From fbf9a6571c2baef4deff08a76270a35990c2e20d Mon Sep 17 00:00:00 2001 From: TSYS Group COO Date: Thu, 13 Aug 2026 11:16:49 -0500 Subject: [PATCH] docs: add STATUS.md + questions-v1.md for TSGCOO handoff MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit STATUS.md tracks the full state of the agent identity bootstrap: what's built, all 6 blockers with specific remediation steps, the provisioning execution path, and repo inventory. questions-v1.md captures 7 questions for Charles (4 blocking, 3 non-blocking). Blocking: docker group, BW credentials, Cloudron invites, Gitea push access. Also adds AGENTS.md, STATUS.md, questions-v1.md to README index. ๐Ÿ’˜ Generated with Crush Assisted-by: Crush:glm-5.2 --- README.md | 8 +++++ STATUS.md | 91 +++++++++++++++++++++++++++++++++++++++++++++++++ questions-v1.md | 80 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 179 insertions(+) create mode 100644 STATUS.md create mode 100644 questions-v1.md diff --git a/README.md b/README.md index defadf5..8e4ea4f 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,14 @@ My brand (@reachableceo) is about reachability and transparency. Most organizati | [`transition-map.md`](transition-map.md) | Full transition map โ€” current state across Redmine/Discourse/Gitea/infrastructure, Q3/Q4 timeline, risk register, open decisions | | [`agent-identity-bootstrap.md`](agent-identity-bootstrap.md) | Agent identity provisioning plan โ€” Cloudron enrollment, API key generation, Bitwarden credential architecture, Playwright automation design | +## Agent Resources + +| File | What it covers | +|---|---| +| [`AGENTS.md`](AGENTS.md) | Orientation guide for agents working in this repo | +| [`STATUS.md`](STATUS.md) | Current state, blockers, next actions (agent-maintained) | +| [`questions-v1.md`](questions-v1.md) | Open questions for Charles (edit inline to answer) | + ## Context - **TSYS Group** is the overall organization (multiple business entities under one umbrella) diff --git a/STATUS.md b/STATUS.md new file mode 100644 index 0000000..1841535 --- /dev/null +++ b/STATUS.md @@ -0,0 +1,91 @@ +# STATUS.md โ€” TSGCOO Orchestration Layer + +> Maintained by the TSGCOO agent. Charles reads this to monitor progress. +> Last updated: 2026-08-13 + +## Current State + +**Phase:** Orientation complete. Environment partially set up. Agent identity +provisioning execution is BLOCKED on user-provided prerequisites. + +**Primary task:** Redmine [#442](https://projects.knownelement.com/issues/442) โ€” +stand up first 3 AI agent identities (vp-techops, vp-secops, vp-techcompliance). + +## What's Built + +### This session (TSGCOO) +- [x] Full orientation โ€” read all 7 planning docs, the provisioning automation, + and the TSYSGroupAIOS template framework +- [x] AGENTS.md created for org-buildout repo (committed) +- [x] Git config set up (TSGCOO identity) +- [x] TSYSGroupAIOS framework copied from /tmp/template-test to ~/projects/TSYSGroupAIOS +- [x] **4 missing scripts built and committed:** + - `bw-run.sh` โ€” credential sourcing layer (replaces `~/.creds/*.env`) + - `clone-as.sh` โ€” per-agent git identity on clone + - `agent-profile.sh` โ€” sourced agent context switching (8 agents registered) + - `bw-git-credential.sh` โ€” git credential helper backed by Bitwarden +- [x] agent-identity-provisioning repo cloned to ~/projects/ + +### Previous agent (reachableceo) +- [x] Complete planning docs (org-buildout repo โ€” 7 files) +- [x] Playwright provisioning automation (agent-identity-provisioning repo) + - provision-agent.py (664 lines) โ€” Cloudron enrollment, SSO login, API key gen + - bw-helper.py (188 lines) โ€” BW CLI wrapper + - Dockerfile + docker-compose.yml + - agents.yaml.example manifest template +- [x] TSYSGroupAIOS template framework (was at /tmp/template-test, NOT on Gitea) + +## Blockers / Needs Human Input + +These are the prerequisites from `tsgcoo-bootstrap-prompt.md` ยง4. None are met. + +| # | Item | Status | Detail | +|---|---|---|---| +| 1 | **Docker group membership** | BLOCKED | `docker` binary exists but TSGCOO is not in the docker group. `docker info` โ†’ permission denied on socket. Fix: `sudo usermod -aG docker TSGCOO` (requires re-login). | +| 2 | **Bitwarden CLI** | BLOCKED | `bw` not installed. Needed for all credential operations. Fix: install bw CLI, or rely on the provisioning Docker container (needs docker access first). | +| 3 | **BW credentials** | BLOCKED | `~/.config/bw/env` does not exist. Need BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD for the dedicated COO BW account. | +| 4 | **Cloudron invite links** | BLOCKED | `agents.yaml` does not exist (only `.example`). Need real invite URLs for vp-techops, vp-secops, vp-techcompliance (Q3) and optionally coo, svp-knel, svp-tctc (Q4). | +| 5 | **Gitea push credentials** | BLOCKED | Cannot push to any repo (no auth). Need either BW-sourced Gitea