TSYS Group COO
dce7164889
Replace the Node.js @bitwarden/cli dependency with the pre-compiled native Rust binary (v2026.7.0) for CMMC/ITAR/STIG audit readiness. The Node.js dependency tree was a significant attack surface that would fail security audits. Infrastructure: - docker/bw-native/Dockerfile: minimal debian-slim + native bw binary - scripts/bw-cli.sh: host wrapper handling full auth lifecycle (config, API-key login, unlock, sync) inside the container - scripts/bw-entrypoint.sh: container entrypoint for auth lifecycle - scripts/bw-install.sh: one-command installer (download, build, deploy) Root causes fixed: - ~/.config/bw/env values now single-quoted (master password has $ chars that shell expansion corrupted, truncating 32→16 chars) - Added BW_SERVER for self-hosted instance (pwvault.turnsys.com) - Entrypoint bw config server tolerates re-run (|| true) All scripts pass shellcheck with zero warnings including info-level. Verified: bw status (unlocked, coo@turnsys.com), generate, list items. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
org-buildout
Building an AI-native organization — shared transparently as a bootstrapping reference.
This repository documents the full thought process behind TSYS Group's transition from a solo-founder operating model to an AI-agent-augmented organization. It captures the planning, architecture decisions, and operational design work behind:
- COO → CTO transition — delegating operations to AI agents + a human COO
- AI agent identity architecture — Cloudron SSO, Bitwarden credential management, per-agent RBAC
- Infrastructure buildout — Proxmox fleet, k8s cluster, monitoring, zero-trust networking
- Security/compliance targets — CMMC L3, STIG, ITAR, zero trust
Why public?
My brand (@reachableceo) is about reachability and transparency. Most organizations hide their internal operations. I'm sharing the full process — the messy early stages, the planning docs, the architecture decisions — because I believe the future of work involves AI agents as first-class organizational members, and showing how that gets built is more valuable than hiding it.
Documents
| Document | What it covers |
|---|---|
prompt.md |
Q2/Q3 2026 planning notes — org chart, AI team roles, goals, SDLC/process requirements |
prompt-techops.md |
IaC testing model — sectestbed/preprod VM workflow |
prompt-k8s.md |
K8s vision — VCluster, Rancher, multi-tenancy, workload catalog |
transition-map.md |
Full transition map — current state across Redmine/Discourse/Gitea/infrastructure, Q3/Q4 timeline, risk register, open decisions |
agent-identity-bootstrap.md |
Agent identity provisioning plan — Cloudron enrollment, API key generation, Bitwarden credential architecture, Playwright automation design |
Agent Resources
| File | What it covers |
|---|---|
AGENTS.md |
Orientation guide for agents working in this repo |
STATUS.md |
Current state, blockers, next actions (agent-maintained) |
questions-v1.md |
Open questions for Charles (edit inline to answer) |
Context
- TSYS Group is the overall organization (multiple business entities under one umbrella)
- Known Element Enterprises (KNEL) owns and operates all IT/business systems
- The environment operates in ITAR/CMMC/TS/SCI compliance space
- The infrastructure is a Proxmox bare-metal cluster in a private residence
- The production stack runs on Cloudron (Reston VA VPS) + on-prem k8s
Status
This is live, evolving documentation. The transition is in progress (Q3-Q4 2026).
License
See LICENSE. All content here is shared for educational/reference purposes.