diff --git a/resume-prompt.md b/resume-prompt.md index 056bdbb..495810d 100644 --- a/resume-prompt.md +++ b/resume-prompt.md @@ -1,8 +1,8 @@ -# Resume Prompt — Agent Identity Provisioning (Session 3) +# Resume Prompt — Agent Identity Provisioning (Session 4) -> **Read this entire file before doing anything.** Session 2 completed all -> four systems for vp-techops and consolidated the flows. This session loops -> the remaining agents through the manifest. +> **Read this entire file before doing anything.** Session 3 created all 10 +> agent identities. Session 4 finishes app credentials and starts the +> org-chart rollout (directors, IC worker/reviewer pairs, audit). --- @@ -15,121 +15,76 @@ in Bitwarden. ## Read First 1. `/home/TSGCOO/projects/TSYSGroupAIOS/BASELINE-PROMPT.md` (14 principles) -2. `/home/TSGCOO/projects/agent-identity-provisioning/STATUS.md` -3. `/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md` — all - working selectors and flows are documented here +2. `/home/TSGCOO/projects/KNEL/agent-identity-provisioning/STATUS.md` — identity matrix + blockers +3. `/home/TSGCOO/projects/KNEL/agent-identity-provisioning/docs/JOURNAL.md` — all working selectors/flows -## State at Session 3 Start (2026-08-14) - -**All flows are proven end-to-end for vp-techops and consolidated into -`provision-agent.py`:** - -| System | Flow | Status | -|---|---|---| -| Cloudron | invite -> password -> TOTP 2FA | ✅ proven | -| Gitea | SSO -> token | ✅ proven | -| Discourse | SSO -> signup -> RSA User API key | ✅ proven | -| Redmine | SSO -> API key | ✅ proven | - -**First remote delivery completed (2026-08-14):** the container-based -BW CLI moved from org-buildout to `KNEL/KNELSecretsManager` (commit -e3e5451, pushed by vp-techops, linked to the vptechops Gitea account, -with ADR-002 documenting the decision). This proved the full agent -delivery loop: TSGCOO pulls the vp-techops token from BW -> tea/git -operate as vptechops -> commit -> push -> account-linked attribution. - -**tea is configured:** login `git.knownelement.com` as vptechops. -Token sourced from BW item "vp-techops Gitea". - -**Agent git identity gotcha (fixed, do not regress):** Gitea links -commits to accounts by EMAIL. Agent registries must use the -Cloudron-issued address (`tsgstaff-coo-vptechops@turnsys.com`), not -synthetic `vp-techops@turnsys.com`. clone-as.sh and agent-profile.sh -in TSYSGroupAIOS are fixed as of c564531. - -BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine. -All keys verified via their APIs. - -**Infrastructure facts:** -- Provisioner: `docker compose run --rm provision` in - `/home/TSGCOO/projects/agent-identity-provisioning` -- Source is bind-mounted read-only — no rebuild needed for .py changes -- Container user matches host TSGCOO (1002:1002); `:latest` tag reuse is - fine during iteration -- `bw_helper.py` syncs after login and before list — the session-1 state - divergence bug is fixed and covered by `test_bw_persistence.py` -- Host `bw` wrapper: `export PATH="$HOME/.local/bin:$PATH"` (not in - default PATH) - -## What This Session Does - -Loop the remaining agents in `agents.yaml`: - -### Step 1: Merge Charles's invite file into the manifest - -Charles keeps invites in `~/cloudron-invites.txt`, one agent per line: -`agent-name,invite-url` (hyphenated names preferred; loose names like -vpsecops auto-normalize; blank lines and # comments ignored; email/ -username/displayName are extracted from the invite URL itself). +## Filesystem Layout (changed session 3) ``` -cd /home/TSGCOO/projects/agent-identity-provisioning -docker compose run --rm --entrypoint python3 \ - -v "$HOME/cloudron-invites.txt:/invites.txt:ro" \ - provision merge-invites.py -cp state/agents-merged.yaml agents.yaml +~/projects/ +├── TSYSGroupAIOS/ # governance (COO-owned) +└── KNEL/ # all 32 KNEL repos (31 + agent-identity-provisioning) + ├── agent-identity-provisioning/ # transferred from TSYSGroupCorporate, VP TechOps owns + └── KNELSecretsManager/ # BW CLI container (ADR-002) ``` -merge-invites.py SKIPS duplicate invite tokens (stale copy-paste guard) -and exits 1 while still writing the valid entries. As of session 2 end -the manifest is fully merged: all 9 agents READY (including new -vp-compliance, appended phase1-only). Re-run this step only if