docs: session 4 handoff — 10 identities live, org-chart rollout next
This commit is contained in:
TSYS Group COO
+54
-99
@@ -1,8 +1,8 @@
|
||||
# Resume Prompt — Agent Identity Provisioning (Session 3)
|
||||
# Resume Prompt — Agent Identity Provisioning (Session 4)
|
||||
|
||||
> **Read this entire file before doing anything.** Session 2 completed all
|
||||
> four systems for vp-techops and consolidated the flows. This session loops
|
||||
> the remaining agents through the manifest.
|
||||
> **Read this entire file before doing anything.** Session 3 created all 10
|
||||
> agent identities. Session 4 finishes app credentials and starts the
|
||||
> org-chart rollout (directors, IC worker/reviewer pairs, audit).
|
||||
|
||||
---
|
||||
|
||||
@@ -15,121 +15,76 @@ in Bitwarden.
|
||||
## Read First
|
||||
|
||||
1. `/home/TSGCOO/projects/TSYSGroupAIOS/BASELINE-PROMPT.md` (14 principles)
|
||||
2. `/home/TSGCOO/projects/agent-identity-provisioning/STATUS.md`
|
||||
3. `/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md` — all
|
||||
working selectors and flows are documented here
|
||||
2. `/home/TSGCOO/projects/KNEL/agent-identity-provisioning/STATUS.md` — identity matrix + blockers
|
||||
3. `/home/TSGCOO/projects/KNEL/agent-identity-provisioning/docs/JOURNAL.md` — all working selectors/flows
|
||||
|
||||
## State at Session 3 Start (2026-08-14)
|
||||
|
||||
**All flows are proven end-to-end for vp-techops and consolidated into
|
||||
`provision-agent.py`:**
|
||||
|
||||
| System | Flow | Status |
|
||||
|---|---|---|
|
||||
| Cloudron | invite -> password -> TOTP 2FA | ✅ proven |
|
||||
| Gitea | SSO -> token | ✅ proven |
|
||||
| Discourse | SSO -> signup -> RSA User API key | ✅ proven |
|
||||
| Redmine | SSO -> API key | ✅ proven |
|
||||
|
||||
**First remote delivery completed (2026-08-14):** the container-based
|
||||
BW CLI moved from org-buildout to `KNEL/KNELSecretsManager` (commit
|
||||
e3e5451, pushed by vp-techops, linked to the vptechops Gitea account,
|
||||
with ADR-002 documenting the decision). This proved the full agent
|
||||
delivery loop: TSGCOO pulls the vp-techops token from BW -> tea/git
|
||||
operate as vptechops -> commit -> push -> account-linked attribution.
|
||||
|
||||
**tea is configured:** login `git.knownelement.com` as vptechops.
|
||||
Token sourced from BW item "vp-techops Gitea".
|
||||
|
||||
**Agent git identity gotcha (fixed, do not regress):** Gitea links
|
||||
commits to accounts by EMAIL. Agent registries must use the
|
||||
Cloudron-issued address (`tsgstaff-coo-vptechops@turnsys.com`), not
|
||||
synthetic `vp-techops@turnsys.com`. clone-as.sh and agent-profile.sh
|
||||
in TSYSGroupAIOS are fixed as of c564531.
|
||||
|
||||
BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine.
|
||||
All keys verified via their APIs.
|
||||
|
||||
**Infrastructure facts:**
|
||||
- Provisioner: `docker compose run --rm provision` in
|
||||
`/home/TSGCOO/projects/agent-identity-provisioning`
|
||||
- Source is bind-mounted read-only — no rebuild needed for .py changes
|
||||
- Container user matches host TSGCOO (1002:1002); `:latest` tag reuse is
|
||||
fine during iteration
|
||||
- `bw_helper.py` syncs after login and before list — the session-1 state
|
||||
divergence bug is fixed and covered by `test_bw_persistence.py`
|
||||
- Host `bw` wrapper: `export PATH="$HOME/.local/bin:$PATH"` (not in
|
||||
default PATH)
|
||||
|
||||
## What This Session Does
|
||||
|
||||
Loop the remaining agents in `agents.yaml`:
|
||||
|
||||
### Step 1: Merge Charles's invite file into the manifest
|
||||
|
||||
Charles keeps invites in `~/cloudron-invites.txt`, one agent per line:
|
||||
`agent-name,invite-url` (hyphenated names preferred; loose names like
|
||||
vpsecops auto-normalize; blank lines and # comments ignored; email/
|
||||
username/displayName are extracted from the invite URL itself).
|
||||
## Filesystem Layout (changed session 3)
|
||||
|
||||
```
|
||||
cd /home/TSGCOO/projects/agent-identity-provisioning
|
||||
docker compose run --rm --entrypoint python3 \
|
||||
-v "$HOME/cloudron-invites.txt:/invites.txt:ro" \
|
||||
provision merge-invites.py
|
||||
cp state/agents-merged.yaml agents.yaml
|
||||
~/projects/
|
||||
├── TSYSGroupAIOS/ # governance (COO-owned)
|
||||
└── KNEL/ # all 32 KNEL repos (31 + agent-identity-provisioning)
|
||||
├── agent-identity-provisioning/ # transferred from TSYSGroupCorporate, VP TechOps owns
|
||||
└── KNELSecretsManager/ # BW CLI container (ADR-002)
|
||||
```
|
||||
|
||||
merge-invites.py SKIPS duplicate invite tokens (stale copy-paste guard)
|
||||
and exits 1 while still writing the valid entries. As of session 2 end
|
||||
the manifest is fully merged: all 9 agents READY (including new
|
||||
vp-compliance, appended phase1-only). Re-run this step only if Charles
|
||||
issues fresh invites.
