vptechops
87298df1ba
Invite acceptance (verified live on 8 agents): Pankow forms need
click + keyboard.type (fill() silently no-ops), submit button is
<div role="button"> "Set up" which starts disabled until the form
is valid.
2FA enablement: fresh accounts land on setupaccount.html ("Your
account is ready") and hash navigation cannot leave that page --
load the panel root first. Also match "Set up" (forced-enrollment
screen says "Set up passkey", profile page says "Setup").
Verified in the 8-agent run: coo/svp-knel/svp-tctc/vp-investing/
vp-trading/vp-compliance enrolled with TOTP. vp-secops and
vp-techcompliance ran pre-fix and need the --enable-2fa second pass.
Agent Identity Provisioning
Playwright-based automation for provisioning AI agent identities across the TSYS Group stack: Cloudron enrollment (with 2FA), SSO login, API key generation, and Bitwarden credential storage.
Overview
Each AI agent (VP TechOps, VP SecOps, etc.) gets:
- A dedicated Cloudron user (identity root — SSO provisions everywhere)
- TOTP 2FA enrolled and stored in Bitwarden
- API keys generated in Gitea, Discourse, Redmine (stored in Bitwarden)
- All credentials owned by the agent, sourced via
bw-run.sh(no~/.creds/files)
See ~/Q3/agent-identity-bootstrap.md for the full architecture.
Usage
# 1. Create the manifest from the example
cp agents.yaml.example agents.yaml
# Edit: add Cloudron invite links for each agent
# 2. Set BW credentials
export BW_CLIENTID="..."
export BW_CLIENTSECRET="..."
# 3. Build and run
docker compose up --build
# Or run a single agent
docker compose run --rm provision --agent vp-techops
Manifest format
See agents.yaml.example. Each agent defines:
- Cloudron invite link
- Display name
- Priority (Q3 vs Q4)
- System scopes (Redmine projects, Gitea orgs, Discourse categories)