Verify access controls on prod

Epic 5329 ask (verbatim): "Analyze current code, processes and documentation and close the gap to being SOC 2 compliant. Humans can participate but only where it cannot be avoided legally. Ask questions, but do not offload any work that you are technically able to do." Sources: PRD (Task 5330) and architecture (Task 5331) of epic 5329 — read them with `task_read` / `task_read_artifact`. Binding decisions (verbatim): "D4 People with production access: Only Roman." AS1: "agents may run prod terraform, scripts and tests, but only code that has reached `master` through Roman's promotion, plus read-only and test actions that need no code change (a restore into an isolated target, a page test, an export)." Credentials: `jaah/system/bootstrap-admin` (AWS via `OrganizationAccountAccessRole`, explicit `--region`, env vars per command only) and `gmind/skynet/main` (prod CP admin API for the probe user); confirm with `task_credential_list` first (missing = BLOCKER ask). Evidence filing: `tools/evidence_store.py` CLI with `EVIDENCE_BUCKET=jaah-main-evidence-366008913850`; Object Lock — permanent; dry-run first; drafts named `<control>/<YYYY-MM-DD>/<slug>.draft.<ext>` with `Status: awaiting signature` (DA6). ## Requirement (verbatim from PRD) "### R7 — Logical access (CC6.1–CC6.3; G-01, G-03, G-05, OA-10, OA-11, OA-23) - **AC7.1** MFA is verified behaviourally on prod: a login without a second factor gets no session. *Verify:* the scripted check's output is filed to `reviews/`. - **AC7.2** `cp_readonly` is verified on prod: a write is refused, and the break-glass page fires. *Verify:* the check's output is filed to `reviews/` and `alarms/`. - **AC7.3** An entitlement export covers console users and roles, AWS Identity Center and IAM users in every org account, and GitHub. It is filed to `entitlements/` as a review ready for Roman's signature. *Verify:* the object exists, and it lists `bootstrap-admin`, `jaah-cp-psql-reader` and `jaah-node-launcher`." ## Scope and approach (from the settled architecture) Architecture B4 — master code only. - Run the access tools against prod: `tools/mfa_check.py` (probe user created, used, disabled) and `tools/cp_readonly_check.sh`, filed to `reviews/`. - **Break-glass, behaviourally (AC7.2):** perform the real break-glass DB access path (`infra/jaah/terraform/operator-db-access.tf`, through `tools/cp_psql.sh --break-glass`) once. The master secret it reads is never printed, logged or filed. Observe its alarm reach Slack (via the CP relay) and email, then close it. File one record to `alarms/`, cross-referenced from the `reviews/` cp_readonly record. - Run `tools/entitlements_export.py` (org-wide + Identity Center + console + GitHub), filed to `entitlements/` as unsigned (`.draft.`). Name "sign the entitlement review" for the close-out child's R16 list. Out of scope: Epic-wide fences (PRD §6, verbatim): "No agent merges or pushes to `master`. No agent approves its own promotion. No agent applies to prod any change not yet promoted. Delivery is a PR to `develop` (D1)." "No contact with any outside party: no emails, Slack messages to externals, vendor portals, NDA click-throughs or RFPs sent; no contracts; no new vendor or subprocessor, which also excludes PagerDuty/Opsgenie and Drata (D3, D7, D8)." "Legacy account 210352747749 is untouched." "Out of scope: Security Hub MEDIUM and LOW findings (D10) — registered only; evidence automation: no new crons, workflows or collectors whose purpose is recurring evidence (D7); Type II, the observation window, the audit, auditor engagement; `compliance_locks` and the vault-lock *compliance* mode." "No change to the console Compliance page, `portfolio/registry.toml` or `portfolio/engine/`" (epic 5303 owns them). "No secret value in any doc, register, evidence object or report." "No weakening of an existing control to make a check pass." This child: No write to the prod DB beyond the rolled-back probe transaction; the break-glass session runs no write. No secret in any record. Probe user disabled after use. Done means: - AC7.1 — oracle: the `reviews/<date>/mfa-check…` `s3://` URI printed; the record shows the HTTP status and "no session cookie/token issued"; the probe user is disabled (CP read cited). - AC7.2 — oracle: `reviews/<date>/cp-readonly…` shows the refused write error; `alarms/<date>/break-glass…` shows the alarm transition time, the Slack message and the email delivery evidence; no filed record contains any secret value (each record grepped for the secret's ARN-resolved value pattern finds nothing). - AC7.3 — oracle: `aws s3 cp` the `entitlements/<date>/…draft…` object and grep finds `bootstrap-admin`, `jaah-cp-psql-reader`, `jaah-node-launcher`; it covers all org accounts (account ids listed) and GitHub collaborators.

AC7.2 cp_readonly PASS; entitlements draft filed (AC7.3 PASS). Break-glass paged Slack, but email subs unconfirmed so no email went. AC7.1 open: TimeSaver has mfa_skip, Gmind probe skipped per Roman. Close-out: sign entitlements, confirm paging email, run Gmind MFA probe.