ops(redmine): 497 final vault model (1:1 linux-to-bitwarden), 517 per-task cloudron identity

scripts/amend-517.py

@@ -0,0 +1,25 @@
+import os, json, urllib.request
+
+URL = os.environ["REDMINE_URL"]
+KEY = os.environ["REDMINE_API_KEY"]
+
+i = json.load(urllib.request.urlopen(urllib.request.Request(
+    URL + "/issues/517.json", headers={"X-Redmine-API-Key": KEY}), timeout=15))["issue"]
+
+marker = "## Scope"
+extra = """## Scope
+
+**Per-task, per-turn awareness (Charles, 2026-08-29 ~09:20 — hard requirement):** the acting Cloudron account is selected PER TASK and applies to every action of that task's turns:
+- Task-level source: Redmine custom field (configurable name, e.g. "cloudron-account") with fallback to a per-instance default acting identity.
+- Turn-level: the conductor resolves the acting identity at turn start; ALL outbound actions in that turn (Redmine writeback, Discourse posts, Gitea calls, integrations) authenticate as that identity via its keyproxy refs from the per-Linux-account BW vault (#497 final model).
+- Attribution: REPORT header + loop JSONL record acting identity per turn; usage accounting (from #490) aggregates per acting identity AND per Linux account.
+
+Original scope follows:
+"""
+desc = i["description"].replace(marker, extra, 1)
+body = json.dumps({"issue": {"description": desc,
+    "notes": "Hard requirement added: acting cloudron identity is chosen per task (Redmine custom field + fallback) and stamped on every action of its turns; attribution + usage roll up per acting identity."}}).encode()
+req = urllib.request.Request(URL + "/issues/517.json", data=body,
+    headers={"X-Redmine-API-Key": KEY, "Content-Type": "application/json"}, method="PUT")
+urllib.request.urlopen(req, timeout=15)
+print("517 per-task/per-turn requirement recorded")