org-buildout/STATUS.md

# STATUS.md — TSGCOO Orchestration Layer

> Maintained by the TSGCOO agent. Charles reads this to monitor progress.
> Last updated: 2026-08-13

## Current State

**Phase:** Bitwarden access operational. Container-based CLI (native Rust, no Node.js) deployed and verified. Agent identity provisioning unblocked on BW access — still needs Cloudron invite links and Gitea push credentials.

**Primary task:** Redmine [#442](https://projects.knownelement.com/issues/442) —
stand up first 3 AI agent identities (vp-techops, vp-secops, vp-techcompliance).

## What's Built

### This session (TSGCOO) — BW Infrastructure
- [x] **Bitwarden access operational** — container-based CLI using native Rust binary
      (no Node.js at any layer, CMMC/ITAR/STIG-friendly)
  - `docker/bw-native/Dockerfile` — minimal debian-slim + bw v2026.7.0
  - `scripts/bw-cli.sh` — host wrapper (auth lifecycle handled internally)
  - `scripts/bw-entrypoint.sh` — container entrypoint (config, login, unlock, sync)
  - `scripts/bw-install.sh` — one-command installer
  - All scripts pass shellcheck (zero warnings, including info-level)
  - Verified: `bw status` (unlocked, coo@turnsys.com @ pwvault.turnsys.com)
- [x] **Fixed `~/.config/bw/env`:** single-quoted all values (master password
      has `$` chars that shell expansion corrupted), added `BW_SERVER`
- [x] Full orientation — read all 7 planning docs, the provisioning automation,
      and the TSYSGroupAIOS template framework
- [x] AGENTS.md created for org-buildout repo (committed)
- [x] Git config set up (TSGCOO identity)
- [x] TSYSGroupAIOS framework copied from /tmp/template-test to ~/projects/TSYSGroupAIOS
- [x] **4 missing scripts built and committed:**
  - `bw-run.sh` — credential sourcing layer (replaces `~/.creds/*.env`)
  - `clone-as.sh` — per-agent git identity on clone
  - `agent-profile.sh` — sourced agent context switching (8 agents registered)
  - `bw-git-credential.sh` — git credential helper backed by Bitwarden
- [x] **BASELINE-PROMPT.md created** — the 14 canonical agent principles (was
      referenced everywhere but didn't exist)
- [x] **prereq-check.sh built** — environment readiness verifier
- [x] agent-identity-provisioning repo cloned to ~/projects/
- [x] **Code review of provisioning automation** — found and fixed critical bugs:
  - Email domain bug (tsys-cloudron.knel.net → turnsys.com) — would have failed all provisioning
  - STATE_DIR at module level (crashed --dry-run/--help)
  - IndexError on empty password_inputs list
  - State file unreachable on exception (moved to finally)
  - BW item_exists swallowing network errors as "not found" (duplicate creds)
  - Dockerfile npx install with `|| true` (silent BW CLI failure)
  - Missing .dockerignore (secrets leaking into image)
  - Added explicit cloudron_email to agents.yaml.example

### Previous agent (reachableceo)
- [x] Complete planning docs (org-buildout repo — 7 files)
- [x] Playwright provisioning automation (agent-identity-provisioning repo)
  - provision-agent.py (664 lines) — Cloudron enrollment, SSO login, API key gen
  - bw-helper.py (188 lines) — BW CLI wrapper
  - Dockerfile + docker-compose.yml
  - agents.yaml.example manifest template
- [x] TSYSGroupAIOS template framework (was at /tmp/template-test, NOT on Gitea)

## Blockers / Needs Human Input

These are the prerequisites from `tsgcoo-bootstrap-prompt.md` §4. None are met.

| # | Item | Status | Detail |
|---|---|---|---|
| 1 | **Docker group membership** | RESOLVED | TSGCOO has docker access. All 20+ containers running. |
| 2 | **Bitwarden CLI** | RESOLVED | Container-based native Rust binary deployed. `bw` on PATH via `~/.local/bin/bw` wrapper. No Node.js. |
| 3 | **BW credentials** | RESOLVED | `~/.config/bw/env` exists with single-quoted values. Verified: `coo@turnsys.com` unlocked on `pwvault.turnsys.com`. Vault is empty (new account, not yet populated). |
| 4 | **Cloudron invite links** | BLOCKED | `agents.yaml` does not exist (only `.example`). Need real invite URLs for vp-techops, vp-secops, vp-techcompliance (Q3) and optionally coo, svp-knel, svp-tctc (Q4). |
| 5 | **Gitea push credentials** | BLOCKED | Cannot push to any repo (no auth). Need either BW-sourced Gitea token or manual credential setup. |
| 6 | **Discourse admin access** | DEFERRED | Needed for VP SecOps category creation. Can be done after agent provisioning (assign to vp-techops). |

## What's Ready to Execute (once blockers resolved)

BW access is operational. The remaining blockers are:
- **Cloudron invite links** (item 4) — needed to run the provisioning pipeline
- **Gitea push credentials** (item 5) — needed to push repos to Gitea

Once item 4 is resolved:

```bash
# BW is already operational via the container wrapper
bw status   # verify access

# Fill in the manifest
cd ~/projects/agent-identity-provisioning
cp agents.yaml.example agents.yaml
# Edit: replace REPLACE_WITH_TOKEN with real Cloudron invite links

# Set BW creds for the container
cp .env.example .env
# Fill in from ~/.config/bw/env

# Build and run (provisions all Q3 agents)
docker compose up --build

# Or provision one agent at a time (recommended for first run)
docker compose run --rm provision --agent vp-techops
```

## Inbox

- TSYSGroupAIOS needs to be pushed to Gitea as a template repo (blocked on #5)
- BW migration of reachableceo's ~/.creds/ → Redmine #440 (due Aug 19)
- Cross-linking audit → Redmine #441
- Provisioning code needs code review against live Cloudron UI selectors (Q1 in questions-v1.md)
- TSYSGroupAIOS needs BASELINE-PROMPT.md (referenced everywhere, not in template)

## Repo Inventory

| Repo | Location | Commits this session | Status |
|---|---|---|---|
| org-buildout (this repo) | ~/org-buildout | 3 (AGENTS.md, STATUS.md, questions-v1.md) | Can't push (no Gitea auth) |
| agent-identity-provisioning | ~/projects/agent-identity-provisioning | 1 (critical bug fixes) | Can't push (no Gitea auth) |
| TSYSGroupAIOS | ~/projects/TSYSGroupAIOS | 5 (framework + 4 scripts + BASELINE-PROMPT.md + prereq-check.sh) | Can't push (no Gitea auth, repo doesn't exist on Gitea yet) |