# Resume Prompt — Agent Identity Provisioning (Session 3)

> **Read this entire file before doing anything.** Session 2 completed all
> four systems for vp-techops and consolidated the flows. This session loops
> the remaining agents through the manifest.

---

## Who You Are

You are the TSGCOO Crush agent (AI assistant for TSYS Group's COO). You provision
AI agent identities (Cloudron accounts, SSO, API keys) and store all credentials
in Bitwarden.

## Read First

1. `/home/TSGCOO/projects/TSYSGroupAIOS/BASELINE-PROMPT.md` (14 principles)
2. `/home/TSGCOO/projects/agent-identity-provisioning/STATUS.md`
3. `/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md` — all
   working selectors and flows are documented here

## State at Session 3 Start (2026-08-13 end of session 2)

**All flows are proven end-to-end for vp-techops and consolidated into
`provision-agent.py`:**

| System | Flow | Status |
|---|---|---|
| Cloudron | invite -> password -> TOTP 2FA | ✅ proven |
| Gitea | SSO -> token | ✅ proven |
| Discourse | SSO -> signup -> RSA User API key | ✅ proven |
| Redmine | SSO -> API key | ✅ proven |

BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine.
All keys verified via their APIs.

**Infrastructure facts:**
- Provisioner: `docker compose run --rm provision` in
  `/home/TSGCOO/projects/agent-identity-provisioning`
- Source is bind-mounted read-only — no rebuild needed for .py changes
- Container user matches host TSGCOO (1002:1002); `:latest` tag reuse is
  fine during iteration
- `bw_helper.py` syncs after login and before list — the session-1 state
  divergence bug is fixed and covered by `test_bw_persistence.py`
- Host `bw` wrapper: `export PATH="$HOME/.local/bin:$PATH"` (not in
  default PATH)

## What This Session Does

Loop the remaining agents in `agents.yaml`:

1. Charles generates Cloudron invites for: vp-secops, vp-techcompliance
   (Q3), coo, svp-knel, svp-tctc (Q4, phase1-only)
2. Fill `cloudron_invite:` URLs in `agents.yaml` (it is gitignored)
3. **Charles must grant each user app access in Cloudron** (Redmine lesson:
   OIDC shows "You do not have access" until the admin grants the app)
4. Run per agent:
   ```
   docker compose run --rm provision provision-agent.py --agent vp-secops
   ```
   Q4 agents: add `--phase1-only`
5. Idempotency: BW items short-circuit (`X already exists -- skipping`),
   so re-runs are safe

## Prereq Checklist Before Each Agent

- [ ] Invite URL in agents.yaml
- [ ] Cloudron app access granted (Gitea/Redmine/Discourse per manifest)
- [ ] BW vault has no stale items for that agent

## Known Issues (do not re-litigate)

1. **bw "native" binary is a Node.js SEA** — prints Node errors on crash.
   CMMC/ITAR zero-Node goal is not actually met. Needs a Charles decision.
2. **Gitea stale tokens** from session 1 may exist for vp-techops — cleanup
   pending (revoke all but the stored one).
3. **Repos can't be pushed** — TSGCOO has no Gitea auth yet. All commits
   are local. Wire TSGCOO's Gitea credentials when available.
4. **Discourse User API keys are user-scoped** — admin operations still
   need an admin key (assign to vp-techops per STATUS.md inbox).

## Mistakes to Avoid (carried forward)

- Never delete BW items to fix duplicates — `update_item()` in place
- One comprehensive DOM dump per page before writing selectors
  (see `_debug_dump` and JOURNAL.md patterns)
- `page.keyboard.type()` not `fill()` for Vue/Pankow forms
- `[role="button"]` not `button` for Cloudron UI
- Em dashes break Python source — use `--`
- Redmine Reset: use the DOM-traversal targeting in `provision_redmine`,
  never a generic `a:has-text("Reset")` match