reachableceo/org-buildout
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: first remote delivery via vp-techops identity, email-linkage gotcha

Browse Source
This commit is contained in:
TSYS Group COO
2026-09-07 14:51:13 -05:00
parent 2df2d34f81
commit fa35f9a038
1 changed files with 23 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resume-prompt.md
+23 -4
View File
@@ -19,7 +19,7 @@ in Bitwarden.
3. `/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md` — all 3. `/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md` — all
working selectors and flows are documented here working selectors and flows are documented here
## State at Session 3 Start (2026-08-13 end of session 2) ## State at Session 3 Start (2026-08-14)
**All flows are proven end-to-end for vp-techops and consolidated into **All flows are proven end-to-end for vp-techops and consolidated into
`provision-agent.py`:** `provision-agent.py`:**
@@ -31,6 +31,22 @@ in Bitwarden.
| Discourse | SSO -> signup -> RSA User API key | ✅ proven | | Discourse | SSO -> signup -> RSA User API key | ✅ proven |
| Redmine | SSO -> API key | ✅ proven | | Redmine | SSO -> API key | ✅ proven |
**First remote delivery completed (2026-08-14):** the container-based
BW CLI moved from org-buildout to `KNEL/KNELSecretsManager` (commit
e3e5451, pushed by vp-techops, linked to the vptechops Gitea account,
with ADR-002 documenting the decision). This proved the full agent
delivery loop: TSGCOO pulls the vp-techops token from BW -> tea/git
operate as vptechops -> commit -> push -> account-linked attribution.
**tea is configured:** login `git.knownelement.com` as vptechops.
Token sourced from BW item "vp-techops Gitea".
**Agent git identity gotcha (fixed, do not regress):** Gitea links
commits to accounts by EMAIL. Agent registries must use the
Cloudron-issued address (`tsgstaff-coo-vptechops@turnsys.com`), not
synthetic `vp-techops@turnsys.com`. clone-as.sh and agent-profile.sh
in TSYSGroupAIOS are fixed as of c564531.
BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine. BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine.
All keys verified via their APIs. All keys verified via their APIs.
@@ -96,11 +112,14 @@ so re-runs are safe.
## Known Issues (do not re-litigate) ## Known Issues (do not re-litigate)
1. **bw "native" binary is a Node.js SEA** — prints Node errors on crash. 1. **bw "native" binary is a Node.js SEA** — prints Node errors on crash.
CMMC/ITAR zero-Node goal is not actually met. Needs a Charles decision. CMMC/ITAR zero-Node goal is not actually met (documented in
KNELSecretsManager ADR-002). Needs a Charles decision.
2. **Gitea stale tokens** from session 1 may exist for vp-techops — cleanup 2. **Gitea stale tokens** from session 1 may exist for vp-techops — cleanup
pending (revoke all but the stored one). pending (revoke all but the stored one).
3. **Repos can't be pushed** — TSGCOO has no Gitea auth yet. All commits 3. **org-buildout and agent-identity-provisioning are local-only** — they
are local. Wire TSGCOO's Gitea credentials when available. live in TSYSGroupCorporate/reachableceo orgs, which vptechops cannot
see (vptechops has 31 KNEL/* repos). Options: grant vptechops access,
or push from an account that can.
4. **Discourse User API keys are user-scoped** — admin operations still 4. **Discourse User API keys are user-scoped** — admin operations still
need an admin key (assign to vp-techops per STATUS.md inbox). need an admin key (assign to vp-techops per STATUS.md inbox).