Files

T

TSYS Group COO 7a1ae1be07 docs: session 3 handoff -- all flows proven, loop remaining agents

Session 2 outcome: BW sync fixed, Cloudron 2FA on, all four systems
provisioned for vp-techops with verified API keys. Flows consolidated
into provision-agent.py and documented in the provisioner JOURNAL.md.

Session 3 job: populate agents.yaml invites (plus Cloudron app-access
grants) and run the manifest loop for the remaining five agents.

2026-09-07 14:51:13 -05:00

3.6 KiB

Raw Blame History

Resume Prompt — Agent Identity Provisioning (Session 3)

Read this entire file before doing anything. Session 2 completed all four systems for vp-techops and consolidated the flows. This session loops the remaining agents through the manifest.

Who You Are

You are the TSGCOO Crush agent (AI assistant for TSYS Group's COO). You provision AI agent identities (Cloudron accounts, SSO, API keys) and store all credentials in Bitwarden.

Read First

/home/TSGCOO/projects/TSYSGroupAIOS/BASELINE-PROMPT.md (14 principles)
/home/TSGCOO/projects/agent-identity-provisioning/STATUS.md
/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md — all working selectors and flows are documented here

State at Session 3 Start (2026-08-13 end of session 2)

All flows are proven end-to-end for vp-techops and consolidated into provision-agent.py:

System	Flow	Status
Cloudron	invite -> password -> TOTP 2FA	✅ proven
Gitea	SSO -> token	✅ proven
Discourse	SSO -> signup -> RSA User API key	✅ proven
Redmine	SSO -> API key	✅ proven

BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine. All keys verified via their APIs.

Infrastructure facts:

Provisioner: docker compose run --rm provision in /home/TSGCOO/projects/agent-identity-provisioning
Source is bind-mounted read-only — no rebuild needed for .py changes
Container user matches host TSGCOO (1002:1002); :latest tag reuse is fine during iteration
bw_helper.py syncs after login and before list — the session-1 state divergence bug is fixed and covered by test_bw_persistence.py
Host bw wrapper: export PATH="$HOME/.local/bin:$PATH" (not in default PATH)

What This Session Does

Loop the remaining agents in agents.yaml:

Charles generates Cloudron invites for: vp-secops, vp-techcompliance (Q3), coo, svp-knel, svp-tctc (Q4, phase1-only)
Fill cloudron_invite: URLs in agents.yaml (it is gitignored)
Charles must grant each user app access in Cloudron (Redmine lesson: OIDC shows "You do not have access" until the admin grants the app)

Run per agent:

docker compose run --rm provision provision-agent.py --agent vp-secops

Q4 agents: add --phase1-only

Idempotency: BW items short-circuit (X already exists -- skipping), so re-runs are safe

Prereq Checklist Before Each Agent

Invite URL in agents.yaml
Cloudron app access granted (Gitea/Redmine/Discourse per manifest)
BW vault has no stale items for that agent

Known Issues (do not re-litigate)

bw "native" binary is a Node.js SEA — prints Node errors on crash. CMMC/ITAR zero-Node goal is not actually met. Needs a Charles decision.
Gitea stale tokens from session 1 may exist for vp-techops — cleanup pending (revoke all but the stored one).
Repos can't be pushed — TSGCOO has no Gitea auth yet. All commits are local. Wire TSGCOO's Gitea credentials when available.
Discourse User API keys are user-scoped — admin operations still need an admin key (assign to vp-techops per STATUS.md inbox).

Mistakes to Avoid (carried forward)

Never delete BW items to fix duplicates — update_item() in place
One comprehensive DOM dump per page before writing selectors (see _debug_dump and JOURNAL.md patterns)
page.keyboard.type() not fill() for Vue/Pankow forms
[role="button"] not button for Cloudron UI
Em dashes break Python source — use --
Redmine Reset: use the DOM-traversal targeting in provision_redmine, never a generic a:has-text("Reset") match

3.6 KiB Raw Blame History