agent-identity-provisioning/STATUS.md

STATUS.md — Agent Identity Provisioning

Last updated: 2026-08-13 (Session 2) Phase: Active development — vp-techops provisioning in progress

Current State (Session 2)

Completed

• BW state sync fixed — added sync() to login() lifecycle; 5-phase cross-container persistence test passes
• Container UID/GID fixed — provision user now matches host TSGCOO (1002:1002)
• Cloudron 2FA enabled — TOTP on vp-techops account, secret stored in BW, full round-trip verified
• Discourse SSO + signup — account created (username: vptechops), SSO via OpenID Connect working
• Discourse API key — User API key generated via RSA flow, stored in BW, verified working
• Gitea token — stored in BW, verified working (user=vptechops, active=true)
• BW vault — 3 items: Cloudron (TOTP), Discourse (API key), Gitea (token)

Blocked (needs Charles)

• Redmine SSO — Cloudron returns "You do not have access" when vp-techops tries OIDC to Redmine. Charles must grant Redmine app access for the vp-techops Cloudron user.
• Redmine API key — blocked by SSO above

Remaining

• Gitea token cleanup (multiple stale tokens may exist from session 1 iterations)
• Integrate Discourse/Gitea flows into provision-agent.py main script
• Provision remaining agents (vp-secops, vp-techcompliance, coo, svp-knel, svp-tctc)

BW Vault State

Item	Username	Password	TOTP
vp-techops Cloudron	tsgstaff-coo-vptechops@turnsys.com	32 chars	Enabled
vp-techops Discourse	vptechops	32-char API key	N/A
vp-techops Gitea	vptechops	40-char token	N/A

Key Technical Discoveries (Session 2)

1. Cloudron 2FA flow: Profile -> Setup -> switchToTotp (Cloudron defaults to Passkey) -> extract base32 secret -> #totpTokenInput -> Enable
2. Cloudron OIDC TOTP field: #inputTotpToken (not #inputTotp as previously assumed)
3. Discourse SSO: Click .login-button -> click button:has-text("OpenID") in modal
4. Discourse User API Key: RSA-based flow with PKCS1v15 padding (not OAEP). Response payload is JSON: {"key":"...","nonce":"..."}
5. Discourse API auth: Use User-Api-Key header (not Api-Key)

Provisioner Container

• Image: agent-identity-provisioning-provision:latest
• UID/GID: 1002:1002 (matches host TSGCOO)
• Source code mounted as read-only volumes for fast iteration
• BW state persists via ./bw-state bind mount + sync() after every login

Ticket

#442