4 Commits

Include renames

Author	SHA1	Message	Date
mrcharles	0076b4f941	docs: reachableceo wording sweep per 2026-09-09 direct order ... House style: the principal identity is named (reachableceo), never 'the founder'. No behavior change. https://projects.knownelement.com/issues/942	2026-09-09 12:43:23 -05:00
mrcharles	627948a98e	scripts: fix oidc code extraction + Cloudron 10 totp routes ... - sed kept the URL prefix in the auth-code extraction; the garbage code was the cause of every invalid_grant on the token exchange - enrollment now uses the Cloudron 10 profile-scoped routes mined from the dashboard bundle: POST /api/v1/profile/totp_secret and POST /api/v1/profile/totp_enable - seed storage verifies the setfield write and falls back to a full vault item recreate (smcli setfield 400s on some ciphers) - prompt=login added to the auth URL for session-switch flows Verified: 32 COO-org identities enrolled end-to-end (seed in vault + real TOTP login as each identity). Full detail on the #942 comment. https://projects.knownelement.com/issues/942	2026-09-09 12:34:40 -05:00
TSYS Group COO	1a1a7ca581	skills: cloudron.md records pointer	2026-09-08 06:03:06 -05:00
TSYS Group COO	bde7845490	skills: agent-provisioning - codified identity stand-up workflow ... Policy rulings (#942): unique passwords, Cloudron-only SSO accounts, no reachableceo credentials, TOTP seeds MUST be captured to the vault. Cloudron admin API wrapper, cookie-jar OIDC login, RFC-6238-tested TOTP helper, per-system SSO/API references, incident log.	2026-09-08 04:07:14 -05:00