fix(bootstrap): target only remaining system (tsys-siem) [#403]

Access validation shows 68/70 non-excluded systems at intended access
state. Strip already-bootstrapped systems (devbox-cloudron, subopi3,
subopi-dev-3/4, ultix-field, pfvsvrpi, sectestbed-cloudron) from the
active list; tsys-siem is the sole remaining actionable target.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

WORKING.md

@@ -7,9 +7,6 @@ A commit is blocked while any task below remains unchecked.
 
 (all done — session complete)
 
-- [x] Wire guest-agent-as-access ban: strip vm-guest from remote.sh, add check-rules.sh rule #11, codify in AGENTS.md [#403]
+- [x] Add NON-NEGOTIABLE session-start check-for-understanding gate to AGENTS.md
-- [x] Convert vm-validation.sh + perf-matrix.sh + deploy-tuned-guests.sh from guest-agent to SSH
+- [x] Run full end-to-end access validation (68/70 non-excluded at intended state)
-- [x] Rewrite bootstrap-all.sh for remaining 8 locked-out systems
+- [x] Update bootstrap-all.sh to target only remaining system (tsys-siem) [#403]
-- [x] Ban harness question-tool in meta (TSYSGroupAIOS) + project AGENTS.md
-- [x] Update Redmine #403 + Discourse #298 audit log
-- [x] Final access probe: 63/67 SSH+sudo working; 3 blocked on unrelated work

bootstrap-all.sh

@@ -12,6 +12,9 @@
 #
 # Passes AGENT_USER so agent-bootstrap.sh targets the correct unprivileged
 # user. You enter passwords interactively. Idempotent: safe to re-run.
+#
+# Verified state (access-matrix.sh, 2026-08-10): 68/70 non-excluded systems
+# at intended access state. Only tsys-siem remains below.
 set -u
 cd "$(dirname "$0")" || exit 1
 
@@ -42,33 +45,27 @@ run_with_su() {
   echo
 }
 
-# === localuser + sudo (password auth confirmed on) ===
+# === REMAINING: localuser + sudo (password auth on, key not yet pushed) ===
-echo "### localuser + sudo ###"
+echo "### Remaining system: tsys-siem ###"
 echo
 run_with_sudo tsys-siem  100.72.35.113  localuser
-run_with_sudo sectestbed-cloudron  100.97.140.105  localuser
-
-# === subodev/ultixfield + su (password auth confirmed on) ===
-echo "### subodev/ultixfield + su ###"
-echo
-run_with_su  subopi-dev-3  100.64.231.65   subodev     subodev
-run_with_su  ultix-field   100.115.233.124 ultixfield  ultixfield
 
 echo "========================================"
 echo "Done. Re-run access-matrix.sh to verify."
 echo "========================================"
 echo
-echo "CONSOLE-ONLY — sshd rejects password auth (publickey-only)."
+echo "CONSOLE-ONLY fallback — if tsys-siem rejects password auth"
-echo "Log in at the physical console (as root, or user then su/sudo)"
+echo "(publickey-only sshd), log in at the physical console (as root,"
-echo "and paste this ONE line:"
+echo "or localuser then sudo) and paste this ONE line:"
 echo
 cat <<'ONELINER'
 KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming'; for u in root localuser subodev ultixfield; do getent passwd "$u">/dev/null||continue; H=$(getent passwd "$u"|cut -d: -f6); mkdir -p "$H/.ssh"; chmod 700 "$H/.ssh"; AK="$H/.ssh/authorized_keys"; touch "$AK"; chmod 600 "$AK"; grep -qF "$KEY" "$AK"||echo "$KEY">>"$AK"; chown -R "$u": "$H/.ssh"; done; for u in localuser subodev ultixfield; do getent passwd "$u">/dev/null&&[ -d /etc/sudoers.d ]&&{ echo "$u ALL=(ALL) NOPASSWD:ALL">/etc/sudoers.d/010-agent; chmod 440 /etc/sudoers.d/010-agent; }; done; echo DONE
 ONELINER
 echo
-echo "  pfvsvrpi       (localuser)   — Raspberry Pi"
+echo "========================================"
-echo "  subopi3        (subodev)     — Raspberry Pi"
+echo "Already bootstrapped (verified SUDOOK/root-ok via access-matrix):"
-echo "  subopi-dev-4   (subodev)     — Raspberry Pi"
+echo "  devbox-cloudron, sectestbed-cloudron, subopi3, subopi-dev-3,"
+echo "  subopi-dev-4, ultix-field, pfvsvrpi (+ 60 others)"
 echo "========================================"
 echo "Deferred (separate ticket):"
 echo "  stlp-3dscanner — rename + bring online first [#417]"