# STATUS.md — Agent Identity Provisioning

**Last updated:** 2026-08-13 (Session 2)
**Phase:** Active development — vp-techops provisioning in progress

## Current State (Session 2)

### Completed

- [x] **BW state sync fixed** — added `sync()` to `login()` lifecycle; 5-phase cross-container persistence test passes
- [x] **Container UID/GID fixed** — provision user now matches host TSGCOO (1002:1002)
- [x] **Cloudron 2FA enabled** — TOTP on vp-techops account, secret stored in BW, full round-trip verified
- [x] **Discourse SSO + signup** — account created (username: vptechops), SSO via OpenID Connect working
- [x] **Discourse API key** — User API key generated via RSA flow, stored in BW, verified working
- [x] **Redmine SSO + API key** — SSO working after Charles granted Cloudron app access. API key extracted via "Show" button, verified via `X-Redmine-API-Key` header.
- [x] **Gitea token** — stored in BW, verified working (user=vptechops, active=true)
- [x] **BW vault** — 3 items: Cloudron (TOTP), Discourse (API key), Gitea (token)

### Blocked (needs Charles)

(none currently)

### Remaining

- [ ] Gitea token cleanup (multiple stale tokens may exist from session 1 iterations)
- [ ] Integrate all flows into provision-agent.py main script
- [ ] Provision remaining agents (vp-secops, vp-techcompliance, coo, svp-knel, svp-tctc)

## BW Vault State

| Item | Username | Password | TOTP |
|---|---|---|---|
| vp-techops Cloudron | tsgstaff-coo-vptechops@turnsys.com | 32 chars | Enabled |
| vp-techops Discourse | vptechops | 32-char API key | N/A |
| vp-techops Gitea | vptechops | 40-char token | N/A |
| vp-techops Redmine | vptechops | 40-char API key | N/A |

## Key Technical Discoveries (Session 2)

1. **Cloudron 2FA flow:** Profile -> Setup -> switchToTotp (Cloudron defaults to Passkey) -> extract base32 secret -> #totpTokenInput -> Enable
2. **Cloudron OIDC TOTP field:** `#inputTotpToken` (not `#inputTotp` as previously assumed)
3. **Discourse SSO:** Click `.login-button` -> click `button:has-text("OpenID")` in modal
4. **Discourse User API Key:** RSA-based flow with PKCS1v15 padding (not OAEP). Response payload is JSON: `{"key":"...","nonce":"..."}`
5. **Discourse API auth:** Use `User-Api-Key` header (not `Api-Key`)

## Provisioner Container

- Image: `agent-identity-provisioning-provision:latest`
- UID/GID: 1002:1002 (matches host TSGCOO)
- Source code mounted as read-only volumes for fast iteration
- BW state persists via `./bw-state` bind mount + `sync()` after every login

## Ticket

[#442](https://projects.knownelement.com/issues/442)