Continuity runbook: Access inventory

Task

A second existing maintainer can prove they have (or lack) every login needed to operate OpenCRE without Spyros — Heroku opencreorg, GitHub OWASP/OpenCRE, Actions environments, DNS for opencre.org — without dumping secrets.

Success criteria

• Runbook docs/continuity/runbooks/access-inventory.md followed (Cursor skill continuity-access-inventory)
• Issue comment: PASS/FAIL/UNKNOWN table for GitHub, Heroku prod, Heroku staging (tmp-cre), config names only, DNS, addons, local CLIs
• No heroku config values, DATABASE_URL, or API keys in this issue
• FAIL rows have an owner who can grant access (Heroku vs domain vs GitHub)

Context

• Index: docs/continuity/README.md
• Skill: .cursor/skills/continuity-access-inventory/SKILL.md
• Team notes: second person on Heroku (keys live there); Rob checks opencre.org (reportedly Google)

Constraints

• existing maintainers only — not GSoC, not drive-by
• Do not add collaborators or change DNS until a maintainer explicitly asks after the report
• Agent prompt is in the runbook — paste it into Cursor

Agent prompt

See Agent prompt in docs/continuity/runbooks/access-inventory.md.

Start with docs/continuity/runbooks/access-inventory.md and .cursor/skills/continuity-access-inventory/SKILL.md, using docs/continuity/README.md for context. Follow the runbook as an existing maintainer and record a PASS/FAIL/UNKNOWN table covering the named systems, config names, addons, and local CLIs without exposing secrets; completion also requires owners for FAIL rows.