docs: session 3 results — 10 identities enrolled, matrix + blockers
All 10 agents enrolled in Cloudron with TOTP 2FA (vp-secops and vp-techcompliance via the --enable-2fa second pass after the setup page fix). Gitea tokens generated and verified for both Q3 VPs. Remaining blockers are Charles-side: Redmine app access grants and a Discourse signup/approval investigation.
This commit is contained in:
@@ -1,55 +1,52 @@
|
||||
# STATUS.md — Agent Identity Provisioning
|
||||
|
||||
**Last updated:** 2026-08-13 (Session 2)
|
||||
**Phase:** Active development — vp-techops provisioning in progress
|
||||
**Last updated:** 2026-08-14 (Session 3)
|
||||
**Phase:** 10/10 agent identities enrolled in Cloudron with TOTP 2FA. App credentials partial.
|
||||
|
||||
## Current State (Session 2)
|
||||
## Identity Matrix (session 3 end)
|
||||
|
||||
### Completed
|
||||
| Agent | Cloudron | 2FA | Gitea | Discourse | Redmine |
|
||||
|---|---|---|---|---|---|
|
||||
| vp-techops | ✅ | ✅ | ✅ token+verified | ✅ user key | ✅ key verified |
|
||||
| vp-secops | ✅ | ✅ | ✅ token+verified | ❌ see blocker | ❌ see blocker |
|
||||
| vp-techcompliance | ✅ | ✅ | ✅ token+verified | ❌ see blocker | ❌ see blocker |
|
||||
| coo | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
||||
| svp-knel | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
||||
| svp-tctc | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
||||
| vp-investing | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
||||
| vp-trading | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
||||
| vp-compliance | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
||||
| vp-facilities | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
||||
|
||||
- [x] **BW state sync fixed** — added `sync()` to `login()` lifecycle; 5-phase cross-container persistence test passes
|
||||
- [x] **Container UID/GID fixed** — provision user now matches host TSGCOO (1002:1002)
|
||||
- [x] **Cloudron 2FA enabled** — TOTP on vp-techops account, secret stored in BW, full round-trip verified
|
||||
- [x] **Discourse SSO + signup** — account created (username: vptechops), SSO via OpenID Connect working
|
||||
- [x] **Discourse API key** — User API key generated via RSA flow, stored in BW, verified working
|
||||
- [x] **Redmine SSO + API key** — SSO working after Charles granted Cloudron app access. API key extracted via "Show" button, verified via `X-Redmine-API-Key` header.
|
||||
- [x] **Gitea token** — stored in BW, verified working (user=vptechops, active=true)
|
||||
- [x] **BW vault** — 3 items: Cloudron (TOTP), Discourse (API key), Gitea (token)
|
||||
BW vault: 15 items across 10 agents (see JOURNAL.md session 3 table).
|
||||
|
||||
### Blocked (needs Charles)
|
||||
## Blockers (Charles actions)
|
||||
|
||||
(none currently)
|
||||
- **Redmine for vp-secops/vp-techcompliance**: Cloudron app access not
|
||||
granted (OIDC bounce-back to /login, same class as session-2 Redmine fix).
|
||||
- **Discourse for vp-secops/vp-techcompliance**: OIDC email auth works and
|
||||
the signup form appears each run (account creation not persisting).
|
||||
Suspect the "must approve users" site setting or a signup validation
|
||||
error -- needs a look at Discourse admin. API cannot diagnose (user
|
||||
keys get 404 on /u/*.json).
|
||||
- **vp-techops stale Gitea tokens** from session 1 (revoke all but stored).
|
||||
- **vptechops org perms**: currently broad (admin on repos/orgs used
|
||||
during bootstrap). Dial back once per-agent ownership is settled.
|
||||
|
||||
### Remaining
|
||||
## Tooling State
|
||||
|
||||
- [ ] Gitea token cleanup (multiple stale tokens may exist from session 1 iterations)
|
||||
- [ ] Integrate all flows into provision-agent.py main script
|
||||
- [ ] Provision remaining agents (vp-secops, vp-techcompliance, coo, svp-knel, svp-tctc)
|
||||
- Provisioner loop proven at scale: 8-agent batch run + cleanup pass.
|
||||
Invite acceptance + 2FA selectors verified on all 10 identities.
|
||||
- tea configured (login `git.knownelement.com`, vptechops) + git credential
|
||||
helper installed -- NOTE: pushes from this host authenticate as
|
||||
vptechops globally.
|
||||
- Repo moved: KNEL/agent-identity-provisioning (transferred from
|
||||
TSYSGroupCorporate; owned by VP TechOps). All work pushed.
