[E05-S01] Administrator bootstrap #72

New Issue

2026-08-27T00:00:38Z

kpcto commented

2026-08-27 00:00:38 +00:00

Parent epic: [E05] Administrator security (#33)

Intent

A documented first-run bootstrap creates the initial administrator without any universal or default password, hashes the password with Argon2id, and never leaks secrets into logs.

Acceptance criteria

No universal or default password exists for administrator bootstrap
Administrator password is hashed with Argon2id before it is stored
Bootstrap follows the documented first-run path exactly
Secret and password values never appear in any log output

Explicitly out of scope

Opaque DB-backed session management (E05-S02)
CSRF protection for cookie-authenticated state changes (E05-S03)

Test plan

Automated test asserts no default credential is accepted
Manual run of the documented first-run path creates the administrator

Rollback note

Revert bootstrap code and re-run the admin-row migration; no data migration beyond the administrator row

Owning stream

platform

Risk quadrant

agent-full

> Parent epic: [E05] Administrator security (#33) ## Intent A documented first-run bootstrap creates the initial administrator without any universal or default password, hashes the password with Argon2id, and never leaks secrets into logs. ## Acceptance criteria - No universal or default password exists for administrator bootstrap - Administrator password is hashed with Argon2id before it is stored - Bootstrap follows the documented first-run path exactly - Secret and password values never appear in any log output ## Explicitly out of scope - Opaque DB-backed session management (E05-S02) - CSRF protection for cookie-authenticated state changes (E05-S03) ## Test plan - Automated test asserts no default credential is accepted - Manual run of the documented first-run path creates the administrator ## Rollback note - Revert bootstrap code and re-run the admin-row migration; no data migration beyond the administrator row ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint 1 milestone 2026-08-27 00:00:38 +00:00

kpcto added the

labels 2026-08-27 00:00:39 +00:00

kpcto referenced this issue

2026-08-27 00:17:15 +00:00

[E05-S01-T01] No universal/default password #232

kpcto referenced this issue

2026-08-27 00:17:15 +00:00