reachableceo/org-buildout
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: add STATUS.md + questions-v1.md for TSGCOO handoff

Browse Source 
STATUS.md tracks the full state of the agent identity bootstrap: what's
built, all 6 blockers with specific remediation steps, the provisioning
execution path, and repo inventory.

questions-v1.md captures 7 questions for Charles (4 blocking, 3
non-blocking). Blocking: docker group, BW credentials, Cloudron invites,
Gitea push access.

Also adds AGENTS.md, STATUS.md, questions-v1.md to README index.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
TSYS Group COO
2026-09-07 14:51:13 -05:00
parent 88a2f14415
commit fbf9a6571c
3 changed files with 179 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8
View File
@@ -23,6 +23,14 @@ My brand (@reachableceo) is about reachability and transparency. Most organizati
| [`transition-map.md`](transition-map.md) | Full transition map — current state across Redmine/Discourse/Gitea/infrastructure, Q3/Q4 timeline, risk register, open decisions |
| [`agent-identity-bootstrap.md`](agent-identity-bootstrap.md) | Agent identity provisioning plan — Cloudron enrollment, API key generation, Bitwarden credential architecture, Playwright automation design |
## Agent Resources
| File | What it covers |
|---|---|
| [`AGENTS.md`](AGENTS.md) | Orientation guide for agents working in this repo |
| [`STATUS.md`](STATUS.md) | Current state, blockers, next actions (agent-maintained) |
| [`questions-v1.md`](questions-v1.md) | Open questions for Charles (edit inline to answer) |
## Context
- **TSYS Group** is the overall organization (multiple business entities under one umbrella)
STATUS.md
+91
View File
@@ -0,0 +1,91 @@
# STATUS.md — TSGCOO Orchestration Layer
> Maintained by the TSGCOO agent. Charles reads this to monitor progress.
> Last updated: 2026-08-13
## Current State
**Phase:** Orientation complete. Environment partially set up. Agent identity
provisioning execution is BLOCKED on user-provided prerequisites.
**Primary task:** Redmine [#442](https://projects.knownelement.com/issues/442) —
stand up first 3 AI agent identities (vp-techops, vp-secops, vp-techcompliance).
## What's Built
### This session (TSGCOO)
- [x] Full orientation — read all 7 planning docs, the provisioning automation,
and the TSYSGroupAIOS template framework
- [x] AGENTS.md created for org-buildout repo (committed)
- [x] Git config set up (TSGCOO identity)
- [x] TSYSGroupAIOS framework copied from /tmp/template-test to ~/projects/TSYSGroupAIOS
- [x] **4 missing scripts built and committed:**
- `bw-run.sh` — credential sourcing layer (replaces `~/.creds/*.env`)
- `clone-as.sh` — per-agent git identity on clone
- `agent-profile.sh` — sourced agent context switching (8 agents registered)
- `bw-git-credential.sh` — git credential helper backed by Bitwarden
- [x] agent-identity-provisioning repo cloned to ~/projects/
### Previous agent (reachableceo)
- [x] Complete planning docs (org-buildout repo — 7 files)
- [x] Playwright provisioning automation (agent-identity-provisioning repo)
- provision-agent.py (664 lines) — Cloudron enrollment, SSO login, API key gen
- bw-helper.py (188 lines) — BW CLI wrapper
- Dockerfile + docker-compose.yml
- agents.yaml.example manifest template
- [x] TSYSGroupAIOS template framework (was at /tmp/template-test, NOT on Gitea)
## Blockers / Needs Human Input
These are the prerequisites from `tsgcoo-bootstrap-prompt.md` §4. None are met.
| # | Item | Status | Detail |
|---|---|---|---|
| 1 | **Docker group membership** | BLOCKED | `docker` binary exists but TSGCOO is not in the docker group. `docker info` → permission denied on socket. Fix: `sudo usermod -aG docker TSGCOO` (requires re-login). |
| 2 | **Bitwarden CLI** | BLOCKED | `bw` not installed. Needed for all credential operations. Fix: install bw CLI, or rely on the provisioning Docker container (needs docker access first). |
| 3 | **BW credentials** | BLOCKED | `~/.config/bw/env` does not exist. Need BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD for the dedicated COO BW account. |
| 4 | **Cloudron invite links** | BLOCKED | `agents.yaml` does not exist (only `.example`). Need real invite URLs for vp-techops, vp-secops, vp-techcompliance (Q3) and optionally coo, svp-knel, svp-tctc (Q4). |
| 5 | **Gitea push credentials** | BLOCKED | Cannot push to any repo (no auth). Need either BW-sourced Gitea token or manual credential setup. |
