gabriel / musehub public
fix patch fix/staging-deploy-individual-identity #1 / 1
AI Agent gabriel · 1 day ago · Sep 7, 2026 · Diff

fix: push.sh staging deploys now use individual SSO identity, not shared musehub-infra

Staging authenticated via the shared, long-lived musehub-infra static IAM credential — exactly the anti-pattern Section 1 flags. Switched to the same per-operator IAM Identity Center SSO session already used for production (musehub-nonproduction profile). Verified live with a real staging deploy under SSO with zero reliance on musehub-infra.

Re-verified Section 1 (#150) end-to-end with full account access: most items that were 'needs Gabriel, cannot verify from here' are now resolved (IAM Identity Center, individual identities, root MFA, break-glass, joiner/leaver docs all landed since this doc was written). Upgraded Aaron from write to admin collaborator on musehub and muse, matching his actual co-ownership.

musehub-infra itself isn't retired yet — bootstrap-instance.sh, publish_muse_release.sh, and backfill_loop.sh still reference it/stale instance IDs; tracked as a follow-up rather than fixed in this pass.

sha256:7ca89a509c5c90deba3aee7664f0fdaa8f58f7c5d5b7b9893262f04ac955c408 sha
sha256:be1b2fdf6ab1fc652b3b35a945d0277a36fbf5d96e63692020d36cd7ebe03534 parent
+5 ~2 −5 symbols
2 changed · 1060 in snapshot files
sha256:1981289685d0ee5546e148bfc63d7dba676846cd19643565b02db04456c5fb1b snapshot
+5
symbols added
~2
symbols modified
−5
symbols removed
2
files changed
1060
files in snapshot
0
dead code introduced
Semantic Changes 12 symbols
+ .vscode/
+ alembic/
+ alembic/versions/
+ deploy/
+ deploy/load-tests/
+ docs/
+ docs/architecture/
+ docs/guides/
+ docs/issues/
+ docs/issues/assets/
+ docs/legal/
+ docs/mists/
+ docs/production-readiness/
+ docs/reference/
+ docs/releases/
+ docs/roadmaps/
+ musehub/
+ musehub/api/
+ musehub/api/routes/
+ musehub/api/routes/api/
+ musehub/api/routes/musehub/
+ musehub/auth/
+ musehub/core/
+ musehub/crypto/
+ musehub/db/
+ musehub/debug/
+ musehub/graph/
+ musehub/maintenance/
+ musehub/mcp/
+ musehub/mcp/tools/
+ musehub/mcp/write_tools/
+ musehub/middleware/
+ musehub/models/
+ musehub/muse_cli/
+ musehub/proposals/
+ musehub/protocol/
+ musehub/security/
+ musehub/services/
+ musehub/storage/
+ musehub/templates/
+ musehub/templates/mcp/
+ musehub/templates/musehub/
+ musehub/templates/musehub/fragments/
+ musehub/templates/musehub/macros/
+ musehub/templates/musehub/opengraph/
+ musehub/templates/musehub/pages/
+ musehub/templates/musehub/partials/
+ musehub/templates/musehub/static/
+ musehub/templates/musehub/static/vendor/
+ musehub/types/
+ scripts/
+ src/
+ src/scss/
+ src/scss/components/
+ src/scss/pages/
+ src/scss/patterns/
+ src/scss/theme/
+ src/ts/
+ src/ts/pages/
+ tests/
+ tests/unit/
+ tools/
+ workflows/
~ deploy/push.sh .sh 1 symbol modified
~ AWS_PROFILE
~ docs/production-readiness/01-ownership-and-access.md .md 5 symbols added, 5 symbols removed, 1 symbol modified
− Cannot be verified or performed from this environment section Cannot be verified or performed from this environment L33–51
− table section table L39–50
− Independent-operation test (per the checklist's explicit ask) section Independent-operation test (per the checklist's explicit ask) L51–70
− Verified today section Verified today L18–33
− What I did not do section What I did not do L70–76
+ Independent-operation test — re-run against the checklist's actual list section Independent-operation test — re-run against the checklist's actual list L65–84
+ table section table L71–80
+ Update (2026-09-07) — re-verified with full account access, several items resolved section Update (2026-09-07) — re-verified with full account access, several items resolved L7–65
+ Resolved section Resolved L14–46
+ Still genuinely open — real gaps, not just unverifiable-from-here section Still genuinely open — real gaps, not just unverifiable-from-here L46–65
~ Section 1 — Ownership and Shared Access
Files Changed
~2
1060 in snapshot
~ deploy/push.sh .sh
~ docs/production-readiness/01-ownership-and-access.md .md
← Older Oldest on fix/staging-deploy-individual-identity
All commits
Newer → Latest on fix/staging-deploy-individual-identity

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:7ca89a509c5c90deba3aee7664f0fdaa8f58f7c5d5b7b9893262f04ac955c408 --body "your comment"