status: COO C2 lane scope + incident-gated queue

BOD/CTO/CCO out of scope; TCTC deferred to founder ruling.
Queue: rulings ticket, #937/#939 updates, blocked pushes,
coo identity stand-up, TechOps staff provisioning.

STATUS.md

@@ -1,114 +1,36 @@
-# STATUS.md — TSGCOO Orchestration Layer
+# STATUS.md — COO C2 lane
 
-> Maintained by the TSGCOO agent. Charles reads this to monitor progress.
-> Last updated: 2026-08-13
+> Maintained by the COO-line agent (COO command-and-control chat).
+> Last updated: 2026-09-07
 
-## Current State
+## Scope (founder-ruled 2026-09-07)
 
-**Phase:** All four systems provisioned for vp-techops (Cloudron+2FA, Gitea, Discourse, Redmine) with verified API keys in Bitwarden. 9-agent manifest merged and READY. Session 3 will loop the remaining agents.
+- **IN:** COO line + SVP KNEL tree — TechOps, SecOps, SecEng, TechCompliance,
+  Facilities, SRE, VpEngOps — and this repo (org chart / org buildout).
+- **OUT:** BOD, CTO, CCO. Do not touch their identities, vaults, or work.
+- **DEFERRED:** TCTC — in scope later; founder rules on its structure the
+  week of 2026-09-14. Leave it alone until then.
 
-**Primary task:** Redmine [#442](https://projects.knownelement.com/issues/442) —
-stand up first 3 AI agent identities (vp-techops, vp-secops, vp-techcompliance).
+## Queue — gated on the vault/box incident
 
-## What's Built
+Vault `pwvault` authed `/api/sync` hangs (started ~20:00 CT 09-07); same box
+(152.53.37.179) hosts gitea (receive-pack 500, #937) and the my. vhost
+(MySQL root@localhost leak, #939). Another chat is fixing the cloudron box.
 