| 6 | **Discourse admin access** | DEFERRED | Needed for VP SecOps category creation. Can be done after agent provisioning (assign to vp-techops). |
## What's Ready to Execute (once blockers resolved)
The provisioning pipeline is ready. Once items 1-5 are resolved:
```bash
# 1. Log into Bitwarden
. ~/.config/bw/env
bw login --apikey
export BW_SESSION=$(bw unlock --raw)
# 2. Fill in the manifest
cd ~/projects/agent-identity-provisioning
cp agents.yaml.example agents.yaml
# Edit: replace REPLACE_WITH_TOKEN with real Cloudron invite links
# 3. Set BW creds for the container
cp .env.example .env
# Fill in BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD
# 4. Build and run (provisions all Q3 agents)
docker compose up --build
# Or provision one agent at a time (recommended for first run)
docker compose run --rm provision --agent vp-techops
```
## Inbox
- TSYSGroupAIOS needs to be pushed to Gitea as a template repo (blocked on #5)
- BW migration of reachableceo's ~/.creds/ → Redmine #440 (due Aug 19)
- Cross-linking audit → Redmine #441
- Provisioning code needs code review against live Cloudron UI selectors (Q1 in questions-v1.md)
- TSYSGroupAIOS needs BASELINE-PROMPT.md (referenced everywhere, not in template)
## Repo Inventory
| Repo | Location | Status |
|---|---|---|
| org-buildout (this repo) | ~/org-buildout | Cloned, AGENTS.md committed, can't push |
| agent-identity-provisioning | ~/projects/agent-identity-provisioning | Cloned, not modified |
| TSYSGroupAIOS | ~/projects/TSYSGroupAIOS | Created from template + 4 new scripts, 2 commits, not pushed to Gitea |
questions-v1.md
+80
View File
@@ -0,0 +1,80 @@
# questions-v1.md — TSGCOO → Charles
> Git-tracked questions/answers/decisions. Please edit inline.
> Per prompt.md: gathering questions in a git-tracked way is imperative.
## Blocking questions (need answers before provisioning can run)
### Q1: Docker group membership
TSGCOO is not in the docker group — `docker info` fails with "permission denied
on socket". The provisioning runs entirely in Docker (Playwright container).
**Action needed:** `sudo usermod -aG docker TSGCOO` then re-login, or add TSGCOO
to the docker group another way.
**CNW:**
### Q2: Bitwarden account and credentials
The `~/.config/bw/env` file does not exist. The bootstrap prompt says it should
contain BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD for a dedicated COO BW account.
**Questions:**
- Has the dedicated "COO" Bitwarden account been created?
- Can you populate `~/.config/bw/env` with the API credentials?
**CNW:**
### Q3: Cloudron invite links
The provisioning manifest (`agents.yaml`) needs real Cloudron invite URLs.
Only the `agents.yaml.example` template exists, with `REPLACE_WITH_TOKEN` placeholders.
**Questions:**
- Have Cloudron user invites been generated for vp-techops, vp-secops,
vp-techcompliance (Q3 agents)?
- Can you paste the invite URLs so I can populate agents.yaml?
**CNW:**
### Q4: Gitea push access
I can clone public repos from Gitea but cannot push (no credentials). The
TSYSGroupAIOS framework + 4 new scripts need to be pushed to Gitea.
**Questions:**
- Should I wait for BW-based git credentials (bw-git-credential.sh)?
- Or can you provide a Gitea token for the TSGCOO identity to push with?
**CNW:**
## Non-blocking questions (can proceed without, but need answers for correctness)
### Q5: Cloudron SSO architecture (from transition-map §5, open decision #1)
Are Gitea/Discourse/Redmine Cloudron-managed (auto-SSO on first login)? Or
standalone? The provisioning code assumes Cloudron SSO auto-provisions accounts.
If SSO is NOT auto-provisioning, the provisioning flow needs adjustment.
**CNW:**
### Q6: Provisioning selectors (from agent-identity-provisioning/questions-v1.md Q1)
The Playwright automation uses generic CSS selectors for Cloudron's invite
acceptance, 2FA enrollment, and per-system API key pages. These need
verification against the live UI.
**Options:**
1. I run the provisioning with `--headed` (needs display) and iterate live
2. You provide screenshots of the Cloudron invite/2FA flow
3. We do a dry-run first and fix selectors as they fail
**Which approach do you prefer?**
**CNW:**
### Q7: BASELINE-PROMPT.md
The TSYSGroupAIOS template (from /tmp/template-test) does not contain
`BASELINE-PROMPT.md` (the 14 canonical principles). It's referenced by
tsgcoo-bootstrap-prompt.md and the provisioning repo's AGENTS.md.
**Question:** Where does BASELINE-PROMPT.md live? Should I create it based on
the principles documented in prompt.md, or does it exist somewhere I haven't
looked?
**CNW:**