docs: session 3 results — 10 identities enrolled, matrix + blockers

All 10 agents enrolled in Cloudron with TOTP 2FA (vp-secops and
vp-techcompliance via the --enable-2fa second pass after the setup
page fix). Gitea tokens generated and verified for both Q3 VPs.
Remaining blockers are Charles-side: Redmine app access grants and a
Discourse signup/approval investigation.

STATUS.md

@@ -1,55 +1,52 @@
 # STATUS.md — Agent Identity Provisioning
 
-**Last updated:** 2026-08-13 (Session 2)
-**Phase:** Active development — vp-techops provisioning in progress
+**Last updated:** 2026-08-14 (Session 3)
+**Phase:** 10/10 agent identities enrolled in Cloudron with TOTP 2FA. App credentials partial.
 
-## Current State (Session 2)
+## Identity Matrix (session 3 end)
 
-### Completed
+| Agent | Cloudron | 2FA | Gitea | Discourse | Redmine |
+|---|---|---|---|---|---|
+| vp-techops | ✅ | ✅ | ✅ token+verified | ✅ user key | ✅ key verified |
+| vp-secops | ✅ | ✅ | ✅ token+verified | ❌ see blocker | ❌ see blocker |
+| vp-techcompliance | ✅ | ✅ | ✅ token+verified | ❌ see blocker | ❌ see blocker |
+| coo | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
+| svp-knel | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
+| svp-tctc | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
+| vp-investing | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
+| vp-trading | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
+| vp-compliance | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
+| vp-facilities | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
 
-- [x] **BW state sync fixed** — added `sync()` to `login()` lifecycle; 5-phase cross-container persistence test passes
-- [x] **Container UID/GID fixed** — provision user now matches host TSGCOO (1002:1002)
-- [x] **Cloudron 2FA enabled** — TOTP on vp-techops account, secret stored in BW, full round-trip verified
-- [x] **Discourse SSO + signup** — account created (username: vptechops), SSO via OpenID Connect working
-- [x] **Discourse API key** — User API key generated via RSA flow, stored in BW, verified working
-- [x] **Redmine SSO + API key** — SSO working after Charles granted Cloudron app access. API key extracted via "Show" button, verified via `X-Redmine-API-Key` header.
-- [x] **Gitea token** — stored in BW, verified working (user=vptechops, active=true)
-- [x] **BW vault** — 3 items: Cloudron (TOTP), Discourse (API key), Gitea (token)
+BW vault: 15 items across 10 agents (see JOURNAL.md session 3 table).
 
-### Blocked (needs Charles)
+## Blockers (Charles actions)
 
-(none currently)
+- **Redmine for vp-secops/vp-techcompliance**: Cloudron app access not
+  granted (OIDC bounce-back to /login, same class as session-2 Redmine fix).
+- **Discourse for vp-secops/vp-techcompliance**: OIDC email auth works and
+  the signup form appears each run (account creation not persisting).
+  Suspect the "must approve users" site setting or a signup validation
+  error -- needs a look at Discourse admin. API cannot diagnose (user
+  keys get 404 on /u/*.json).
+- **vp-techops stale Gitea tokens** from session 1 (revoke all but stored).
+- **vptechops org perms**: currently broad (admin on repos/orgs used
+  during bootstrap). Dial back once per-agent ownership is settled.
 
-### Remaining
+## Tooling State
 
-- [ ] Gitea token cleanup (multiple stale tokens may exist from session 1 iterations)
-- [ ] Integrate all flows into provision-agent.py main script
-- [ ] Provision remaining agents (vp-secops, vp-techcompliance, coo, svp-knel, svp-tctc)
+- Provisioner loop proven at scale: 8-agent batch run + cleanup pass.
+  Invite acceptance + 2FA selectors verified on all 10 identities.
+- tea configured (login `git.knownelement.com`, vptechops) + git credential
+  helper installed -- NOTE: pushes from this host authenticate as
+  vptechops globally.
+- Repo moved: KNEL/agent-identity-provisioning (transferred from
+  TSYSGroupCorporate; owned by VP TechOps). All work pushed.
 
-## BW Vault State
+## Next
 
-| Item | Username | Password | TOTP |
-|---|---|---|---|
-| vp-techops Cloudron | tsgstaff-coo-vptechops@turnsys.com | 32 chars | Enabled |
-| vp-techops Discourse | vptechops | 32-char API key | N/A |
-| vp-techops Gitea | vptechops | 40-char token | N/A |
-| vp-techops Redmine | vptechops | 40-char API key | N/A |
-
-## Key Technical Discoveries (Session 2)
-
-1. **Cloudron 2FA flow:** Profile -> Setup -> switchToTotp (Cloudron defaults to Passkey) -> extract base32 secret -> #totpTokenInput -> Enable
-2. **Cloudron OIDC TOTP field:** `#inputTotpToken` (not `#inputTotp` as previously assumed)
-3. **Discourse SSO:** Click `.login-button` -> click `button:has-text("OpenID")` in modal
-4. **Discourse User API Key:** RSA-based flow with PKCS1v15 padding (not OAEP). Response payload is JSON: `{"key":"...","nonce":"..."}`
-5. **Discourse API auth:** Use `User-Api-Key` header (not `Api-Key`)
-
-## Provisioner Container
-
-- Image: `agent-identity-provisioning-provision:latest`
-- UID/GID: 1002:1002 (matches host TSGCOO)
-- Source code mounted as read-only volumes for fast iteration
-- BW state persists via `./bw-state` bind mount + `sync()` after every login
-
-## Ticket
-
-[#442](https://projects.knownelement.com/issues/442)
+- Clear the two blockers above, then re-run
+  `docker compose run --rm provision --agent vp-secops` (idempotent).
+- Add director/IC identities to agents.yaml once H22026.md settles the
+  org chart (worker/reviewer pairs, audit independence).
+- Q4 agents: fill `systems:` blocks as their charters firm up.