() {
   echo "swept. Base images are kept for reuse; fleets untouched."
 }
 
+SYFT_IMAGE="anchore/syft:v1.18.1@sha256:b8c170b8e51bfc4779ec3ef4399942c57290f5ce76a9c3af564c9d00d4946a6b"
+
+cmd_sbom() {
+  PKG="${1:?usage: grind-stack.sh sbom <pkg-dir>}"
+  [ -f "$PKG/CloudronManifest.json" ] || die "no CloudronManifest.json in $PKG"
+  APPNAME="$(basename "$PKG" | tr '[:upper:]' '[:lower:]')"
+  IMAGE="grind-$APPNAME:test"
+  docker image inspect "$IMAGE" >/dev/null 2>&1 || die "no test image $IMAGE - run 'up' first (sbom runs BEFORE sweep)"
+  echo "== grind sbom: $IMAGE -> CycloneDX"
+  # syft via pinned container (no host installs); reads the docker daemon
+  docker run --rm --cgroup-parent "$SLICE" -v /var/run/docker.sock:/var/run/docker.sock \
+    "$SYFT_IMAGE" "$IMAGE" -o cyclonedx-json > "$PKG/sbom.cyclonedx.json" \
+    || die "syft failed"
+  jq -r '"  components: \(.components | length), tool: \(.metadata.tools[0].name // "?") \(.metadata.tools[0].version // "")"' "$PKG/sbom.cyclonedx.json" 2>/dev/null || true
+  echo "wrote $PKG/sbom.cyclonedx.json [#834] - commit it with the package"
+}
+
 cmd_preflight() {
   ROOT="$(docker info --format '{{.DockerRootDir}}')"
   echo "docker root: $ROOT"