|
||||
Provisioner: `cd ~/projects/KNEL/agent-identity-provisioning && docker compose run --rm provision <args>`
|
||||
Source bind-mounted read-only; no rebuild for .py changes.
|
||||
Host `bw` wrapper needs `export PATH="$HOME/.local/bin:$PATH"`.
|
||||
tea login `git.knownelement.com` (vptechops) + global git credential helper
|
||||
installed — pushes from this host authenticate as vptechops.
|
||||
|
||||
### Step 2: Grant Cloudron app access
|
||||
## State at Session 4 Start (2026-08-14)
|
||||
|
||||
For each agent with systems configured, Charles must grant the user
|
||||
access to those apps in Cloudron (Redmine lesson: OIDC shows "You do
|
||||
not have access" until granted).
|
||||
10/10 identities: Cloudron enrolled + TOTP 2FA, passwords in BW.
|
||||
15 BW items across 10 agents.
|
||||
|
||||
### Step 3: Provision
|
||||
App credentials: vp-techops complete (Gitea/Discourse/Redmine verified).
|
||||
vp-secops + vp-techcompliance: Gitea done. Discourse + Redmine blocked
|
||||
(see STATUS.md blockers — both need Charles actions).
|
||||
|
||||
```
|
||||
docker compose run --rm provision provision-agent.py --agent vp-secops
|
||||
```
|
||||
Q4 agents (coo, svp-knel, svp-tctc, vp-investing, vp-trading,
|
||||
vp-compliance): add `--phase1-only` (they have systems: {} anyway).
|
||||
## Session 4 Jobs
|
||||
|
||||
Idempotency: BW items short-circuit (`X already exists -- skipping`),
|
||||
so re-runs are safe.
|
||||
### 1. Finish Q3 app credentials (blocked on Charles)
|
||||
|
||||
## Prereq Checklist Before Each Agent
|
||||
- Redmine: Charles grants vp-secops + vp-techcompliance app access in
|
||||
Cloudron (same fix as session 2's Redmine lesson)
|
||||
- Discourse: Charles checks Admin > Settings > "must approve users";
|
||||
or approve the pending accounts (tsgstaff-coo-vpsecops, vptechcompliance)
|
||||
- Then re-run (idempotent):
|
||||
`docker compose run --rm provision --agent vp-secops`
|
||||
|
||||
- [ ] Invite URL in agents.yaml
|
||||
- [ ] Cloudron app access granted (Gitea/Redmine/Discourse per manifest)
|
||||
- [ ] BW vault has no stale items for that agent
|
||||
### 2. Org chart rollout (from H22026.md)
|
||||
|
||||
Provision director + IC identities per the org chart once H22026.md
|
||||
defines them. Naming conventions to keep:
|
||||
- IC worker/reviewer pairs: ic-<domain>-1 / ic-<domain>-2 (separate
|
||||
identities — audit trail attribution)
|
||||
- Directors: director-<domain> (sign-off gates)
|
||||
- Audit reports to the board, NOT the COO chain (independence)
|
||||
- Manifest supports it: merge-invites.py normalizes names, provisioner
|
||||
handles any agent with `systems: {}` as phase1-only
|
||||
|
||||
### 3. Hermes/webhook wiring (stretch)
|
||||
|
||||
Charles's target: OWUI → Hermes → Linux VM, agents as Crush sessions
|
||||
keyed by identity. Redmine webhooks → Hermes to wake agents on ticket
|
||||
changes. Interim: screen -S sessions via SSH (current practice).
|
||||
|
||||
## Known Issues (do not re-litigate)
|
||||
|
||||
1. **bw "native" binary is a Node.js SEA** — prints Node errors on crash.
|
||||
CMMC/ITAR zero-Node goal is not actually met (documented in
|
||||
KNELSecretsManager ADR-002). Needs a Charles decision.
|
||||
2. **Gitea stale tokens** from session 1 may exist for vp-techops — cleanup
|
||||
pending (revoke all but the stored one).
|
||||
3. **org-buildout and agent-identity-provisioning are local-only** — they
|
||||
live in TSYSGroupCorporate/reachableceo orgs, which vptechops cannot
|
||||
see (vptechops has 31 KNEL/* repos). Options: grant vptechops access,
|
||||
or push from an account that can.
|
||||
4. **Discourse User API keys are user-scoped** — admin operations still
|
||||
need an admin key (assign to vp-techops per STATUS.md inbox).
|
||||
1. bw "native" binary is a Node.js SEA (see KNELSecretsManager ADR-002)
|
||||
2. vp-techops stale Gitea tokens from session 1
|
||||
3. vptechops permissions currently broad — dial back after ownership settles
|
||||
4. `docker compose run --rm provision <args>` — do NOT write
|
||||
`provision provision-agent.py` (entrypoint already runs the script)
|
||||
|
||||
## Mistakes to Avoid (carried forward)
|
||||
|
||||
- Never delete BW items to fix duplicates — `update_item()` in place
|
||||
- One comprehensive DOM dump per page before writing selectors
|
||||
(see `_debug_dump` and JOURNAL.md patterns)
|
||||
- `page.keyboard.type()` not `fill()` for Vue/Pankow forms
|
||||
- `[role="button"]` not `button` for Cloudron UI
|
||||
- Em dashes break Python source — use `--`
|
||||
- Redmine Reset: use the DOM-traversal targeting in `provision_redmine`,
|
||||
never a generic `a:has-text("Reset")` match
|
||||
- After invite acceptance, goto panel root before hash navigation
|
||||
(setupaccount.html traps the SPA)
|
||||
|
||||
Reference in New Issue
Block a user