|
||||
|
||||
## BW Vault State
|
||||
## Next
|
||||
|
||||
| Item | Username | Password | TOTP |
|
||||
|---|---|---|---|
|
||||
| vp-techops Cloudron | tsgstaff-coo-vptechops@turnsys.com | 32 chars | Enabled |
|
||||
| vp-techops Discourse | vptechops | 32-char API key | N/A |
|
||||
| vp-techops Gitea | vptechops | 40-char token | N/A |
|
||||
| vp-techops Redmine | vptechops | 40-char API key | N/A |
|
||||
|
||||
## Key Technical Discoveries (Session 2)
|
||||
|
||||
1. **Cloudron 2FA flow:** Profile -> Setup -> switchToTotp (Cloudron defaults to Passkey) -> extract base32 secret -> #totpTokenInput -> Enable
|
||||
2. **Cloudron OIDC TOTP field:** `#inputTotpToken` (not `#inputTotp` as previously assumed)
|
||||
3. **Discourse SSO:** Click `.login-button` -> click `button:has-text("OpenID")` in modal
|
||||
4. **Discourse User API Key:** RSA-based flow with PKCS1v15 padding (not OAEP). Response payload is JSON: `{"key":"...","nonce":"..."}`
|
||||
5. **Discourse API auth:** Use `User-Api-Key` header (not `Api-Key`)
|
||||
|
||||
## Provisioner Container
|
||||
|
||||
- Image: `agent-identity-provisioning-provision:latest`
|
||||
- UID/GID: 1002:1002 (matches host TSGCOO)
|
||||
- Source code mounted as read-only volumes for fast iteration
|
||||
- BW state persists via `./bw-state` bind mount + `sync()` after every login
|
||||
|
||||
## Ticket
|
||||
|
||||
[#442](https://projects.knownelement.com/issues/442)
|
||||
- Clear the two blockers above, then re-run
|
||||
`docker compose run --rm provision --agent vp-secops` (idempotent).
|
||||
- Add director/IC identities to agents.yaml once H22026.md settles the
|
||||
org chart (worker/reviewer pairs, audit independence).
|
||||
- Q4 agents: fill `systems:` blocks as their charters firm up.
|
||||
|
||||
@@ -82,3 +82,56 @@ Override with an explicit `username:` field in agents.yaml.
|
||||
| Gitea | 40-char token | `GET /api/v1/user` -> vptechops |
|
||||
| Discourse | 32-char user key | `GET /latest.json` with User-Api-Key |
|
||||
| Redmine | 40-char API key | `GET /users/current.json` -> id 11 |
|
||||
|
||||
---
|
||||
|
||||
## 2026-08-14 — Session 3: 8 agents enrolled, repo transfer, KNEL org layout
|
||||
|
||||
**Commits:** a96990d (org-buildout), 657939d/e3e5451 (KNELSecretsManager),
|
||||
c564531 (TSYSGroupAIOS), 87298df (aip)
|
||||
|
||||
### Decisions
|
||||
|
||||
1. **Repo ownership split**: org-buildout is docs-only (BW CLI source
|
||||
moved out); BW CLI lives in KNEL/KNELSecretsManager with ADR-002;
|
||||
agent-identity-provisioning transferred TSYSGroupCorporate -> KNEL,
|
||||
owned by VP TechOps. All 31 KNEL repos cloned to ~/projects/KNEL/.
|
||||
2. **Gitea links commits to accounts by EMAIL.** Registries must use
|
||||
Cloudron-issued addresses (tsgstaff-coo-*@turnsys.com), not synthetic
|
||||
ones. Fixed in clone-as.sh/agent-profile.sh.
|
||||
3. **tea credential helper** installed globally (vptechops token) --
|
||||
clones over HTTPS work with clean URLs. NOTE: all pushes from this
|
||||
host to git.knownelement.com now authenticate as vptechops; watch
|
||||
attribution when pushing from TSGCOO-owned repos.
|
||||
|
||||
### Patterns proven this session
|
||||
|
||||
**Invite acceptance (setupaccount.html):** fields #inputDisplayName,
|
||||
#inputPassword, #inputPasswordRepeat (username prefilled). Pankow forms
|
||||
require click + keyboard.type. Submit is <div role="button"> "Set up",
|
||||
disabled until form valid.
|
||||
|
||||
**2FA on fresh accounts:** after acceptance the SPA sits on
|
||||
setupaccount.html; hash navigation cannot leave it -- goto panel root
|
||||
first. Forced-2FA screen says "Set up passkey" (profile says "Setup")
|
||||
-- match both. TOTP flow identical to session 2.
|
||||
|
||||
### Results (10 identities)
|
||||
|
||||
| Agent | Cloudron | 2FA | Gitea | Discourse | Redmine |
|
||||
|---|---|---|---|---|---|
|
||||
| vp-techops | yes | yes | token | key | key |
|
||||
| vp-secops | yes | 2nd pass | BLOCKED (no app access) | acct created, retry | BLOCKED |
|
||||
| vp-techcompliance | yes | 2nd pass | BLOCKED (no app access) | acct created, retry | BLOCKED |
|
||||
| coo/svp-knel/svp-tctc | yes | yes | - (Q4 phase1) | - | - |
|
||||
| vp-investing/vp-trading | yes | yes | - | - | - |
|
||||
| vp-compliance | yes | yes | - | - | - |
|
||||
| vp-facilities | cleanup pass | cleanup pass | - | - | - |
|
||||
|
||||
### Open items for Charles
|
||||
|
||||
- Grant Gitea/Redmine (and Discourse approval if required) app access
|
||||
for vp-secops and vp-techcompliance -- Gitea OIDC returns
|
||||
"The authorization request was denied." until granted (same class as
|
||||
the session-2 Redmine blocker).
|
||||
- vp-techops stale Gitea tokens cleanup still pending.
|
||||
|
||||
Reference in New Issue
Block a user