# Grant cp9-developer Direct UI Repository Access

Each CP9 runtime account's `cp9-developer` role directly publishes and pulls
DBaaS UI candidates from account 414. Daily publication uses only that runtime
role and never assumes a source-account publisher role.

The authorization spans the runtime account and source account 414:

- [`terraform/cp9-developer/SKILL.md`](../../terraform/cp9-developer/SKILL.md)
  creates `cp9-developer` in the runtime account.
- [`terraform/cp9-developer/ecr-merge.md`](../../terraform/cp9-developer/ecr-merge.md)
  owns the 414 repository, lifecycle policy, and complete multi-account
  repository policy.

An administrator with access to both accounts initializes a new runtime account
in that order, then merges the 414 floor with the complete runtime-account set.
A partial runtime-account grant revokes every omitted account.

This supersedes ADR 0034's two-profile publication decision. The obsolete
`cp9-source-frontend-images` role is deleted from its original Terraform state
and must not be used. Candidate publication proves effective access by pushing
and pulling the exact digest; checked-in build-time JSON does not duplicate the
414 repository or lifecycle floor.