Ownership/access follow-up: retire musehub-infra elsewhere, Namecheap/Cloudflare ownership, access review cadence

0 Anchors

— Blast radius

— Churn 30d

0 Proposals

Context

Split out from #150, which is now closed. #150 resolved most of what was originally blocked on AWS access: IAM Identity Center, individual identities, root MFA, and break-glass all landed. deploy/push.sh was also fixed to use individual SSO identity for staging deploys instead of the shared musehub-infra credential (verified live).

Remaining items

musehub-infra static credential still referenced elsewhere — push.sh no longer uses it, but these still do:
- deploy/bootstrap-instance.sh — also has a stale PROD_INSTANCE ID from before the production rebuild
- deploy/publish_muse_release.sh — references musehub-infra profile or default in its prerequisites comment; only targets staging, but not SSO-aware
- deploy/backfill_loop.sh — targets staging instance directly, not SSO-aware
- Once these are updated (or confirmed no longer needed), the musehub-infra IAM user's access key can actually be deactivated/deleted — right now it still exists as a live, usable shared credential even though the main deploy path no longer needs it.
Namecheap domain ownership — needs Gabriel to confirm musehub.ai is registered to a company account, not a personal login. Not checkable from this environment.
Cloudflare account ownership — same; needs Gabriel to confirm company-controlled.
Aaron's Cloudflare/DNS access — unverified. This is the one capability in #150's independent-operation test that's still an open question (Aaron can deploy, inspect logs, restore backups, and administer AWS independently now — DNS is the exception).
Quarterly access review process — doesn't exist as a recurring process yet, just point-in-time verification done during this sweep.
Ownership-per-area recording — AWS admin and deploys are now genuinely shared (Gabriel + Aaron). DNS/certs, DB admin, incident response, and billing still default to "Gabriel does everything" with no explicit second owner assigned to those specific areas.

◎ Activity

●

gabriel opened this issue 38 days ago

◎

No activity yet. Use the CLI to comment.

Assignee

○ unassigned

Release

no commits linked to this issue

create

muse hub issue create \
  --title "..." \
  --body "..." \
  --label bug \
  --anchor path/to/file.py::Symbol \
  --commit-anchor <sha> \
  --repo gabriel/musehub

read

muse hub issue get 175 --json
muse hub issue list --state open --json

update

muse hub issue edit 175 \
  --anchor path/to/file.py::Symbol \
  --repo gabriel/musehub

comment

muse hub issue comment 175 \
  --body "Fixed in <sha>" \
  --repo gabriel/musehub

muse hub issue close 175 \
  --repo gabriel/musehub

create

create_issue({
  repo_id: "sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75",
  title: "...",
  body: "...",
  labels: ["bug"],
  symbol_anchors: [
    "path/to/file.py::Symbol"
  ],
  commit_anchors: ["<sha>"]
})

read

get_issue({
  repo_id: "sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75",
  issue_number: 175
})

list_issues({
  repo_id: "sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75",
  state: "open"
})

update

edit_issue({
  repo_id: "sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75",
  issue_number: 175,
  symbol_anchors: ["path/to/file.py::Symbol"]
})

comment

create_issue_comment({
  repo_id: "sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75",
  issue_number: 175,
  body: "..."
})

close_issue({
  repo_id: "sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75",
  issue_number: 175
})

create

curl -X POST \
  http://localhost:10003/api/repos/sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75/issues \
  -H "Content-Type: application/json" \
  -H "Authorization: MSign handle=\"...\" ts=... sig=\"...\"" \
  -d '{
    "title": "...",
    "body": "...",
    "labels": ["bug"],
    "symbol_anchors": ["path/to/file.py::Symbol"]
  }'

read

# get one issue
curl http://localhost:10003/api/repos/sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75/issues/175

# list open issues
curl "http://localhost:10003/api/repos/sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75/issues?state=open"

update

curl -X PATCH \
  http://localhost:10003/api/repos/sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75/issues/175 \
  -H "Content-Type: application/json" \
  -H "Authorization: MSign handle=\"...\" ts=... sig=\"...\"" \
  -d '{"title": "...", "body": "..."}'

comment

curl -X POST \
  http://localhost:10003/api/repos/sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75/issues/175/comments \
  -H "Content-Type: application/json" \
  -H "Authorization: MSign handle=\"...\" ts=... sig=\"...\"" \
  -d '{"body": "Fixed in <sha>"}'

curl -X POST \
  http://localhost:10003/api/repos/sha256:a265796360c3b1b8700b5682ced5f6b044a2c0d3a2c58918892a5aa494db6c75/issues/175/close \
  -H "Authorization: MSign handle=\"...\" ts=... sig=\"...\""