Charles -issues fresh invites. +Provisioner: `cd ~/projects/KNEL/agent-identity-provisioning && docker compose run --rm provision ` +Source bind-mounted read-only; no rebuild for .py changes. +Host `bw` wrapper needs `export PATH="$HOME/.local/bin:$PATH"`. +tea login `git.knownelement.com` (vptechops) + global git credential helper +installed — pushes from this host authenticate as vptechops. -### Step 2: Grant Cloudron app access +## State at Session 4 Start (2026-08-14) -For each agent with systems configured, Charles must grant the user -access to those apps in Cloudron (Redmine lesson: OIDC shows "You do -not have access" until granted). +10/10 identities: Cloudron enrolled + TOTP 2FA, passwords in BW. +15 BW items across 10 agents. -### Step 3: Provision +App credentials: vp-techops complete (Gitea/Discourse/Redmine verified). +vp-secops + vp-techcompliance: Gitea done. Discourse + Redmine blocked +(see STATUS.md blockers — both need Charles actions). -``` -docker compose run --rm provision provision-agent.py --agent vp-secops -``` -Q4 agents (coo, svp-knel, svp-tctc, vp-investing, vp-trading, -vp-compliance): add `--phase1-only` (they have systems: {} anyway). +## Session 4 Jobs -Idempotency: BW items short-circuit (`X already exists -- skipping`), -so re-runs are safe. +### 1. Finish Q3 app credentials (blocked on Charles) -## Prereq Checklist Before Each Agent +- Redmine: Charles grants vp-secops + vp-techcompliance app access in + Cloudron (same fix as session 2's Redmine lesson) +- Discourse: Charles checks Admin > Settings > "must approve users"; + or approve the pending accounts (tsgstaff-coo-vpsecops, vptechcompliance) +- Then re-run (idempotent): + `docker compose run --rm provision --agent vp-secops` -- [ ] Invite URL in agents.yaml -- [ ] Cloudron app access granted (Gitea/Redmine/Discourse per manifest) -- [ ] BW vault has no stale items for that agent +### 2. Org chart rollout (from H22026.md) + +Provision director + IC identities per the org chart once H22026.md +defines them. Naming conventions to keep: +- IC worker/reviewer pairs: ic--1 / ic--2 (separate + identities — audit trail attribution) +- Directors: director- (sign-off gates) +- Audit reports to the board, NOT the COO chain (independence) +- Manifest supports it: merge-invites.py normalizes names, provisioner + handles any agent with `systems: {}` as phase1-only + +### 3. Hermes/webhook wiring (stretch) + +Charles's target: OWUI → Hermes → Linux VM, agents as Crush sessions +keyed by identity. Redmine webhooks → Hermes to wake agents on ticket +changes. Interim: screen -S sessions via SSH (current practice). ## Known Issues (do not re-litigate) -1. **bw "native" binary is a Node.js SEA** — prints Node errors on crash. - CMMC/ITAR zero-Node goal is not actually met (documented in - KNELSecretsManager ADR-002). Needs a Charles decision. -2. **Gitea stale tokens** from session 1 may exist for vp-techops — cleanup - pending (revoke all but the stored one). -3. **org-buildout and agent-identity-provisioning are local-only** — they - live in TSYSGroupCorporate/reachableceo orgs, which vptechops cannot - see (vptechops has 31 KNEL/* repos). Options: grant vptechops access, - or push from an account that can. -4. **Discourse User API keys are user-scoped** — admin operations still - need an admin key (assign to vp-techops per STATUS.md inbox). +1. bw "native" binary is a Node.js SEA (see KNELSecretsManager ADR-002) +2. vp-techops stale Gitea tokens from session 1 +3. vptechops permissions currently broad — dial back after ownership settles +4. `docker compose run --rm provision ` — do NOT write + `provision provision-agent.py` (entrypoint already runs the script) ## Mistakes to Avoid (carried forward) - Never delete BW items to fix duplicates — `update_item()` in place - One comprehensive DOM dump per page before writing selectors - (see `_debug_dump` and JOURNAL.md patterns) - `page.keyboard.type()` not `fill()` for Vue/Pankow forms - `[role="button"]` not `button` for Cloudron UI - Em dashes break Python source — use `--` -- Redmine Reset: use the DOM-traversal targeting in `provision_redmine`, - never a generic `a:has-text("Reset")` match +- After invite acceptance, goto panel root before hash navigation + (setupaccount.html traps the SPA)