reachableceo/org-buildout
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: session 3 flow -- merge invites, grant app access, loop manifest

Browse Source
This commit is contained in:
TSYS Group COO
2026-09-07 14:51:13 -05:00
parent 7a1ae1be07
commit 1b6b12632b
1 changed files with 35 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resume-prompt.md
+32 -9
View File
@@ -49,18 +49,41 @@ All keys verified via their APIs.
Loop the remaining agents in `agents.yaml`: Loop the remaining agents in `agents.yaml`:
1. Charles generates Cloudron invites for: vp-secops, vp-techcompliance ### Step 1: Merge Charles's invite file into the manifest
(Q3), coo, svp-knel, svp-tctc (Q4, phase1-only)
2. Fill `cloudron_invite:` URLs in `agents.yaml` (it is gitignored) Charles keeps invites in `~/cloudron-invites.txt`, one agent per line:
3. **Charles must grant each user app access in Cloudron** (Redmine lesson: `agent-name,invite-url` (hyphenated names preferred; loose names like
OIDC shows "You do not have access" until the admin grants the app) vpsecops auto-normalize; blank lines and # comments ignored; email/
4. Run per agent: username/displayName are extracted from the invite URL itself).
```
cd /home/TSGCOO/projects/agent-identity-provisioning
docker compose run --rm --entrypoint python3 \
-v "$HOME/cloudron-invites.txt:/invites.txt:ro" \
provision merge-invites.py
cp state/agents-merged.yaml agents.yaml
```
merge-invites.py SKIPS duplicate invite tokens (stale copy-paste guard)
and exits 1 while still writing the valid entries. As of session 2 end:
svp-knel and vp-techcompliance still need real invites (Charles).
### Step 2: Grant Cloudron app access
For each agent with systems configured, Charles must grant the user
access to those apps in Cloudron (Redmine lesson: OIDC shows "You do
not have access" until granted).
### Step 3: Provision
``` ```
docker compose run --rm provision provision-agent.py --agent vp-secops docker compose run --rm provision provision-agent.py --agent vp-secops
``` ```
Q4 agents: add `--phase1-only` Q4 agents (coo, svp-knel, svp-tctc, vp-investing, vp-trading): add
5. Idempotency: BW items short-circuit (`X already exists -- skipping`), `--phase1-only` (they have systems: {} anyway).
so re-runs are safe
Idempotency: BW items short-circuit (`X already exists -- skipping`),
so re-runs are safe.
## Prereq Checklist Before Each Agent ## Prereq Checklist Before Each Agent