# First-Run Administration

On an empty installation, open Conductor in a browser. The setup screen creates the first administrator and signs that administrator in. The setup endpoint closes permanently as soon as any user exists; it is not a registration endpoint.

The setup form requires a unique username and a password of at least 12 characters. Display name and contact email are optional. Passwords are masked, confirmed in the browser, hashed before storage, and never returned or logged.

Initial creation is protected by a short-lived same-site setup cookie/header token, request throttling, and an atomic empty-database check. Concurrent setup attempts can create at most one administrator.

## Empty-installation CLI fallback

Browser setup is the normal path. Operators may bootstrap an empty installation non-interactively when browser access is unavailable:

```bash
docker compose run --rm \
  -e CONDUCTOR_BOOTSTRAP_ADMIN_USERNAME='operator' \
  -e CONDUCTOR_BOOTSTRAP_ADMIN_PASSWORD='a-unique-password-of-12-or-more-characters' \
  backend npm run bootstrap-admin
```

The command refuses weak credentials and makes no change when an enabled administrator already exists.

## Explicit administrator recovery

If every administrator is inaccessible, an operator with access to the persisted Conductor data volume may reset one existing local administrator. Stop normal administrative work during recovery and provide secrets only in the private terminal environment:

```bash
docker compose run --rm \
  -e CONDUCTOR_ALLOW_ADMIN_RECOVERY='I_UNDERSTAND' \
  -e CONDUCTOR_RECOVERY_ADMIN_USERNAME='operator' \
  -e CONDUCTOR_RECOVERY_ADMIN_PASSWORD='a-new-unique-password-of-12-or-more-characters' \
  backend npm run bootstrap-admin
```

Recovery only targets an existing local administrator, re-enables that account, replaces its password hash, and revokes all of its sessions. It cannot create a new administrator or elevate a normal user. Remove sensitive shell history according to local operator policy and rotate the recovered password after access is restored.