token or manual credential setup. | +| 6 | **Discourse admin access** | DEFERRED | Needed for VP SecOps category creation. Can be done after agent provisioning (assign to vp-techops). | + +## What's Ready to Execute (once blockers resolved) + +The provisioning pipeline is ready. Once items 1-5 are resolved: + +```bash +# 1. Log into Bitwarden +. ~/.config/bw/env +bw login --apikey +export BW_SESSION=$(bw unlock --raw) + +# 2. Fill in the manifest +cd ~/projects/agent-identity-provisioning +cp agents.yaml.example agents.yaml +# Edit: replace REPLACE_WITH_TOKEN with real Cloudron invite links + +# 3. Set BW creds for the container +cp .env.example .env +# Fill in BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD + +# 4. Build and run (provisions all Q3 agents) +docker compose up --build + +# Or provision one agent at a time (recommended for first run) +docker compose run --rm provision --agent vp-techops +``` + +## Inbox + +- TSYSGroupAIOS needs to be pushed to Gitea as a template repo (blocked on #5) +- BW migration of reachableceo's ~/.creds/ โ†’ Redmine #440 (due Aug 19) +- Cross-linking audit โ†’ Redmine #441 +- Provisioning code needs code review against live Cloudron UI selectors (Q1 in questions-v1.md) +- TSYSGroupAIOS needs BASELINE-PROMPT.md (referenced everywhere, not in template) + +## Repo Inventory + +| Repo | Location | Status | +|---|---|---| +| org-buildout (this repo) | ~/org-buildout | Cloned, AGENTS.md committed, can't push | +| agent-identity-provisioning | ~/projects/agent-identity-provisioning | Cloned, not modified | +| TSYSGroupAIOS | ~/projects/TSYSGroupAIOS | Created from template + 4 new scripts, 2 commits, not pushed to Gitea | diff --git a/questions-v1.md b/questions-v1.md new file mode 100644 index 0000000..8d2b675 --- /dev/null +++ b/questions-v1.md @@ -0,0 +1,80 @@ +# questions-v1.md โ€” TSGCOO โ†’ Charles + +> Git-tracked questions/answers/decisions. Please edit inline. +> Per prompt.md: gathering questions in a git-tracked way is imperative. + +## Blocking questions (need answers before provisioning can run) + +### Q1: Docker group membership +TSGCOO is not in the docker group โ€” `docker info` fails with "permission denied +on socket". The provisioning runs entirely in Docker (Playwright container). + +**Action needed:** `sudo usermod -aG docker TSGCOO` then re-login, or add TSGCOO +to the docker group another way. + +**CNW:** + +### Q2: Bitwarden account and credentials +The `~/.config/bw/env` file does not exist. The bootstrap prompt says it should +contain BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD for a dedicated COO BW account. + +**Questions:** +- Has the dedicated "COO" Bitwarden account been created? +- Can you populate `~/.config/bw/env` with the API credentials? + +**CNW:** + +### Q3: Cloudron invite links +The provisioning manifest (`agents.yaml`) needs real Cloudron invite URLs. +Only the `agents.yaml.example` template exists, with `REPLACE_WITH_TOKEN` placeholders. + +**Questions:** +- Have Cloudron user invites been generated for vp-techops, vp-secops, + vp-techcompliance (Q3 agents)? +- Can you paste the invite URLs so I can populate agents.yaml? + +**CNW:** + +### Q4: Gitea push access +I can clone public repos from Gitea but cannot push (no credentials). The +TSYSGroupAIOS framework + 4 new scripts need to be pushed to Gitea. + +**Questions:** +- Should I wait for BW-based git credentials (bw-git-credential.sh)? +- Or can you provide a Gitea token for the TSGCOO identity to push with? + +**CNW:** + +## Non-blocking questions (can proceed without, but need answers for correctness) + +### Q5: Cloudron SSO architecture (from transition-map ยง5, open decision #1) +Are Gitea/Discourse/Redmine Cloudron-managed (auto-SSO on first login)? Or +standalone? The provisioning code assumes Cloudron SSO auto-provisions accounts. +If SSO is NOT auto-provisioning, the provisioning flow needs adjustment. + +**CNW:** + +### Q6: Provisioning selectors (from agent-identity-provisioning/questions-v1.md Q1) +The Playwright automation uses generic CSS selectors for Cloudron's invite +acceptance, 2FA enrollment, and per-system API key pages. These need +verification against the live UI. + +**Options:** +1. I run the provisioning with `--headed` (needs display) and iterate live +2. You provide screenshots of the Cloudron invite/2FA flow +3. We do a dry-run first and fix selectors as they fail + +**Which approach do you prefer?** + +**CNW:** + +### Q7: BASELINE-PROMPT.md +The TSYSGroupAIOS template (from /tmp/template-test) does not contain +`BASELINE-PROMPT.md` (the 14 canonical principles). It's referenced by +tsgcoo-bootstrap-prompt.md and the provisioning repo's AGENTS.md. + +**Question:** Where does BASELINE-PROMPT.md live? Should I create it based on +the principles documented in prompt.md, or does it exist somewhere I haven't +looked? + +**CNW:**