skills: cloudron.md records pointer

skills/agent-provisioning/references/org-chart-update.md

@@ -0,0 +1,37 @@
+# Org chart update (mandatory post-provisioning step)
+
+The org chart lives in THREE places and all three move together in the same
+turn a provisioning change lands:
+
+| Where | What | How |
+|---|---|---|
+| `TSYSGroupCorporate/TSYSGroupAIOS` `agents/global/AGENTS.md` — "Org chart & agent lanes" | THE canonical operational map (every session loads it via symlink) | branch `coo/…` or lane branch → PR → founder merge |
+| `reachableceo/org-buildout` `docs/org-chart.md` | The rendered full-group chart (publishable) | same-turn commit |
+| Redmine provisioning ticket | Per-identity state (pw/2FA/seed/systems) | comment with commit URLs |
+
+Rules:
+
+1. **Chart before claimed-done.** A provisioned identity that isn't in the
+   chart is an incomplete task; a charted identity without a ticket is
+   invisible work. Both fail review.
+2. House-rules/policy changes additionally require a `house-rules-v*` tag bump
+   (see the versioning section at the bottom of AGENTS.md).
+3. The COO C2 lane charts; lanes below SVP execute. If you are not the COO
+   lane, your provisioning ticket IS the chart-change request.
+4. When the chart changes, so does reality somewhere: verify the identity's
+   vault item (unique password, totp_seed, per-system tokens) before drawing
+   it as operational.
+
+Sequence for one provisioning run (branch `coo/…` in TSYSGroupAIOS):
+
+```bash
+# 1. edit agents/global/AGENTS.md org table (if lane structure changed)
+# 2. edit org-buildout docs/org-chart.md + STATUS.md
+# 3. commit both, push both (HTTPS + the acting identity's token)
+# 4. PR for TSYSGroupAIOS if policy-level; org-buildout pushes direct per its flow
+# 5. Redmine comment links every commit URL
+```
+
+---
+
+**Records:** Redmine #942 — https://projects.knownelement.com/issues/942 · Discourse docs home: https://community.turnsys.com (skill topic pending admin-key provisioning, tracked on #942)