reachableceo/org-buildout
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: session 4 handoff — 10 identities live, org-chart rollout next

Browse Source
This commit is contained in:
TSYS Group COO
2026-09-07 14:51:13 -05:00
parent fa35f9a038
commit 9993025645
1 changed files with 54 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resume-prompt.md
+54 -99
View File
@@ -1,8 +1,8 @@
# Resume Prompt — Agent Identity Provisioning (Session 3) # Resume Prompt — Agent Identity Provisioning (Session 4)
> **Read this entire file before doing anything.** Session 2 completed all > **Read this entire file before doing anything.** Session 3 created all 10
> four systems for vp-techops and consolidated the flows. This session loops > agent identities. Session 4 finishes app credentials and starts the
> the remaining agents through the manifest. > org-chart rollout (directors, IC worker/reviewer pairs, audit).
--- ---
@@ -15,121 +15,76 @@ in Bitwarden.
## Read First ## Read First
1. `/home/TSGCOO/projects/TSYSGroupAIOS/BASELINE-PROMPT.md` (14 principles) 1. `/home/TSGCOO/projects/TSYSGroupAIOS/BASELINE-PROMPT.md` (14 principles)
2. `/home/TSGCOO/projects/agent-identity-provisioning/STATUS.md` 2. `/home/TSGCOO/projects/KNEL/agent-identity-provisioning/STATUS.md` — identity matrix + blockers
3. `/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md` — all 3. `/home/TSGCOO/projects/KNEL/agent-identity-provisioning/docs/JOURNAL.md` — all working selectors/flows
working selectors and flows are documented here
## State at Session 3 Start (2026-08-14) ## Filesystem Layout (changed session 3)
**All flows are proven end-to-end for vp-techops and consolidated into
`provision-agent.py`:**
| System | Flow | Status |
|---|---|---|
| Cloudron | invite -> password -> TOTP 2FA | ✅ proven |
| Gitea | SSO -> token | ✅ proven |
| Discourse | SSO -> signup -> RSA User API key | ✅ proven |
| Redmine | SSO -> API key | ✅ proven |
**First remote delivery completed (2026-08-14):** the container-based
BW CLI moved from org-buildout to `KNEL/KNELSecretsManager` (commit
e3e5451, pushed by vp-techops, linked to the vptechops Gitea account,
with ADR-002 documenting the decision). This proved the full agent
delivery loop: TSGCOO pulls the vp-techops token from BW -> tea/git
operate as vptechops -> commit -> push -> account-linked attribution.
**tea is configured:** login `git.knownelement.com` as vptechops.
Token sourced from BW item "vp-techops Gitea".
**Agent git identity gotcha (fixed, do not regress):** Gitea links
commits to accounts by EMAIL. Agent registries must use the
Cloudron-issued address (`tsgstaff-coo-vptechops@turnsys.com`), not
synthetic `vp-techops@turnsys.com`. clone-as.sh and agent-profile.sh
in TSYSGroupAIOS are fixed as of c564531.
BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine.
All keys verified via their APIs.
**Infrastructure facts:**
- Provisioner: `docker compose run --rm provision` in
`/home/TSGCOO/projects/agent-identity-provisioning`
- Source is bind-mounted read-only — no rebuild needed for .py changes
- Container user matches host TSGCOO (1002:1002); `:latest` tag reuse is
fine during iteration
- `bw_helper.py` syncs after login and before list — the session-1 state
divergence bug is fixed and covered by `test_bw_persistence.py`
- Host `bw` wrapper: `export PATH="$HOME/.local/bin:$PATH"` (not in
default PATH)
## What This Session Does
Loop the remaining agents in `agents.yaml`:
### Step 1: Merge Charles's invite file into the manifest
Charles keeps invites in `~/cloudron-invites.txt`, one agent per line:
`agent-name,invite-url` (hyphenated names preferred; loose names like
vpsecops auto-normalize; blank lines and # comments ignored; email/
username/displayName are extracted from the invite URL itself).
``` ```
cd /home/TSGCOO/projects/agent-identity-provisioning ~/projects/
docker compose run --rm --entrypoint python3 \ ├── TSYSGroupAIOS/ # governance (COO-owned)
-v "$HOME/cloudron-invites.txt:/invites.txt:ro" \ └── KNEL/ # all 32 KNEL repos (31 + agent-identity-provisioning)
provision merge-invites.py ├── agent-identity-provisioning/ # transferred from TSYSGroupCorporate, VP TechOps owns
cp state/agents-merged.yaml agents.yaml └── KNELSecretsManager/ # BW CLI container (ADR-002)
``` ```
merge-invites.py SKIPS duplicate invite tokens (stale copy-paste guard) Provisioner: `cd ~/projects/KNEL/agent-identity-provisioning && docker compose run --rm provision <args>`
and exits 1 while still writing the valid entries. As of session 2 end Source bind-mounted read-only; no rebuild for .py changes.
the manifest is fully merged: all 9 agents READY (including new Host `bw` wrapper needs `export PATH="$HOME/.local/bin:$PATH"`.
vp-compliance, appended phase1-only). Re-run this step only if Charles tea login `git.knownelement.com` (vptechops) + global git credential helper
issues fresh invites. installed — pushes from this host authenticate as vptechops.
