TSYS Group COO
7a1ae1be07
Session 2 outcome: BW sync fixed, Cloudron 2FA on, all four systems provisioned for vp-techops with verified API keys. Flows consolidated into provision-agent.py and documented in the provisioner JOURNAL.md. Session 3 job: populate agents.yaml invites (plus Cloudron app-access grants) and run the manifest loop for the remaining five agents.
92 lines
3.6 KiB
Markdown
92 lines
3.6 KiB
Markdown
# Resume Prompt — Agent Identity Provisioning (Session 3)
|
|
|
|
> **Read this entire file before doing anything.** Session 2 completed all
|
|
> four systems for vp-techops and consolidated the flows. This session loops
|
|
> the remaining agents through the manifest.
|
|
|
|
---
|
|
|
|
## Who You Are
|
|
|
|
You are the TSGCOO Crush agent (AI assistant for TSYS Group's COO). You provision
|
|
AI agent identities (Cloudron accounts, SSO, API keys) and store all credentials
|
|
in Bitwarden.
|
|
|
|
## Read First
|
|
|
|
1. `/home/TSGCOO/projects/TSYSGroupAIOS/BASELINE-PROMPT.md` (14 principles)
|
|
2. `/home/TSGCOO/projects/agent-identity-provisioning/STATUS.md`
|
|
3. `/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md` — all
|
|
working selectors and flows are documented here
|
|
|
|
## State at Session 3 Start (2026-08-13 end of session 2)
|
|
|
|
**All flows are proven end-to-end for vp-techops and consolidated into
|
|
`provision-agent.py`:**
|
|
|
|
| System | Flow | Status |
|
|
|---|---|---|
|
|
| Cloudron | invite -> password -> TOTP 2FA | ✅ proven |
|
|
| Gitea | SSO -> token | ✅ proven |
|
|
| Discourse | SSO -> signup -> RSA User API key | ✅ proven |
|
|
| Redmine | SSO -> API key | ✅ proven |
|
|
|
|
BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine.
|
|
All keys verified via their APIs.
|
|
|
|
**Infrastructure facts:**
|
|
- Provisioner: `docker compose run --rm provision` in
|
|
`/home/TSGCOO/projects/agent-identity-provisioning`
|
|
- Source is bind-mounted read-only — no rebuild needed for .py changes
|
|
- Container user matches host TSGCOO (1002:1002); `:latest` tag reuse is
|
|
fine during iteration
|
|
- `bw_helper.py` syncs after login and before list — the session-1 state
|
|
divergence bug is fixed and covered by `test_bw_persistence.py`
|
|
- Host `bw` wrapper: `export PATH="$HOME/.local/bin:$PATH"` (not in
|
|
default PATH)
|
|
|
|
## What This Session Does
|
|
|
|
Loop the remaining agents in `agents.yaml`:
|
|
|
|
1. Charles generates Cloudron invites for: vp-secops, vp-techcompliance
|
|
(Q3), coo, svp-knel, svp-tctc (Q4, phase1-only)
|
|
2. Fill `cloudron_invite:` URLs in `agents.yaml` (it is gitignored)
|
|
3. **Charles must grant each user app access in Cloudron** (Redmine lesson:
|
|
OIDC shows "You do not have access" until the admin grants the app)
|
|
4. Run per agent:
|
|
```
|
|
docker compose run --rm provision provision-agent.py --agent vp-secops
|
|
```
|
|
Q4 agents: add `--phase1-only`
|
|
5. Idempotency: BW items short-circuit (`X already exists -- skipping`),
|
|
so re-runs are safe
|
|
|
|
## Prereq Checklist Before Each Agent
|
|
|
|
- [ ] Invite URL in agents.yaml
|
|
- [ ] Cloudron app access granted (Gitea/Redmine/Discourse per manifest)
|
|
- [ ] BW vault has no stale items for that agent
|
|
|
|
## Known Issues (do not re-litigate)
|
|
|
|
1. **bw "native" binary is a Node.js SEA** — prints Node errors on crash.
|
|
CMMC/ITAR zero-Node goal is not actually met. Needs a Charles decision.
|
|
2. **Gitea stale tokens** from session 1 may exist for vp-techops — cleanup
|
|
pending (revoke all but the stored one).
|
|
3. **Repos can't be pushed** — TSGCOO has no Gitea auth yet. All commits
|
|
are local. Wire TSGCOO's Gitea credentials when available.
|
|
4. **Discourse User API keys are user-scoped** — admin operations still
|
|
need an admin key (assign to vp-techops per STATUS.md inbox).
|
|
|
|
## Mistakes to Avoid (carried forward)
|
|
|
|
- Never delete BW items to fix duplicates — `update_item()` in place
|
|
- One comprehensive DOM dump per page before writing selectors
|
|
(see `_debug_dump` and JOURNAL.md patterns)
|
|
- `page.keyboard.type()` not `fill()` for Vue/Pankow forms
|
|
- `[role="button"]` not `button` for Cloudron UI
|
|
- Em dashes break Python source — use `--`
|
|
- Redmine Reset: use the DOM-traversal targeting in `provision_redmine`,
|
|
never a generic `a:has-text("Reset")` match
|