vptechops
c461f85efa
All 10 agents enrolled in Cloudron with TOTP 2FA (vp-secops and vp-techcompliance via the --enable-2fa second pass after the setup page fix). Gitea tokens generated and verified for both Q3 VPs. Remaining blockers are Charles-side: Redmine app access grants and a Discourse signup/approval investigation.
53 lines
2.5 KiB
Markdown
53 lines
2.5 KiB
Markdown
# STATUS.md — Agent Identity Provisioning
|
|
|
|
**Last updated:** 2026-08-14 (Session 3)
|
|
**Phase:** 10/10 agent identities enrolled in Cloudron with TOTP 2FA. App credentials partial.
|
|
|
|
## Identity Matrix (session 3 end)
|
|
|
|
| Agent | Cloudron | 2FA | Gitea | Discourse | Redmine |
|
|
|---|---|---|---|---|---|
|
|
| vp-techops | ✅ | ✅ | ✅ token+verified | ✅ user key | ✅ key verified |
|
|
| vp-secops | ✅ | ✅ | ✅ token+verified | ❌ see blocker | ❌ see blocker |
|
|
| vp-techcompliance | ✅ | ✅ | ✅ token+verified | ❌ see blocker | ❌ see blocker |
|
|
| coo | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
|
| svp-knel | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
|
| svp-tctc | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
|
| vp-investing | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
|
| vp-trading | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
|
| vp-compliance | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
|
| vp-facilities | ✅ | ✅ | Q4 phase1 | Q4 phase1 | Q4 phase1 |
|
|
|
|
BW vault: 15 items across 10 agents (see JOURNAL.md session 3 table).
|
|
|
|
## Blockers (Charles actions)
|
|
|
|
- **Redmine for vp-secops/vp-techcompliance**: Cloudron app access not
|
|
granted (OIDC bounce-back to /login, same class as session-2 Redmine fix).
|
|
- **Discourse for vp-secops/vp-techcompliance**: OIDC email auth works and
|
|
the signup form appears each run (account creation not persisting).
|
|
Suspect the "must approve users" site setting or a signup validation
|
|
error -- needs a look at Discourse admin. API cannot diagnose (user
|
|
keys get 404 on /u/*.json).
|
|
- **vp-techops stale Gitea tokens** from session 1 (revoke all but stored).
|
|
- **vptechops org perms**: currently broad (admin on repos/orgs used
|
|
during bootstrap). Dial back once per-agent ownership is settled.
|
|
|
|
## Tooling State
|
|
|
|
- Provisioner loop proven at scale: 8-agent batch run + cleanup pass.
|
|
Invite acceptance + 2FA selectors verified on all 10 identities.
|
|
- tea configured (login `git.knownelement.com`, vptechops) + git credential
|
|
helper installed -- NOTE: pushes from this host authenticate as
|
|
vptechops globally.
|
|
- Repo moved: KNEL/agent-identity-provisioning (transferred from
|
|
TSYSGroupCorporate; owned by VP TechOps). All work pushed.
|
|
|
|
## Next
|
|
|
|
- Clear the two blockers above, then re-run
|
|
`docker compose run --rm provision --agent vp-secops` (idempotent).
|
|
- Add director/IC identities to agents.yaml once H22026.md settles the
|
|
org chart (worker/reviewer pairs, audit independence).
|
|
- Q4 agents: fill `systems:` blocks as their charters firm up.
|