-### This session (TSGCOO) — BW Infrastructure
-- [x] **Bitwarden access operational** — container-based CLI using native Rust binary
-      (no Node.js at any layer, CMMC/ITAR/STIG-friendly)
-  - Source files **moved to KNELCredsManager repo** (staged in
-    `~/knelcredsmanager-staging/` pending clone/push — org-buildout is docs-only).
-    Deployed artifacts unaffected: image `reachableceo-bw-native:2026.7.0`,
-    `~/.local/bin/bw` wrapper, `~/.local/share/bw/entrypoint.sh`.
-  - All scripts pass shellcheck (zero warnings, including info-level)
-  - Verified: `bw status` (unlocked, coo@turnsys.com @ pwvault.turnsys.com)
-- [x] **Fixed `~/.config/bw/env`:** single-quoted all values (master password
-      has `$` chars that shell expansion corrupted), added `BW_SERVER`
-- [x] Full orientation — read all 7 planning docs, the provisioning automation,
-      and the TSYSGroupAIOS template framework
-- [x] AGENTS.md created for org-buildout repo (committed)
-- [x] Git config set up (TSGCOO identity)
-- [x] TSYSGroupAIOS framework copied from /tmp/template-test to ~/projects/TSYSGroupAIOS
-- [x] **4 missing scripts built and committed:**
-  - `bw-run.sh` — credential sourcing layer (replaces `~/.creds/*.env`)
-  - `clone-as.sh` — per-agent git identity on clone
-  - `agent-profile.sh` — sourced agent context switching (8 agents registered)
-  - `bw-git-credential.sh` — git credential helper backed by Bitwarden
-- [x] **BASELINE-PROMPT.md created** — the 14 canonical agent principles (was
-      referenced everywhere but didn't exist)
-- [x] **prereq-check.sh built** — environment readiness verifier
-- [x] agent-identity-provisioning repo cloned to ~/projects/
-- [x] **Code review of provisioning automation** — found and fixed critical bugs:
-  - Email domain bug (tsys-cloudron.knel.net → turnsys.com) — would have failed all provisioning
-  - STATE_DIR at module level (crashed --dry-run/--help)
-  - IndexError on empty password_inputs list
-  - State file unreachable on exception (moved to finally)
-  - BW item_exists swallowing network errors as "not found" (duplicate creds)
-  - Dockerfile npx install with `|| true` (silent BW CLI failure)
-  - Missing .dockerignore (secrets leaking into image)
-  - Added explicit cloudron_email to agents.yaml.example
-
-### Previous agent (reachableceo)
-- [x] Complete planning docs (org-buildout repo — 7 files)
-- [x] Playwright provisioning automation (agent-identity-provisioning repo)
-  - provision-agent.py (664 lines) — Cloudron enrollment, SSO login, API key gen
-  - bw-helper.py (188 lines) — BW CLI wrapper
-  - Dockerfile + docker-compose.yml
-  - agents.yaml.example manifest template
-- [x] TSYSGroupAIOS template framework (was at /tmp/template-test, NOT on Gitea)
-
-## Blockers / Needs Human Input
-
-These are the prerequisites from `tsgcoo-bootstrap-prompt.md` §4. None are met.
-
-| # | Item | Status | Detail |
-|---|---|---|---|
-| 1 | **Docker group membership** | RESOLVED | TSGCOO has docker access. All 20+ containers running. |
-| 2 | **Bitwarden CLI** | RESOLVED | Container-based native Rust binary deployed. `bw` on PATH via `~/.local/bin/bw` wrapper. No Node.js. |
-| 3 | **BW credentials** | RESOLVED | `~/.config/bw/env` exists with single-quoted values. Verified: `coo@turnsys.com` unlocked on `pwvault.turnsys.com`. Vault is empty (new account, not yet populated). |
-| 4 | **Cloudron invite links** | BLOCKED | `agents.yaml` does not exist (only `.example`). Need real invite URLs for vp-techops, vp-secops, vp-techcompliance (Q3) and optionally coo, svp-knel, svp-tctc (Q4). |
-| 5 | **Gitea push credentials** | BLOCKED | Cannot push to any repo (no auth). Need either BW-sourced Gitea token or manual credential setup. |
-| 6 | **Discourse admin access** | DEFERRED | Needed for VP SecOps category creation. Can be done after agent provisioning (assign to vp-techops). |
-
-## What's Ready to Execute (once blockers resolved)
-
-BW access is operational. The remaining blockers are:
-- **Cloudron invite links** (item 4) — needed to run the provisioning pipeline
-- **Gitea push credentials** (item 5) — needed to push repos to Gitea
-
-Once item 4 is resolved:
-
-```bash
-# BW is already operational via the container wrapper
-bw status   # verify access
-
-# Fill in the manifest
-cd ~/projects/agent-identity-provisioning
-cp agents.yaml.example agents.yaml
-# Edit: replace REPLACE_WITH_TOKEN with real Cloudron invite links
-
-# Set BW creds for the container
-cp .env.example .env
-# Fill in from ~/.config/bw/env
-
-# Build and run (provisions all Q3 agents)
-docker compose up --build
-
-# Or provision one agent at a time (recommended for first run)
-docker compose run --rm provision --agent vp-techops
-```
+1. File Redmine ticket for the 2026-09-07 org rulings; comment carries
+   commit URLs: TSYSGroupAIOS `8eb3867` (branch ic-builder/retire-creds-
+   pattern, symlink-live) + org-buildout `4669d24`.
+2. Update #937 — corrected diagnosis notes.
+3. Update #939 — correct attribution (public-box MySQL root leak is on
+   152.53.37.179, not the cloudron box); note fix-in-flight by another chat.
+4. Push blocked commits: TSYSGroupAIOS (ssh 22/29418 filtered from this
+   host), org-buildout (receive-pack 500).
+5. coo identity stand-up — founder-side asks open: gitea token mint
+   (coo-api), Redmine + Discourse account creation, glpi admin TOTP into
+   vault. Then ALL system actions switch to coo (founder directive).
+6. Stand up TechOps staff identities (techops-director, techops-manager)
+   once provisioning is possible.
 
 ## Inbox
 
-- TSYSGroupAIOS needs to be pushed to Gitea as a template repo (blocked on #5)
-- BW migration of reachableceo's ~/.creds/ → Redmine #440 (due Aug 19)
-- Cross-linking audit → Redmine #441
-- Provisioning code needs code review against live Cloudron UI selectors (Q1 in questions-v1.md)
-- TSYSGroupAIOS needs BASELINE-PROMPT.md (referenced everywhere, not in template)
-
-## Repo Inventory
-
-| Repo | Location | Commits this session | Status |
-|---|---|---|---|
-| org-buildout (this repo) | ~/org-buildout | 3 (AGENTS.md, STATUS.md, questions-v1.md) | Can't push (no Gitea auth) |
-| agent-identity-provisioning | ~/projects/agent-identity-provisioning | 1 (critical bug fixes) | Can't push (no Gitea auth) |
-| TSYSGroupAIOS | ~/projects/TSYSGroupAIOS | 5 (framework + 4 scripts + BASELINE-PROMPT.md + prereq-check.sh) | Can't push (no Gitea auth, repo doesn't exist on Gitea yet) |
+- (empty)