KNEL/agent-identity-provisioning
5
0
Fork 0
Code Pull Requests Actions Packages Releases Activity
Files
1b8bd843d991f81c8d3d7b819fbc7c141ea86cb1
agent-identity-provisioning/STATUS.md
T
vptechops c461f85efa docs: session 3 results — 10 identities enrolled, matrix + blockers 
All 10 agents enrolled in Cloudron with TOTP 2FA (vp-secops and
vp-techcompliance via the --enable-2fa second pass after the setup
page fix). Gitea tokens generated and verified for both Q3 VPs.
Remaining blockers are Charles-side: Redmine app access grants and a
Discourse signup/approval investigation.
2026-08-14 10:44:40 -05:00

2.5 KiB
Raw Blame History

STATUS.md — Agent Identity Provisioning

Last updated: 2026-08-14 (Session 3) Phase: 10/10 agent identities enrolled in Cloudron with TOTP 2FA. App credentials partial.

Identity Matrix (session 3 end)

Agent Cloudron 2FA Gitea Discourse Redmine
vp-techops ✅ ✅ ✅ token+verified ✅ user key ✅ key verified
vp-secops ✅ ✅ ✅ token+verified ❌ see blocker ❌ see blocker
vp-techcompliance ✅ ✅ ✅ token+verified ❌ see blocker ❌ see blocker
coo ✅ ✅ Q4 phase1 Q4 phase1 Q4 phase1
svp-knel ✅ ✅ Q4 phase1 Q4 phase1 Q4 phase1
svp-tctc ✅ ✅ Q4 phase1 Q4 phase1 Q4 phase1
vp-investing ✅ ✅ Q4 phase1 Q4 phase1 Q4 phase1
vp-trading ✅ ✅ Q4 phase1 Q4 phase1 Q4 phase1
vp-compliance ✅ ✅ Q4 phase1 Q4 phase1 Q4 phase1
vp-facilities ✅ ✅ Q4 phase1 Q4 phase1 Q4 phase1

BW vault: 15 items across 10 agents (see JOURNAL.md session 3 table).

Blockers (Charles actions)

  • Redmine for vp-secops/vp-techcompliance: Cloudron app access not granted (OIDC bounce-back to /login, same class as session-2 Redmine fix).
  • Discourse for vp-secops/vp-techcompliance: OIDC email auth works and the signup form appears each run (account creation not persisting). Suspect the "must approve users" site setting or a signup validation error -- needs a look at Discourse admin. API cannot diagnose (user keys get 404 on /u/*.json).
  • vp-techops stale Gitea tokens from session 1 (revoke all but stored).
  • vptechops org perms: currently broad (admin on repos/orgs used during bootstrap). Dial back once per-agent ownership is settled.

Tooling State

  • Provisioner loop proven at scale: 8-agent batch run + cleanup pass. Invite acceptance + 2FA selectors verified on all 10 identities.
  • tea configured (login git.knownelement.com, vptechops) + git credential helper installed -- NOTE: pushes from this host authenticate as vptechops globally.
  • Repo moved: KNEL/agent-identity-provisioning (transferred from TSYSGroupCorporate; owned by VP TechOps). All work pushed.

Next

  • Clear the two blockers above, then re-run docker compose run --rm provision --agent vp-secops (idempotent).
  • Add director/IC identities to agents.yaml once H22026.md settles the org chart (worker/reviewer pairs, audit independence).
  • Q4 agents: fill systems: blocks as their charters firm up.
View Git Blame Copy Permalink