FIRST-ADMIN.md: the 53-app first-admin audit (decision 45); CHANGELOG + REPORT

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-28 18:59:24 +02:00
parent ccd17da3c4
commit a791aae057
3 changed files with 102 additions and 13 deletions
@@ -1,3 +1,16 @@
+## No app goes live with a login a stranger knows — first two apps; the audit (2026-09-28 evening, `09` §3 decision 45)
+
+- **`FIRST-ADMIN.md`** (new): how each of the 53 apps gets its first admin — class, fix route, status, and whether each
+  claim was measured or read. 2 fixed, 37 open (3 hard-coded defaults, 34 open first-run screens), 14 fine.
+- **claper** (`9dc8a05`) and **bookstack**: a generated `ADMIN_PASSWORD` (`type: password`, shown on the app page as the
+  first password) and an `after_install:` command through the app's own CLI that replaces the known default
+  (`bin/claper rpc … update_user_password`; `artisan bookstack:create-admin --initial`). Needs controller ≥ 0.279.0 (the
+  floor). Proven on 9202 on a fresh install each: the default no longer logs in, the generated password does, a wrong
+  one does not; for claper a restore keeps it. First steps (hu + en) now say to sign in with the first password.
+- **Copy freeze:** the new and changed Hungarian strings of both apps signed off (`--capture-freeze`, diff = those strings only).
+- Found, not changed: romm's `default_creds` (`admin / admin`) does not log in on demo-hp (stale); zipline's looks
+  stale; calibre-web's route needs a generated password with a special character (its password policy).
+
 ## claper → PostgreSQL 17, calcom → 1536M and PostgreSQL 18 (2026-09-28, `09` §3 decision 43)

 - **claper: PostgreSQL 16 → 17** (`4a249b9`, alone in its commit, written by `upgrade-test.py --write-ladder`). Its upstream