# STATUS.md — Agent Identity Provisioning

**Last updated:** 2026-08-14 (Session 3)
**Phase:** 10/10 agent identities enrolled in Cloudron with TOTP 2FA. App credentials partial.

## Identity Matrix (session 3 end)

| Agent | Cloudron | 2FA | Gitea | Discourse | Redmine |
|---|---|---|---|---|---|
| vp-techops | ✅ | ✅ | ✅ token+verified | ✅ user key | ✅ key verified |
| vp-secops | ✅ | ✅ | ✅ token+verified | ❌ see blocker | ❌ see blocker |
| vp-techcompliance | ✅ | ✅ | ✅ token+verified | ❌ see blocker | ❌ see blocker |
| coo | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
| svp-knel | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
| svp-tctc | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
| vp-investing | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
| vp-trading | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
| vp-compliance | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
| vp-facilities | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |

BW vault: 15 items across 10 agents (see JOURNAL.md session 3 table).

## Blockers (Charles actions)

- **Redmine for vp-secops/vp-techcompliance**: Cloudron app access not
  granted (OIDC bounce-back to /login, same class as session-2 Redmine fix).
- **Discourse for vp-secops/vp-techcompliance**: OIDC email auth works and
  the signup form appears each run (account creation not persisting).
  Suspect the "must approve users" site setting or a signup validation
  error -- needs a look at Discourse admin. API cannot diagnose (user
  keys get 404 on /u/*.json).
- **vp-techops stale Gitea tokens** from session 1 (revoke all but stored).
- **vptechops org perms**: currently broad (admin on repos/orgs used
  during bootstrap). Dial back once per-agent ownership is settled.

## Tooling State

- Provisioner loop proven at scale: 8-agent batch run + cleanup pass.
  Invite acceptance + 2FA selectors verified on all 10 identities.
- tea configured (login `git.knownelement.com`, vptechops) + git credential
  helper installed -- NOTE: pushes from this host authenticate as
  vptechops globally.
- Repo moved: KNEL/agent-identity-provisioning (transferred from
  TSYSGroupCorporate; owned by VP TechOps). All work pushed.

## Next

- Clear the two blockers above, then re-run
  `docker compose run --rm provision --agent vp-secops` (idempotent).
- Add director/IC identities to agents.yaml once H22026.md settles the
  org chart (worker/reviewer pairs, audit independence).
- Q4 agents: fill `systems:` blocks as their charters firm up.