ops(redmine): 497 scale+cloudron corrections, two-level identity ticket filed

2026-08-29 06:20:16 -05:00
parent 725c184511
commit b9035f28ba
3 changed files with 53 additions and 1 deletions
@@ -0,0 +1,49 @@
+import os, json, urllib.request
+
+URL = os.environ["REDMINE_URL"]
+KEY = os.environ["REDMINE_API_KEY"]
+
+cats = {c["name"]: c["id"] for c in
+        json.load(urllib.request.urlopen(urllib.request.Request(
+            URL + "/projects/MOPAC/issue_categories.json",
+            headers={"X-Redmine-API-Key": KEY}), timeout=15))["issue_categories"]}
+vers = {v["name"]: v["id"] for v in
+        json.load(urllib.request.urlopen(urllib.request.Request(
+            URL + "/projects/MOPAC/versions.json",
+            headers={"X-Redmine-API-Key": KEY}), timeout=15))["versions"]}
+print("cats:", cats, "versions:", vers)
+
+desc = """# Two-level identity model: Linux account + Cloudron accounts
+
+## Objective (Charles, 2026-08-29)
+The harness must model TWO identity levels everywhere it acts:
+- **Linux account** = runtime identity (where the daemon runs: reachableceo, TSGBOD, ..., COSWFO). Drives: state dirs, quota/usage attribution (the $200/mo breakdown is per vertical), Redmine scope, briefing rollup.
+- **Cloudron accounts** = acting identities (N per Linux account, e.g. a dozen+). All actions in TSYS systems happen via API under Cloudron SSO identities; their credentials live in per-cloudron-account Bitwarden machine accounts (#497).
+
+## Scope
+- harness.toml gains an identity section: linux account name + cloudron account map (label -> credential refs via keyproxy mpk_ placeholders, per system: redmine, discourse, gitea, linkwarden, ...).
+- Attribution stamped on every outbound action: loop JSONL + REPORT headers record linux account + cloudron identity used.
+- deploy/accounts.tsv (from #494) gains a cloudron-accounts column; installer templates the identity section.
+- Usage accounting (from #490) rolls up per linux account AND per cloudron identity.
+- keyproxy ref lookup stays instance-local; cloudron label selects the BW machine account context (#497).
+
+## Acceptance criteria
+- A turn executed under a fake 2-account config attributes actions correctly at both levels.
+- REPORT/JSONL show both identities; README documents the model.
+
+## References
+SPEC-20260829-charles-brief.md (cloudron accounts section); #497 scale amendment.
+"""
+
+body = json.dumps({"issue": {
+    "project_id": "MOPAC",
+    "subject": "Two-level identity model: Linux account (runtime) + Cloudron accounts (acting)",
+    "tracker_id": 2, "priority_id": 4,
+    "category_id": cats["Infrastructure"],
+    "fixed_version_id": vers["Production"],
+    "estimated_hours": 5,
+    "description": desc}}).encode()
+req = urllib.request.Request(URL + "/issues.json", data=body,
+    headers={"X-Redmine-API-Key": KEY, "Content-Type": "application/json"}, method="POST")
+r = json.load(urllib.request.urlopen(req, timeout=15))
+print("ticket", r["issue"]["id"], "created")