Commit Graph
15 Commits
Author SHA1 Message Date
TSYS Group COO 4669d2439e docs: org chart updated for 2026-09-07 founder rulings
SecOps parallel to SecEng, TechCompliance horizontal owner, EngOps
and Facilities under SVP KNEL, TechOps full staff, TCTC parked.
Redmine linkage deferred (vault sync outage); see COO C2 chat.
2026-09-07 15:58:02 -05:00
TSYS Group COO 8acb8616f0 docs: agent identity ownership — BW account tiers per council-of-four line 2026-09-07 14:51:13 -05:00
TSYS Group COO 678abc8d74 docs: legal entities — 3 TX LLCs + 3 Side Door non-profits (names TBC) 2026-09-07 14:51:13 -05:00
TSYS Group COO c702a71407 docs: H22026 business map — executive-level draft from Charles
Three C-suite lines: COO (Albert, with KNEL+TCTC as group shared
services), CTPO (Charles, Suborbital Systems + the ventures portfolio),
CCO (100% AI, the commons businesses: Side Door Group, Redwood Springs
Capital Partners, Redwood Family Office, High Flight co-ops).

Captured verbatim structure from Charles's sketch plus seed questions
for the agent org chart: AI-executive identity tier, per-business
compliance ICs (asymmetric regimes: ITAR/CMMC, 501c3/c4/PAC, RIA,
co-op), board agents, and director/IC worker-reviewer pairs.
2026-09-07 14:51:13 -05:00
TSYS Group COO 9993025645 docs: session 4 handoff — 10 identities live, org-chart rollout next 2026-09-07 14:51:13 -05:00
TSYS Group COO fa35f9a038 docs: first remote delivery via vp-techops identity, email-linkage gotcha 2026-09-07 14:51:13 -05:00
TSYS Group COO 2df2d34f81 refactor: move BW CLI source to KNELCredsManager repo
org-buildout is docs-only by its own charter; the container-based
Bitwarden CLI (Dockerfile, host wrapper, entrypoint, installer)
belongs in KNELCredsManager alongside other credential tooling.

Files staged in ~/knelcredsmanager-staging/ pending clone/push as
vp-techops. Deployed artifacts (image, ~/.local/bin/bw wrapper) are
unaffected -- they do not read from this repo at runtime.
2026-09-07 14:51:13 -05:00
TSYS Group COO 3b1a3e82a8 docs: all 9 agent invites merged, manifest fully READY for session 3 2026-09-07 14:51:13 -05:00
TSYS Group COO 1b6b12632b docs: session 3 flow -- merge invites, grant app access, loop manifest 2026-09-07 14:51:13 -05:00
TSYS Group COO 7a1ae1be07 docs: session 3 handoff -- all flows proven, loop remaining agents
Session 2 outcome: BW sync fixed, Cloudron 2FA on, all four systems
provisioned for vp-techops with verified API keys. Flows consolidated
into provision-agent.py and documented in the provisioner JOURNAL.md.

Session 3 job: populate agents.yaml invites (plus Cloudron app-access
grants) and run the manifest loop for the remaining five agents.
2026-09-07 14:51:13 -05:00
TSYS Group COO 6c7cb6bb52 docs: add resume-prompt.md for session 2 handoff
Comprehensive handoff document covering:
- What works (BW host CLI, bw_helper.py lifecycle safety)
- What's broken (container BW sync, 2FA, Redmine/Discourse SSO)
- Cloudron Pankow UI patterns (keyboard.type, role=button)
- Per-app SSO button selectors
- Mistakes from session 1 to avoid repeating
- Suggested first actions (fix BW sync before Playwright)

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
2026-09-07 14:51:13 -05:00
TSYS Group COO 6abd688ff5 chore: add AGPLv3 license, update README license section
💘 Generated with Crush

Assisted-by: Crush:glm-5.2
2026-09-07 14:51:13 -05:00
TSYS Group COO dce7164889 feat: container-based Bitwarden CLI using native Rust binary (no Node.js)
Replace the Node.js @bitwarden/cli dependency with the pre-compiled
native Rust binary (v2026.7.0) for CMMC/ITAR/STIG audit readiness.
The Node.js dependency tree was a significant attack surface that
would fail security audits.

Infrastructure:
- docker/bw-native/Dockerfile: minimal debian-slim + native bw binary
- scripts/bw-cli.sh: host wrapper handling full auth lifecycle
  (config, API-key login, unlock, sync) inside the container
- scripts/bw-entrypoint.sh: container entrypoint for auth lifecycle
- scripts/bw-install.sh: one-command installer (download, build, deploy)

Root causes fixed:
- ~/.config/bw/env values now single-quoted (master password has $
  chars that shell expansion corrupted, truncating 32→16 chars)
- Added BW_SERVER for self-hosted instance (pwvault.turnsys.com)
- Entrypoint bw config server tolerates re-run (|| true)

All scripts pass shellcheck with zero warnings including info-level.
Verified: bw status (unlocked, coo@turnsys.com), generate, list items.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
2026-09-07 14:51:13 -05:00
TSYS Group COO 2c91545c0f docs: update STATUS.md with code review results + repo inventory
Added provisioning code review findings (8 bugs found and fixed in
agent-identity-provisioning repo). Updated repo inventory to show
total commits per repo this session.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
2026-09-07 14:51:13 -05:00
TSYS Group COO fbf9a6571c docs: add STATUS.md + questions-v1.md for TSGCOO handoff
STATUS.md tracks the full state of the agent identity bootstrap: what's
built, all 6 blockers with specific remediation steps, the provisioning
execution path, and repo inventory.

questions-v1.md captures 7 questions for Charles (4 blocking, 3
non-blocking). Blocking: docker group, BW credentials, Cloudron invites,
Gitea push access.

Also adds AGENTS.md, STATUS.md, questions-v1.md to README index.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
2026-09-07 14:51:13 -05:00