# 12. Sharing a cp9 env: `cp9 share` exports a K8S-access bundle; owner keeps control

Status: Superseded by the issue #821 `cp9 status` access summary and removal of
`cp9 share`

This ADR is retained as historical context. The command described below no
longer exists. Current `cp9 status` reports persisted connection facts without
exporting a bundle or mutating security groups, Account data, CORS, or EKS
access.

## Context

A cp9 env is owner/session-scoped. To amortize the env + warm-pool (ADR 0009) setup across
trusted teammates/agents, a second party should be able to reuse an already-built, warm env
without rebuilding from scratch. Full trust is assumed — no access-control hardening.

## Decision

- **`cp9 share` (owner-side) exports an access bundle; there is no `cp9 join`.** The cp9
  lifecycle control (up/destroy) stays with the owner; the second party only *uses* the env
  (kubectl, the OpenAPI, etc.) and does not run cp9 to manage it.
- **The bundle is minimal: K8S connection info + AWS account/region.** Concretely: the
  kubeconfig for the env's control-plane k3d, plus how to reach the kube API (this env is
  remote-ec2-k3d, so the kube API is on the EC2 host and needs a tunnel), and the AWS account
  id + region.
- **Everything else is derived, not bundled.** The OpenAPI (kong), the metaDB, and session
  identity all live inside the local k3d; once the second party has K8S access they reach them
  via port-forward / exec. The recipient already has full permissions on the AWS account, so
  **no AWS credentials are bundled** — only which account/region.
- **Reaching the EC2 for the kube-API tunnel is via SSM, not a shared SSH key.** The recipient
  uses their own AWS access to start an SSM port-forwarding session to the EC2's kube-API port
  (given the instance id), so no SSH private key is shared.

Scope: cp9-internal — a `cp9 share` export. Full trust → no access control.

## Consequences

- A trusted second party reuses the owner's warm env (and its warm pool) at near-zero setup;
  the env + warm-pool cost is amortized across whoever shares it.
- The bundle is small and credential-light — no AWS creds, no SSH key — just the kubeconfig +
  the EC2 instance id (for SSM) + account/region. It still contains the kubeconfig, so share it
  over a private/trusted channel (credential hygiene).
- Scope: shared envs are for cluster-lifecycle / control-path loops (each party makes its own
  logical clusters on the shared pool); service-code loops are out of scope (a code change is
  global to the env).
- Depends on the env being long-lived, which depends on the credential root fix (ADR 0010) so
  the env does not hit `ExpiredToken` while shared.