136 lines
5.4 KiB
Markdown
136 lines
5.4 KiB
Markdown
# Resume Prompt — Agent Identity Provisioning (Session 3)
|
|
|
|
> **Read this entire file before doing anything.** Session 2 completed all
|
|
> four systems for vp-techops and consolidated the flows. This session loops
|
|
> the remaining agents through the manifest.
|
|
|
|
---
|
|
|
|
## Who You Are
|
|
|
|
You are the TSGCOO Crush agent (AI assistant for TSYS Group's COO). You provision
|
|
AI agent identities (Cloudron accounts, SSO, API keys) and store all credentials
|
|
in Bitwarden.
|
|
|
|
## Read First
|
|
|
|
1. `/home/TSGCOO/projects/TSYSGroupAIOS/BASELINE-PROMPT.md` (14 principles)
|
|
2. `/home/TSGCOO/projects/agent-identity-provisioning/STATUS.md`
|
|
3. `/home/TSGCOO/projects/agent-identity-provisioning/docs/JOURNAL.md` — all
|
|
working selectors and flows are documented here
|
|
|
|
## State at Session 3 Start (2026-08-14)
|
|
|
|
**All flows are proven end-to-end for vp-techops and consolidated into
|
|
`provision-agent.py`:**
|
|
|
|
| System | Flow | Status |
|
|
|---|---|---|
|
|
| Cloudron | invite -> password -> TOTP 2FA | ✅ proven |
|
|
| Gitea | SSO -> token | ✅ proven |
|
|
| Discourse | SSO -> signup -> RSA User API key | ✅ proven |
|
|
| Redmine | SSO -> API key | ✅ proven |
|
|
|
|
**First remote delivery completed (2026-08-14):** the container-based
|
|
BW CLI moved from org-buildout to `KNEL/KNELSecretsManager` (commit
|
|
e3e5451, pushed by vp-techops, linked to the vptechops Gitea account,
|
|
with ADR-002 documenting the decision). This proved the full agent
|
|
delivery loop: TSGCOO pulls the vp-techops token from BW -> tea/git
|
|
operate as vptechops -> commit -> push -> account-linked attribution.
|
|
|
|
**tea is configured:** login `git.knownelement.com` as vptechops.
|
|
Token sourced from BW item "vp-techops Gitea".
|
|
|
|
**Agent git identity gotcha (fixed, do not regress):** Gitea links
|
|
commits to accounts by EMAIL. Agent registries must use the
|
|
Cloudron-issued address (`tsgstaff-coo-vptechops@turnsys.com`), not
|
|
synthetic `vp-techops@turnsys.com`. clone-as.sh and agent-profile.sh
|
|
in TSYSGroupAIOS are fixed as of c564531.
|
|
|
|
BW vault (4 items): vp-techops Cloudron (TOTP), Gitea, Discourse, Redmine.
|
|
All keys verified via their APIs.
|
|
|
|
**Infrastructure facts:**
|
|
- Provisioner: `docker compose run --rm provision` in
|
|
`/home/TSGCOO/projects/agent-identity-provisioning`
|
|
- Source is bind-mounted read-only — no rebuild needed for .py changes
|
|
- Container user matches host TSGCOO (1002:1002); `:latest` tag reuse is
|
|
fine during iteration
|
|
- `bw_helper.py` syncs after login and before list — the session-1 state
|
|
divergence bug is fixed and covered by `test_bw_persistence.py`
|
|
- Host `bw` wrapper: `export PATH="$HOME/.local/bin:$PATH"` (not in
|
|
default PATH)
|
|
|
|
## What This Session Does
|
|
|
|
Loop the remaining agents in `agents.yaml`:
|
|
|
|
### Step 1: Merge Charles's invite file into the manifest
|
|
|
|
Charles keeps invites in `~/cloudron-invites.txt`, one agent per line:
|
|
`agent-name,invite-url` (hyphenated names preferred; loose names like
|
|
vpsecops auto-normalize; blank lines and # comments ignored; email/
|
|
username/displayName are extracted from the invite URL itself).
|
|
|
|
```
|
|
cd /home/TSGCOO/projects/agent-identity-provisioning
|
|
docker compose run --rm --entrypoint python3 \
|
|
-v "$HOME/cloudron-invites.txt:/invites.txt:ro" \
|
|
provision merge-invites.py
|
|
cp state/agents-merged.yaml agents.yaml
|
|
```
|
|
|
|
merge-invites.py SKIPS duplicate invite tokens (stale copy-paste guard)
|
|
and exits 1 while still writing the valid entries. As of session 2 end
|
|
the manifest is fully merged: all 9 agents READY (including new
|
|
vp-compliance, appended phase1-only). Re-run this step only if Charles
|
|
issues fresh invites.
|
|
|
|
### Step 2: Grant Cloudron app access
|
|
|
|
For each agent with systems configured, Charles must grant the user
|
|
access to those apps in Cloudron (Redmine lesson: OIDC shows "You do
|
|
not have access" until granted).
|
|
|
|
### Step 3: Provision
|
|
|
|
```
|
|
docker compose run --rm provision provision-agent.py --agent vp-secops
|
|
```
|
|
Q4 agents (coo, svp-knel, svp-tctc, vp-investing, vp-trading,
|
|
vp-compliance): add `--phase1-only` (they have systems: {} anyway).
|
|
|
|
Idempotency: BW items short-circuit (`X already exists -- skipping`),
|
|
so re-runs are safe.
|
|
|
|
## Prereq Checklist Before Each Agent
|
|
|
|
- [ ] Invite URL in agents.yaml
|
|
- [ ] Cloudron app access granted (Gitea/Redmine/Discourse per manifest)
|
|
- [ ] BW vault has no stale items for that agent
|
|
|
|
## Known Issues (do not re-litigate)
|
|
|
|
1. **bw "native" binary is a Node.js SEA** — prints Node errors on crash.
|
|
CMMC/ITAR zero-Node goal is not actually met (documented in
|
|
KNELSecretsManager ADR-002). Needs a Charles decision.
|
|
2. **Gitea stale tokens** from session 1 may exist for vp-techops — cleanup
|
|
pending (revoke all but the stored one).
|
|
3. **org-buildout and agent-identity-provisioning are local-only** — they
|
|
live in TSYSGroupCorporate/reachableceo orgs, which vptechops cannot
|
|
see (vptechops has 31 KNEL/* repos). Options: grant vptechops access,
|
|
or push from an account that can.
|
|
4. **Discourse User API keys are user-scoped** — admin operations still
|
|
need an admin key (assign to vp-techops per STATUS.md inbox).
|
|
|
|
## Mistakes to Avoid (carried forward)
|
|
|
|
- Never delete BW items to fix duplicates — `update_item()` in place
|
|
- One comprehensive DOM dump per page before writing selectors
|
|
(see `_debug_dump` and JOURNAL.md patterns)
|
|
- `page.keyboard.type()` not `fill()` for Vue/Pankow forms
|
|
- `[role="button"]` not `button` for Cloudron UI
|
|
- Em dashes break Python source — use `--`
|
|
- Redmine Reset: use the DOM-traversal targeting in `provision_redmine`,
|
|
never a generic `a:has-text("Reset")` match
|