/cm-identity-guard

name: cm-identity-guard
description: Verify and lock project identity before ANY git push, Cloudflare deploy, or Supabase operation. Essential when working with multiple GitHub accounts (personal + work), multiple Cloudflare accounts, or multiple Supabase/Neon projects. Prevents wrong-account deploys, cross-project secret leaks, and git history contamination.
token_budget: 800
compressed: true
deprecated: false

Identity Guard — Multi-Account Safety Protocol

TL;DR

• **Use before** any git push, Cloudflare deploy, or Supabase op
• **Verifies**: GitHub account, CF account, Supabase project match expected
• **Prevents**: wrong-account deploys, cross-project secret leaks

Overview

Working across multiple projects, clients, and platforms means one wrong `git push` or `wrangler deploy` can publish work to the wrong account. This skill establishes a mandatory identity check before any operation that touches external services.

> [!CAUTION] > **Real incidents this skill prevents:** > - Pushed client code to personal GitHub repo > - Deployed to wrong Cloudflare account (different org's Pages project, billing confusion) > - Used personal Supabase `ANON_KEY` in a client project (wrong DB entirely) > - `git config user.email` was personal email → commits show wrong author in client repo

The Iron Law

NEVER push, deploy, or use secrets WITHOUT verifying identity first.
ASK: Which account? Which project? Which database?
ONE command verifies all three. Run it. Always.

When to Use

**ALWAYS** before:

• `git push` or `git commit` in a project with multiple account contexts
• `wrangler pages deploy` or any Cloudflare operation
• Creating or accessing a Supabase/Neon client
• Setting up a new project from scratch
• Resuming work after switching between personal and work projects

---

Account Registry (Your Known Accounts)

Maintain this table in your head (or in `.project-identity.json`):

GitHub Accounts

| Account | Purpose | Email | When to Use | |---------|---------|-------|-------------| | `my-personal` | Personal projects, experiments | personal email | Personal repos, side projects | | `my-work-org` | Client work | `dev@workdomain.com` | All client projects |

Cloudflare Accounts

| Account ID | Purpose | Projects | |-----------|---------|---------| | `abc123def456ghi789jkl012mno345pqr` | Client A / Org | project-1, project-2, app | | (personal) | Personal experiments | personal side projects |

Database Accounts

| Service | Account | Purpose | |---------|---------|---------| | Supabase (Org) | org account | All Client A apps | | Supabase (personal) | personal account | Experiments | | Neon | per project | If used |

---

Phase 0: Project Identity File

Every project MUST have a `.project-identity.json` in the project root:

{
  "name": "my-awesome-project",
  "description": "An awesome internal tool",
  "github": {
    "account": "my-work-org",
    "org": "my-work-org",
    "repo": "my_project_repo",
    "remoteUrl": "https://github.com/my-work-org/my_project_repo.git",
    "userEmail": "dev@workdomain.com"
  },
  "cloudflare": {
    "accountId": "abc123def456ghi789jkl012mno345pqr",
    "projectName": "my-frontend-app",
    "stagingUrl": "https://my-app-staging.pages.dev",
    "productionUrl": "https://myapp.workdomain.com",
    "productionBranch": "production"
  },
  "database": {
    "provider": "supabase",
    "projectName": "my-database-project",
    "urlVar": "SUPABASE_URL",
    "anonKeyVar": "SUPABASE_ANON_KEY",
    "serviceKeyVar": "SUPABASE_SERVICE_KEY",
    "secretsStore": "cloudflare-secrets"
  },
  "i18n": {
    "primary": "vi",
    "languages": ["vi", "en", "th", "ph"],
    "dir": "public/static/i18n"
  }
}

> [!IMPORTANT] > Add `.project-identity.json` to git but NEVER put actual secrets in it — only variable NAMES and account IDs. Secrets live in `.dev.vars` (local) or Cloudflare Secrets (production).

---

Phase 1: Identity Verification

The One-Liner Check

Run this before any push or deploy:

# Full identity check — GitHub + Git user + CF account + DB config
echo "=== GitHub CLI ===" && gh auth status 2>&1 | grep -E "Logged in|github.com" && \
echo "=== Git Remote ===" && git remote get-url origin && \
echo "=== Git User ===" && git config user.name && git config user.email && \
echo "=== Cloudflare ===" && cat wrangler.jsonc | grep -E "account_id|project|name" | head -5 && \
echo "=== DB Config ===" && cat .dev.vars 2>/dev/null | grep -E "URL|SUPABASE" | sed 's/=.*/=***/' && \
echo "=== Expected ===" && cat .project-identity.json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print('GitHub:', d['github']['account'], '| CF:', d['cloudflare']['accountId'][:8]+'...', '| DB:', d['database']['provider'])"

What to Verify (Checklist)

☐ GitHub CLI: logged in as <EXPECTED ACCOUNT>
☐ git remote origin: points to <EXPECTED REPO URL>
☐ git config user.email: matches <EXPECTED EMAIL>
☐ wrangler.jsonc: account_id matches <EXPECTED CF ACCOUNT ID>
☐ .dev.vars: SUPABASE_URL points to <EXPECTED SUPABASE PROJECT>

---

Phase 2: Fix Wrong Identity

Wrong GitHub Account

# Check current
gh auth status

# Switch to work account
gh auth logout
gh auth login
# → Login with web browser → select my-work-org

# Fix git user for THIS repo (not global)
git config user.name "my-work-org"
git config user.email "dev@workdomain.com"

# Fix remote URL
git remote set-url origin https://github.com/my-work-org/REPO_NAME.git

Wrong Cloudflare Account

# Check current CF account
wrangler whoami

# Look for account_id in wrangler.jsonc
grep account_id wrangler.jsonc

# Expected for Your Project: abc123def456ghi789jkl012mno345pqr
# Fix: update account_id in wrangler.jsonc

Wrong Supabase Project

# Check which Supabase URL is in .dev.vars
grep SUPABASE_URL .dev.vars

# The URL pattern reveals the project: https://<PROJECT_ID>.supabase.co
# Compare with the p