# Live floor

Shared process for the four admin SKILL.md files.

These AWS/GCP accounts are shared. Terraform's SSOT is config+state, so import-then-apply rewrites live IAM trust, DNS, and certs to match the module and breaks other uses of the same account (clinic GitHub OIDC on `auto-deploy-cli` is the proof). Live is the SSOT: missing names are created from the invoking SKILL floor; present grants stay.

| Scenario | SKILL.md |
|---|---|
| account-init | [`cp9-developer/SKILL.md`](cp9-developer/SKILL.md) |
| cleanup-lock | [`aws/cp9-cleanup-lock/SKILL.md`](aws/cp9-cleanup-lock/SKILL.md) |
| Dedicated registration | [`aws/init-dedicated-dataplane/SKILL.md`](aws/init-dedicated-dataplane/SKILL.md) |
| cloud-cost identity | [`cloud-cost-report-identity/SKILL.md`](cloud-cost-report-identity/SKILL.md) |
| session-runtime | `cp9 up` (`aws/cp9-substrate`, `aws/cp9-gcp-runtime-identity`, `gcp/cp9-dedicated-regional`) |

**Tools.** Native CLIs only: `aws`, `gcloud`, `az`, `aliyun`. Install them locally first. Run with an already-authorized profile that is the owner account. If the profile cannot call the cloud API, prompt the human to authorize it — prefer device flow (`aws sso login`, `gcloud auth login --no-launch-browser`, `az login --use-device-code`, `aliyun configure`). Do not invent a wrapper, SDK, or Terraform apply for these admin floors.

1. **Identity.** Caller is the owner in the invoking SKILL.md. `sts get-caller-identity` or `gcloud config get-value project` equals that owner.
2. **Floor.** List every contract name from the invoking SKILL.md. ECR and source Route53 use the whole `.github/cp9-cleanup-accounts.json` set.
3. **Live.** Get/Describe/List each name. Record `present` or `missing`. Extra live grants stay. For secrets whose floor lists required keys: `get-secret-value`, parse the payload, and record `placeholder` on fields you judge unusable as credentials. Do not print secret bodies.
4. **Write.** Default is check. Write only with explicit apply. Missing name: create from the SKILL floor (`aws` / `gcloud` / `az` / `aliyun`). For IAM policy documents and role trust, copy a live sibling that already has that floor name. Present IAM assume-role policy, hosted zone, and ACM certificate stay. For secrets with required keys, copy a sibling whose required fields you judge real: missing name → create; name present with `placeholder` fields → update only those required fields and keep every other existing field. After create or update, `get-secret-value` again and re-judge. Do not print secret bodies.

Done when every floor name is `present`, `created`, `updated`, or `left-in-place`, extras remain, and every required secret field re-read after a write is judged real.