org-buildout/STATUS.md

STATUS.md — TSGCOO Orchestration Layer

Maintained by the TSGCOO agent. Charles reads this to monitor progress. Last updated: 2026-08-13

Current State

Phase: Orientation complete. Environment partially set up. Agent identity provisioning execution is BLOCKED on user-provided prerequisites.

Primary task: Redmine #442 — stand up first 3 AI agent identities (vp-techops, vp-secops, vp-techcompliance).

What's Built

This session (TSGCOO)

• Full orientation — read all 7 planning docs, the provisioning automation, and the TSYSGroupAIOS template framework
• AGENTS.md created for org-buildout repo (committed)
• Git config set up (TSGCOO identity)
• TSYSGroupAIOS framework copied from /tmp/template-test to ~/projects/TSYSGroupAIOS
• 4 missing scripts built and committed:
  • bw-run.sh — credential sourcing layer (replaces ~/.creds/*.env)
  • clone-as.sh — per-agent git identity on clone
  • agent-profile.sh — sourced agent context switching (8 agents registered)
  • bw-git-credential.sh — git credential helper backed by Bitwarden
• BASELINE-PROMPT.md created — the 14 canonical agent principles (was referenced everywhere but didn't exist)
• prereq-check.sh built — environment readiness verifier
• agent-identity-provisioning repo cloned to ~/projects/
• Code review of provisioning automation — found and fixed critical bugs:
  • Email domain bug (tsys-cloudron.knel.net → turnsys.com) — would have failed all provisioning
  • STATE_DIR at module level (crashed --dry-run/--help)
  • IndexError on empty password_inputs list
  • State file unreachable on exception (moved to finally)
  • BW item_exists swallowing network errors as "not found" (duplicate creds)
  • Dockerfile npx install with || true (silent BW CLI failure)
  • Missing .dockerignore (secrets leaking into image)
  • Added explicit cloudron_email to agents.yaml.example

Previous agent (reachableceo)

• Complete planning docs (org-buildout repo — 7 files)
• Playwright provisioning automation (agent-identity-provisioning repo)
  • provision-agent.py (664 lines) — Cloudron enrollment, SSO login, API key gen
  • bw-helper.py (188 lines) — BW CLI wrapper
  • Dockerfile + docker-compose.yml
  • agents.yaml.example manifest template
• TSYSGroupAIOS template framework (was at /tmp/template-test, NOT on Gitea)

Blockers / Needs Human Input

These are the prerequisites from tsgcoo-bootstrap-prompt.md §4. None are met.

#	Item	Status	Detail
1	Docker group membership	BLOCKED	docker binary exists but TSGCOO is not in the docker group. docker info → permission denied on socket. Fix: sudo usermod -aG docker TSGCOO (requires re-login).
2	Bitwarden CLI	BLOCKED	bw not installed. Needed for all credential operations. Fix: install bw CLI, or rely on the provisioning Docker container (needs docker access first).
3	BW credentials	BLOCKED	~/.config/bw/env does not exist. Need BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD for the dedicated COO BW account.
4	Cloudron invite links	BLOCKED	agents.yaml does not exist (only .example). Need real invite URLs for vp-techops, vp-secops, vp-techcompliance (Q3) and optionally coo, svp-knel, svp-tctc (Q4).
5	Gitea push credentials	BLOCKED	Cannot push to any repo (no auth). Need either BW-sourced Gitea token or manual credential setup.
6	Discourse admin access	DEFERRED	Needed for VP SecOps category creation. Can be done after agent provisioning (assign to vp-techops).

What's Ready to Execute (once blockers resolved)

The provisioning pipeline is ready. Once items 1-5 are resolved:

# 1. Log into Bitwarden
. ~/.config/bw/env
bw login --apikey
export BW_SESSION=$(bw unlock --raw)

# 2. Fill in the manifest
cd ~/projects/agent-identity-provisioning
cp agents.yaml.example agents.yaml
# Edit: replace REPLACE_WITH_TOKEN with real Cloudron invite links

# 3. Set BW creds for the container
cp .env.example .env
# Fill in BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD

# 4. Build and run (provisions all Q3 agents)
docker compose up --build

# Or provision one agent at a time (recommended for first run)
docker compose run --rm provision --agent vp-techops

Inbox

• TSYSGroupAIOS needs to be pushed to Gitea as a template repo (blocked on #5)
• BW migration of reachableceo's ~/.creds/ → Redmine #440 (due Aug 19)
• Cross-linking audit → Redmine #441
• Provisioning code needs code review against live Cloudron UI selectors (Q1 in questions-v1.md)
• TSYSGroupAIOS needs BASELINE-PROMPT.md (referenced everywhere, not in template)

Repo Inventory

Repo	Location	Commits this session	Status
org-buildout (this repo)	~/org-buildout	3 (AGENTS.md, STATUS.md, questions-v1.md)	Can't push (no Gitea auth)
agent-identity-provisioning	~/projects/agent-identity-provisioning	1 (critical bug fixes)	Can't push (no Gitea auth)
TSYSGroupAIOS	~/projects/TSYSGroupAIOS	5 (framework + 4 scripts + BASELINE-PROMPT.md + prereq-check.sh)	Can't push (no Gitea auth, repo doesn't exist on Gitea yet)