Resume Prompt — Agent Identity Provisioning (Session 4)

Read this entire file before doing anything. Session 3 created all 10 agent identities. Session 4 finishes app credentials and starts the org-chart rollout (directors, IC worker/reviewer pairs, audit).

Who You Are

You are the TSGCOO Crush agent (AI assistant for TSYS Group's COO). You provision AI agent identities (Cloudron accounts, SSO, API keys) and store all credentials in Bitwarden.

Read First

/home/TSGCOO/projects/TSYSGroupAIOS/BASELINE-PROMPT.md (14 principles)
/home/TSGCOO/projects/KNEL/agent-identity-provisioning/STATUS.md — identity matrix + blockers
/home/TSGCOO/projects/KNEL/agent-identity-provisioning/docs/JOURNAL.md — all working selectors/flows

Filesystem Layout (changed session 3)

~/projects/
├── TSYSGroupAIOS/                      # governance (COO-owned)
└── KNEL/                               # all 32 KNEL repos (31 + agent-identity-provisioning)
    ├── agent-identity-provisioning/    # transferred from TSYSGroupCorporate, VP TechOps owns
    └── KNELSecretsManager/             # BW CLI container (ADR-002)

Provisioner: cd ~/projects/KNEL/agent-identity-provisioning && docker compose run --rm provision <args> Source bind-mounted read-only; no rebuild for .py changes. Host bw wrapper needs export PATH="$HOME/.local/bin:$PATH". tea login git.knownelement.com (vptechops) + global git credential helper installed — pushes from this host authenticate as vptechops.

State at Session 4 Start (2026-08-14)

10/10 identities: Cloudron enrolled + TOTP 2FA, passwords in BW. 15 BW items across 10 agents.

App credentials: vp-techops complete (Gitea/Discourse/Redmine verified). vp-secops + vp-techcompliance: Gitea done. Discourse + Redmine blocked (see STATUS.md blockers — both need Charles actions).

Session 4 Jobs

1. Finish Q3 app credentials (blocked on Charles)

Redmine: Charles grants vp-secops + vp-techcompliance app access in Cloudron (same fix as session 2's Redmine lesson)
Discourse: Charles checks Admin > Settings > "must approve users"; or approve the pending accounts (tsgstaff-coo-vpsecops, vptechcompliance)
Then re-run (idempotent): docker compose run --rm provision --agent vp-secops

2. Org chart rollout (from H22026.md)

Provision director + IC identities per the org chart once H22026.md defines them. Naming conventions to keep:

IC worker/reviewer pairs: ic--1 / ic--2 (separate identities — audit trail attribution)
Directors: director- (sign-off gates)
Audit reports to the board, NOT the COO chain (independence)
Manifest supports it: merge-invites.py normalizes names, provisioner handles any agent with systems: {} as phase1-only

3. Hermes/webhook wiring (stretch)

Charles's target: OWUI → Hermes → Linux VM, agents as Crush sessions keyed by identity. Redmine webhooks → Hermes to wake agents on ticket changes. Interim: screen -S sessions via SSH (current practice).

Known Issues (do not re-litigate)

bw "native" binary is a Node.js SEA (see KNELSecretsManager ADR-002)
vp-techops stale Gitea tokens from session 1
vptechops permissions currently broad — dial back after ownership settles
docker compose run --rm provision <args> — do NOT write provision provision-agent.py (entrypoint already runs the script)

Mistakes to Avoid (carried forward)

Never delete BW items to fix duplicates — update_item() in place
One comprehensive DOM dump per page before writing selectors
page.keyboard.type() not fill() for Vue/Pankow forms
[role="button"] not button for Cloudron UI
Em dashes break Python source — use --
After invite acceptance, goto panel root before hash navigation (setupaccount.html traps the SPA)

3.8 KiB Raw Blame History