feat: bootstrap agent identities and automated install flow

.gitignore

@@ -2,6 +2,7 @@
 *.log
 .ansible/
 .vault_pass
+backups/
 
 # Secrets and credentials
 *.env
@@ -13,3 +14,13 @@ vault.yml
 id_rsa*
 host_vars/
 group_vars/
+
+# Keep inventory vars tracked (except vault secrets)
+!inventories/
+!inventories/**/
+!inventories/**/group_vars/
+!inventories/**/group_vars/*.yml
+!inventories/**/host_vars/
+!inventories/**/host_vars/.gitkeep
+inventories/**/group_vars/vault.yml
+inventories/**/group_vars/vault.manual.refactor.yml

AGENT_HANDOFF.md

@@ -0,0 +1,27 @@
+# Codex Agent Handoff
+
+## Current State (2026-03-01)
+- Enterprise install works end-to-end for `dev-main` + `andrea` profiles; control-plane Spins deployed via Docker Compose stacks under `/home/efra/openclaw-control-plane/` and managed via `make reinstall CONFIRM=1 ENV=dev LIMIT=zennook`.
+- Postgres auth reconcilation now uses profile-specific admin credentials before flagging health check failures (`roles/openclaw_control_plane/tasks/profile.yml`).
+- Smoke flow verifies queue + control API by checking `/tasks/{taskId}` until the task reaches a terminal status; `ops/smoke.sh` now retries and reports last status.
+- OAuth login is manageable via `make oauth-login PROFILES="dev-main andrea" OAUTH_PROVIDER=openai-codex`, automatically sources `/etc/openclaw/secrets/<profile>.env`, and lists auth profiles when done (`ops/oauth-login.sh`).
+- Secrets refactor pipeline adds `ops/secrets-refactor.sh`, `ops/validate-secrets.sh`, and the Makefile target `make secrets-refactor` (docs updated accordingly).
+
+## Handoff Checklist
+1. Confirm `/etc/openclaw/secrets/dev-main.env` and `/etc/openclaw/secrets/andrea.env` contain the required temp tokens; backups are stored under `backups/`.
+2. Run `make reinstall CONFIRM=1 ENV=dev LIMIT=zennook` if the environment is dirty again; the playbooks already handle purge/install/smoke in one shot.
+3. After OAuth login you still need to populate `auth-profiles.json` for each agent; run `openclaw --profile <profile> models auth list` to see active entries.
+4. Verify Telegram tokens via `cat /etc/openclaw/secrets/dev-main.env` (mask the values in outputs). They are also referenced in `inventories/dev/group_vars/vault.yml` and each control-plane `.env` file.
+
+## Next Steps for Codex agent
+- Finish the implementation plan for Ansible multi-agent deployment (already captured elsewhere, but double-check architecture docs and inventory). Copy actionable instructions into the reserved roadmap file.
+- When writing PRs, include `@codex` mention, request a full review, and ask for architecture implementation plan per earlier requirements.
+- Keep `ops/oauth-login.sh` and `ops/smoke.sh` in sync with any profile additions (e.g., add new profile names to `PROFILES` in `Makefile`).
+
+## Useful Commands
+- `make secrets-refactor ENV=dev LIMIT=zennook`
+- `make reinstall CONFIRM=1 ENV=dev LIMIT=zennook`
+- `make oauth-login PROFILES="dev-main andrea" OAUTH_PROVIDER=openai-codex`
+- `make smoke ENV=dev LIMIT=zennook`
+
+Keep notes in this file before handing off to another Codex agent; update the `next steps` section if you take new actions.

Makefile

@@ -0,0 +1,73 @@
+SHELL := /usr/bin/env bash
+
+.DEFAULT_GOAL := help
+
+ENV ?= dev
+INVENTORY ?= inventories/$(ENV)/hosts.yml
+LIMIT ?= zennook
+PROFILES ?= dev-main andrea
+OAUTH_PROVIDER ?= openai-codex
+MODEL_REF ?= openai-codex/gpt-5.3-codex
+
+.PHONY: help backup purge install auto-install cloudflare auth-sync oauth-login smoke reinstall secrets-refactor
+
+help:
+	@echo "OpenClaw Ops Targets"
+	@echo ""
+	@echo "  make backup                           Backup current OpenClaw + control-plane state"
+	@echo "  make purge CONFIRM=1                 Purge deployed state and containers"
+	@echo "  make install                          Install/reconcile enterprise + control-plane"
+	@echo "  make auto-install                     Automated install flow (auth-sync + install + smoke)"
+	@echo "  make secrets-refactor                Build manual secrets migration file + validate vault"
+	@echo "  make cloudflare                       Reconcile Cloudflare tunnel/service only"
+	@echo "  make auth-sync                        Sync Codex creds from /home/efra/.codex to OpenClaw profiles"
+	@echo "  make oauth-login                      Alias to make auth-sync (legacy name)"
+	@echo "  make smoke                            Run post-install smoke checks"
+	@echo "  make reinstall CONFIRM=1              backup + purge + install + smoke"
+	@echo ""
+	@echo "Variables:"
+	@echo "  ENV=$(ENV) INVENTORY=$(INVENTORY) LIMIT=$(LIMIT)"
+	@echo "  PROFILES='$(PROFILES)' OAUTH_PROVIDER=$(OAUTH_PROVIDER) MODEL_REF=$(MODEL_REF)"
+	@echo "  AUTO_PURGE=0 AUTO_BACKUP=0 (used by auto-install)"
+
+backup:
+	@ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)" ./ops/backup.sh
+
+purge:
+	@if [[ "$(CONFIRM)" != "1" ]]; then echo "Use: make purge CONFIRM=1"; exit 1; fi
+	@ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)" ./ops/purge.sh --yes
+
+install:
+	@ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)" ./ops/install.sh
+
+auto-install:
+	@if [[ "$(AUTO_BACKUP)" == "1" ]]; then \
+		$(MAKE) backup ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)"; \
+	fi
+	@if [[ "$(AUTO_PURGE)" == "1" ]]; then \
+		$(MAKE) purge CONFIRM=1 ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)"; \
+	fi
+	@$(MAKE) auth-sync ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)" PROFILES="$(PROFILES)" OAUTH_PROVIDER="$(OAUTH_PROVIDER)" MODEL_REF="$(MODEL_REF)"
+	@$(MAKE) install ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)"
+	@$(MAKE) smoke ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)"
+
+secrets-refactor:
+	@ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)" ./ops/secrets-refactor.sh
+
+cloudflare:
+	@ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)" ./ops/cloudflare-reconcile.sh
+
+auth-sync:
+	@ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)" PROFILES="$(PROFILES)" OAUTH_PROVIDER="$(OAUTH_PROVIDER)" MODEL_REF="$(MODEL_REF)" ./ops/auth-sync.sh
+
+oauth-login: auth-sync
+
+smoke:
+	@ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)" ./ops/smoke.sh
+
+reinstall:
+	@if [[ "$(CONFIRM)" != "1" ]]; then echo "Use: make reinstall CONFIRM=1"; exit 1; fi
+	@$(MAKE) backup ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)"
+	@$(MAKE) purge CONFIRM=1 ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)"
+	@$(MAKE) install ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)"
+	@$(MAKE) smoke ENV="$(ENV)" INVENTORY="$(INVENTORY)" LIMIT="$(LIMIT)"