# Account-init

A CP9 session on a runtime AWS account assumes `cp9-developer`, pulls kernel and UI images from account 414, and serves the authenticated UI on that account's wildcard certificate. A Dedicated GCP session attaches the same shared no-key `cp9-developer` SA. This skill is the admin bootstrap that makes those names exist so `cp9 up` can run. The accounts are shared test accounts — clinic auto-deploy, QA ECR grants, and other products already use them — so present trust stays.

## Who

- Runtime-account admin (SSO): IAM, child zone, ACM, quotas, Auth0 secret names **and payloads** (reject placeholders).
- Account-414 admin: parent NS, ECR floor merge, `cp9-source-route53-records`.
- GCP project admin: shared SA + cleanup WIF (no JSON keys). Session Terraform only `actAs`; it never creates the SA.
- Auth0 tenant admin: callback / logout / origin wildcards after the child zone exists. Out of band.

## When

- Onboarding a new runtime AWS account or GCP Dedicated project, before the first session.
- Adding the account to `.github/cp9-cleanup-accounts.json` (scheduled cleanup and session DNS both read that manifest; an omitted account cannot start).
- A session fails closed on missing `cp9-developer`, 414 `BatchGetImage` 403, or missing zone/cert. Auth0 secret payloads that look unusable are an account-init gate (agent judgment); runtime does not reject every dummy string.

Cleanup lease, Dedicated shoot registration, and cloud-cost identities are sibling skills.

## Floor

Read [`../live-floor.md`](../live-floor.md) and run those steps. Names: [`floors.md`](floors.md). 414 ECR write: [`ecr-merge.md`](ecr-merge.md).

`cp9-source-route53-records` exists so pre-delegation sessions can still be destroyed; new sessions never assume it. Direct UI publication uses the runtime `cp9-developer` role against 414 — never a source-account publisher role.

## Completion

Shared done rule: [`../live-floor.md`](../live-floor.md). Account-init extras: existing `auto-deploy-cli` is `left-in-place`; AWS runtime accounts land in `.github/cp9-cleanup-accounts.json` with role ARN, zone id/name, and cert ARN.