Section 1 — Ownership and Shared Access

Companion to musehub-production-readiness-checklist.md. "GitHub organization ownership" in the original checklist is translated to MuseHub collaborator/ownership throughout — see the Decision Log entry in the main checklist.

Update (2026-09-07) — re-verified with full account access, several items resolved

Most of what this section originally flagged as "needs Gabriel, cannot verify from here" is now resolved, since IAM Identity Center, individual SSO identities, and root MFA all landed in the weeks since this doc was first written (see docs/architecture/musehub-cloud-identity-and-aws-operating-model.md for the full identity model).

Resolved

• [x] AWS human identities exist and are separate — IAM Identity Center (MuseHub-Workforce) provisions Gabriel and Aaron as individual identities via Google Workspace SSO, each with Google-managed MFA. Confirmed via muse hub — not something this environment could see before.
• [x] Aaron has independent AWS access — AdministratorAccess on all three AWS accounts (Management, Nonproduction, Production) via SSO, matching his role as a 50/50 owner of the MuseHub LLCs (deliberate decision, documented in the identity model doc).
• [x] Root MFA — enabled on Management and Production root (Authenticator, unique passwords in the password manager). Nonproduction's root credentials are deliberately deleted entirely (centralized root access management) rather than left with a standing password/MFA — see the identity model doc's "Centralized root access management" section for why this is the more secure end state, not a gap.
• [x] Company-controlled email for AWS — root mailboxes ([email protected], [email protected], [email protected]) are Google Groups on the company domain, not personal addresses, with Gabriel and Aaron as members.
• [x] No shared AWS credential for deploys — deploy/push.sh now authenticates both staging and production via the operator's own IAM Identity Center SSO session (musehub-nonproduction / musehub-production profiles), not the shared musehub-infra static IAM user. Verified live (2026-09-07): ran a real staging deploy end-to-end under SSO with zero reliance on musehub-infra. This directly resolves the checklist's core "individual identities, not shared keys" ask for the deploy path specifically.
• [x] Aaron has admin (not just write) on musehub and muse — upgraded from write to admin collaborator permission on both repos (2026-09-07), matching his actual co-ownership rather than treating him as a contributor.
• [x] Joiner/leaver procedure exists — written as part of the identity model doc (§11 "Onboarding a teammate", §12 "Offboarding a teammate"), covering Google Workspace group membership, SCIM provisioning, and AWS account/permission-set assignment.
• [x] A break-glass procedure exists for AWS — centralized root access management (Management account → IAM → Root access management) lets an admin take root-only privileged actions on member accounts without a standing credential. This is the AWS break-glass path.

Still genuinely open — real gaps, not just unverifiable-from-here

• [ ] musehub-infra static credential still exists and is used elsewhere — push.sh no longer uses it, but deploy/bootstrap-instance.sh, deploy/publish_muse_release.sh, and deploy/backfill_loop.sh still reference the old shared-credential pattern and/or stale instance IDs. Not fixed in this pass — see follow-up ticket.
• [ ] Domain ownership (Namecheap) — needs Gabriel to confirm musehub.ai is registered to a company account, not a personal login. Still outside what this environment can check.
• [ ] Cloudflare account ownership — same; needs Gabriel to confirm company-controlled, not personal.
• [ ] Sole-recovery-path audit for Namecheap/Cloudflare specifically — AWS's recovery paths are now solid (multiple admins, root MFA, centralized break-glass). Namecheap and Cloudflare haven't been through the same audit.
• [ ] Quarterly access review process — doesn't exist yet as a recurring process, just a point-in-time state today.
• [ ] Ownership-per-area recording — AWS admin and deploys are now genuinely shared (Gabriel + Aaron), but DNS/certs, DB admin, incident response, and billing ownership still default to "Gabriel does everything" with no explicit second owner assigned.

Independent-operation test — re-run against the checklist's actual list

The checklist asks to test that a second person can: sign in to AWS independently, inspect production, deploy staging, approve/deploy production, inspect logs/alarms, restore from backup, and update DNS.

This is a real, substantial improvement from the original "none of this is possible yet" state — 6 of 7 capabilities are now genuinely true and several were verified live, not just assumed. DNS access is the one remaining unverified item, tied to the open Cloudflare ownership question above.