# Password accounts and personal agent keys — 14 October 2026

Implemented username/password login in the library and admin surfaces, administrator
account creation/disable, self-service password changes and `/agents` for personal
agent keys. The development proxy preserves the public Host to fix the reported
same-origin login failure. Existing bearer credentials remain usable for setup.
An initial administrator account was created at the owner's request; no password or
bearer token is recorded in this evidence document.

PASS:

- Full backend suite: 181 tests.
- Web check: TypeScript, ESLint and 19 component tests.
- Production web build; Ruff check/format, mypy, boundary and agent manifest checks.
- Account API scenarios: hashed passwords, generic input errors without secrets,
  HTTPS/origin/CSRF/body limits, login throttling, password change invalidates all
  sessions, wrong-password rejection, agent identity isolation, owner-only key
  listing/revocation, grant escalation denial, read-only user limitations, account
  disable cascades to agent revocation, self-disable rejection and durable accounts.
- Added targeted coverage for owned-key rotation and legacy account-key revocation
  cascading to the user's agent keys.
- Live HTTPS smoke check: password login 200, Secure session cookie, authorized user
  list 200, CSRF-protected sign-out 200. The test session was revoked afterward.
- Public-origin requests now pass through the development proxy; attacker-origin
  requests still fail with the same-origin error.

LIMITED: the shared preview switched between clients, stale pages and renderer
errors. The fixture page loaded, but the full visual/keyboard/password walkthrough
could not be completed reliably. The component and API tests cover the behavior;
no screen-reader or axe pass is claimed. Temporary fixture HTTPS forwarding and
server processes were removed. Native agent-host setup remains outside this slice.

Existing dirty/untracked application state was preserved, no commit was made, and
no knowledge records were changed. Account migration adds tables and a nullable
credential owner column; no existing bearer secret is rotated during migration.