### Step 2: Grant Cloudron app access ## State at Session 4 Start (2026-08-14)
For each agent with systems configured, Charles must grant the user 10/10 identities: Cloudron enrolled + TOTP 2FA, passwords in BW.
access to those apps in Cloudron (Redmine lesson: OIDC shows "You do 15 BW items across 10 agents.
not have access" until granted).
### Step 3: Provision App credentials: vp-techops complete (Gitea/Discourse/Redmine verified).
vp-secops + vp-techcompliance: Gitea done. Discourse + Redmine blocked
(see STATUS.md blockers — both need Charles actions).
``` ## Session 4 Jobs
docker compose run --rm provision provision-agent.py --agent vp-secops
```
Q4 agents (coo, svp-knel, svp-tctc, vp-investing, vp-trading,
vp-compliance): add `--phase1-only` (they have systems: {} anyway).
Idempotency: BW items short-circuit (`X already exists -- skipping`), ### 1. Finish Q3 app credentials (blocked on Charles)
so re-runs are safe.
## Prereq Checklist Before Each Agent - Redmine: Charles grants vp-secops + vp-techcompliance app access in
Cloudron (same fix as session 2's Redmine lesson)
- Discourse: Charles checks Admin > Settings > "must approve users";
or approve the pending accounts (tsgstaff-coo-vpsecops, vptechcompliance)
- Then re-run (idempotent):
`docker compose run --rm provision --agent vp-secops`
- [ ] Invite URL in agents.yaml ### 2. Org chart rollout (from H22026.md)
- [ ] Cloudron app access granted (Gitea/Redmine/Discourse per manifest)
- [ ] BW vault has no stale items for that agent Provision director + IC identities per the org chart once H22026.md
defines them. Naming conventions to keep:
- IC worker/reviewer pairs: ic-<domain>-1 / ic-<domain>-2 (separate
identities — audit trail attribution)
- Directors: director-<domain> (sign-off gates)
- Audit reports to the board, NOT the COO chain (independence)
- Manifest supports it: merge-invites.py normalizes names, provisioner
handles any agent with `systems: {}` as phase1-only
### 3. Hermes/webhook wiring (stretch)
Charles's target: OWUI → Hermes → Linux VM, agents as Crush sessions
keyed by identity. Redmine webhooks → Hermes to wake agents on ticket
changes. Interim: screen -S sessions via SSH (current practice).
## Known Issues (do not re-litigate) ## Known Issues (do not re-litigate)
1. **bw "native" binary is a Node.js SEA** — prints Node errors on crash. 1. bw "native" binary is a Node.js SEA (see KNELSecretsManager ADR-002)
CMMC/ITAR zero-Node goal is not actually met (documented in 2. vp-techops stale Gitea tokens from session 1
KNELSecretsManager ADR-002). Needs a Charles decision. 3. vptechops permissions currently broad — dial back after ownership settles
2. **Gitea stale tokens** from session 1 may exist for vp-techops — cleanup 4. `docker compose run --rm provision <args>` — do NOT write
pending (revoke all but the stored one). `provision provision-agent.py` (entrypoint already runs the script)
3. **org-buildout and agent-identity-provisioning are local-only** — they
live in TSYSGroupCorporate/reachableceo orgs, which vptechops cannot
see (vptechops has 31 KNEL/* repos). Options: grant vptechops access,
or push from an account that can.
4. **Discourse User API keys are user-scoped** — admin operations still
need an admin key (assign to vp-techops per STATUS.md inbox).
## Mistakes to Avoid (carried forward) ## Mistakes to Avoid (carried forward)
- Never delete BW items to fix duplicates — `update_item()` in place - Never delete BW items to fix duplicates — `update_item()` in place
- One comprehensive DOM dump per page before writing selectors - One comprehensive DOM dump per page before writing selectors
(see `_debug_dump` and JOURNAL.md patterns)
- `page.keyboard.type()` not `fill()` for Vue/Pankow forms - `page.keyboard.type()` not `fill()` for Vue/Pankow forms
- `[role="button"]` not `button` for Cloudron UI - `[role="button"]` not `button` for Cloudron UI
- Em dashes break Python source — use `--` - Em dashes break Python source — use `--`
- Redmine Reset: use the DOM-traversal targeting in `provision_redmine`, - After invite acceptance, goto panel root before hash navigation
never a generic `a:has-text("Reset")` match (setupaccount.html traps the SPA)