[Feature] Controlled one-time production administrator enrollment #278

New Issue

2026-07-30T15:08:42+02:00

zemion commented

2026-07-30 15:08:42 +02:00

Problem

A newly migrated production database has no safe supported path to establish
the first durable administrator. Development bootstrap must remain forbidden.

Parent story: GovOPlaN/govoplan #13.

Acceptance Criteria

Enrollment is available only while no durable system admin exists.
Its secret is random, root-readable/equivalent, expiring, and single-use.
The bootstrap principal can only establish the first durable admin and
inspect minimum setup readiness.
Success atomically creates authority, invalidates bootstrap credentials,
and emits audit evidence.
Concurrent/interrupted attempts are idempotent and cannot create owners.
Lost/expired material has a local operator recovery command with the same
empty-install and audit gates.
Development bootstrap remains separate and cannot be enabled by this flow.

## Problem A newly migrated production database has no safe supported path to establish the first durable administrator. Development bootstrap must remain forbidden. Parent story: GovOPlaN/govoplan #13. ## Acceptance Criteria - [ ] Enrollment is available only while no durable system admin exists. - [ ] Its secret is random, root-readable/equivalent, expiring, and single-use. - [ ] The bootstrap principal can only establish the first durable admin and inspect minimum setup readiness. - [ ] Success atomically creates authority, invalidates bootstrap credentials, and emits audit evidence. - [ ] Concurrent/interrupted attempts are idempotent and cannot create owners. - [ ] Lost/expired material has a local operator recovery command with the same empty-install and audit gates. - [ ] Development bootstrap remains separate and cannot be enabled by this flow.

zemion added the module/access area/auth codex/ready area/security

module/core labels 2026-07-30 15:08:42 +02:00

zemion commented

2026-08-04 10:08:12 +02:00

Codex State: done

Summary

Implemented an expiring, random, single-use production first-administrator credential with a mode-0600 local artifact and no secret console output.
Added a restricted readiness/enrollment API, atomic initial tenant + protected system owner creation, exact idempotent replay, local recovery rotation, and hash-chained plus audit evidence.
Development bootstrap remains a separate code path and no development setting is read or enabled by production enrollment.

Changed Files

govoplan-core@25da7d4
govoplan-access@668f7cf
govoplan@9e956ee

Verification

tools/checks/check-focused.sh: passed, including 121 Core module-system tests and all 50 WebUI module permutations
govoplan-core tests/test_first_admin_enrollment.py: 8 passed
govoplan-access tests: 59 passed plus 4 subtests
fresh SQLite release migration and operator issue/status flow: passed; artifact mode 0600

## Codex State: done ### Summary - Implemented an expiring, random, single-use production first-administrator credential with a mode-0600 local artifact and no secret console output. - Added a restricted readiness/enrollment API, atomic initial tenant + protected system owner creation, exact idempotent replay, local recovery rotation, and hash-chained plus audit evidence. - Development bootstrap remains a separate code path and no development setting is read or enabled by production enrollment. ### Changed Files - `govoplan-core@25da7d4` - `govoplan-access@668f7cf` - `govoplan@9e956ee` ### Verification - `tools/checks/check-focused.sh: passed, including 121 Core module-system tests and all 50 WebUI module permutations` - `govoplan-core tests/test_first_admin_enrollment.py: 8 passed` - `govoplan-access tests: 59 passed plus 4 subtests` - `fresh SQLite release migration and operator issue/status flow: passed; artifact mode 0600`

zemion closed this issue

2026-08-04 10:08:12 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-core#278