docs: first remote delivery via vp-techops identity, email-linkage gotcha

resume-prompt.md

@@ -19,7 +19,7 @@ in Bitwarden.
 3. `/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md` — all
    working selectors and flows are documented here
 
-## State at Session 3 Start (2026-08-13 end of session 2)
+## State at Session 3 Start (2026-08-14)
 
 **All flows are proven end-to-end for vp-techops and consolidated into
 `provision-agent.py`:**
@@ -31,6 +31,22 @@ in Bitwarden.
 | Discourse | SSO -> signup -> RSA User API key | ✅ proven |
 | Redmine | SSO -> API key | ✅ proven |
 
+**First remote delivery completed (2026-08-14):** the container-based
+BW CLI moved from org-buildout to `KNEL/KNELSecretsManager` (commit
+e3e5451, pushed by vp-techops, linked to the vptechops Gitea account,
+with ADR-002 documenting the decision). This proved the full agent
+delivery loop: TSGCOO pulls the vp-techops token from BW -> tea/git
+operate as vptechops -> commit -> push -> account-linked attribution.
+
+**tea is configured:** login `git.knownelement.com` as vptechops.
+Token sourced from BW item "vp-techops Gitea".
+
+**Agent git identity gotcha (fixed, do not regress):** Gitea links
+commits to accounts by EMAIL. Agent registries must use the
+Cloudron-issued address (`tsgstaff-coo-vptechops@turnsys.com`), not
+synthetic `vp-techops@turnsys.com`. clone-as.sh and agent-profile.sh
+in TSYSGroupAIOS are fixed as of c564531.
+
 BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine.
 All keys verified via their APIs.
 
@@ -96,11 +112,14 @@ so re-runs are safe.
 ## Known Issues (do not re-litigate)
 
 1. **bw "native" binary is a Node.js SEA** — prints Node errors on crash.
-   CMMC/ITAR zero-Node goal is not actually met. Needs a Charles decision.
+   CMMC/ITAR zero-Node goal is not actually met (documented in
+   KNELSecretsManager ADR-002). Needs a Charles decision.
 2. **Gitea stale tokens** from session 1 may exist for vp-techops — cleanup
    pending (revoke all but the stored one).
-3. **Repos can't be pushed** — TSGCOO has no Gitea auth yet. All commits
-   are local. Wire TSGCOO's Gitea credentials when available.
+3. **org-buildout and agent-identity-provisioning are local-only** — they
+   live in TSYSGroupCorporate/reachableceo orgs, which vptechops cannot
+   see (vptechops has 31 KNEL/* repos). Options: grant vptechops access,
+   or push from an account that can.
 4. **Discourse User API keys are user-scoped** — admin operations still
    need an admin key (assign to vp-techops per STATUS.md inbox).