From 1b6b12632b39147e8060bd60f4b87d002f7ce255 Mon Sep 17 00:00:00 2001
From: TSYS Group COO <TSGCOO@turnsys.com>
Date: Fri, 14 Aug 2026 09:31:45 -0500
Subject: [PATCH] docs: session 3 flow -- merge invites, grant app access, loop
 manifest

---
 resume-prompt.md | 47 +++++++++++++++++++++++++++++++++++------------
 1 file changed, 35 insertions(+), 12 deletions(-)

diff --git a/resume-prompt.md b/resume-prompt.md
index d0a27cb..c4d9f94 100644
--- a/resume-prompt.md
+++ b/resume-prompt.md
@@ -49,18 +49,41 @@ All keys verified via their APIs.
 
 Loop the remaining agents in `agents.yaml`:
 
-1. Charles generates Cloudron invites for: vp-secops, vp-techcompliance
-   (Q3), coo, svp-knel, svp-tctc (Q4, phase1-only)
-2. Fill `cloudron_invite:` URLs in `agents.yaml` (it is gitignored)
-3. **Charles must grant each user app access in Cloudron** (Redmine lesson:
-   OIDC shows "You do not have access" until the admin grants the app)
-4. Run per agent:
-   ```
-   docker compose run --rm provision provision-agent.py --agent vp-secops
-   ```
-   Q4 agents: add `--phase1-only`
-5. Idempotency: BW items short-circuit (`X already exists -- skipping`),
-   so re-runs are safe
+### Step 1: Merge Charles's invite file into the manifest
+
+Charles keeps invites in `~/cloudron-invites.txt`, one agent per line:
+`agent-name,invite-url` (hyphenated names preferred; loose names like
+vpsecops auto-normalize; blank lines and # comments ignored; email/
+username/displayName are extracted from the invite URL itself).
+
+```
+cd /home/TSGCOO/projects/agent-identity-provisioning
+docker compose run --rm --entrypoint python3 \
+    -v "$HOME/cloudron-invites.txt:/invites.txt:ro" \
+    provision merge-invites.py
+cp state/agents-merged.yaml agents.yaml
+```
+
+merge-invites.py SKIPS duplicate invite tokens (stale copy-paste guard)
+and exits 1 while still writing the valid entries. As of session 2 end:
+svp-knel and vp-techcompliance still need real invites (Charles).
+
+### Step 2: Grant Cloudron app access
+
+For each agent with systems configured, Charles must grant the user
+access to those apps in Cloudron (Redmine lesson: OIDC shows "You do
+not have access" until granted).
+
+### Step 3: Provision
+
+```
+docker compose run --rm provision provision-agent.py --agent vp-secops
+```
+Q4 agents (coo, svp-knel, svp-tctc, vp-investing, vp-trading): add
+`--phase1-only` (they have systems: {} anyway).
+
+Idempotency: BW items short-circuit (`X already exists -- skipping`),
+so re-runs are safe.
 
 ## Prereq Checklist Before Each Agent