From 77e88c98a19280795c4d1e4054bbf882f19d9304 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Mon, 10 Aug 2026 14:27:15 -0500
Subject: [PATCH] fix(access): map UCS to root, create tickets for blocked
 systems
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

access-matrix.sh:
- tsys-ucs-* mapped to root (was falling through to localuser)

bootstrap-all.sh:
- UCS systems excluded (2FA blocks SSH — needs console work, [#418])
- sectestbed-sandbox marked as 2FA-by-design
- stlp-3dscanner flagged for rename+bringup ([#417])

Refs [#403], [#417], [#418]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
---
 access-matrix.sh | 1 +
 bootstrap-all.sh | 9 +++++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/access-matrix.sh b/access-matrix.sh
index b780552..a36f40b 100644
--- a/access-matrix.sh
+++ b/access-matrix.sh
@@ -19,6 +19,7 @@ users_for() {
     *-proxmox-pbs)                   echo "root:no" ;;
     *-proxmox-mailgw*)               echo "root:no" ;;
     *-proxmox-backup*)               echo "root:no" ;;
+    tsys-ucs-*)                      echo "root:no" ;;
     ultix-streaming)                 echo "root:no" ;;
     stlpc-*)                         echo "root:labuser:no" ;;
     subopi*)                         echo "subodev:yes" ;;
diff --git a/bootstrap-all.sh b/bootstrap-all.sh
index 84d072b..ef54fd7 100644
--- a/bootstrap-all.sh
+++ b/bootstrap-all.sh
@@ -69,10 +69,11 @@ echo "========================================"
 echo "Summary: $ok done, $fail failed"
 [ -n "$faillist" ] && echo "Failed:$faillist"
 echo "========================================"
-echo "Still 2FA-blocked (need policy decision):"
-echo "  sectestbed-sandbox, tsys-ucs-01, tsys-ucs-02"
+echo "Blocked — need console work (separate tickets):"
+echo "  tsys-ucs-01, tsys-ucs-02 — remove 2FA first [#418]"
+echo "  stlpc-3dscanner — bring online + rename [#417]"
 echo "========================================"
-echo "Unknown user (not in bootstrap):"
-echo "  stlp-3dscanner (100.125.14.37) — need user clarification"
+echo "2FA by design (leave alone):"
+echo "  sectestbed-sandbox"
 echo "========================================"
 echo "Tell the agent to re-run access-matrix.sh to verify."