conductor/docs/FIRST_RUN_SETUP.md

First-Run Administration

On an empty installation, finish HTTPS and open Conductor in a browser. The setup screen creates the first administrator and signs that administrator in. Conductor ships with no default username or password.

The setup form requires a unique username and a password of at least 12 characters. Display name and contact email are optional. Passwords are masked, confirmed in the browser, hashed before storage, and never returned or logged.

Initial creation is protected by a short-lived same-site setup token, request throttling, and an atomic empty-database check. Concurrent setup attempts can create at most one administrator. The setup endpoint closes permanently as soon as any user exists; it is not a registration endpoint.

After signing in:

1. Open Users and create a second administrator for recovery.
2. Store administrator credentials through an approved private process.
3. Confirm the installation has a current off-host backup before adding projects or stored REST credentials.

See the Administrator Guide for account and application administration.

CLI fallback and recovery

Browser setup is the normal path. A host operator can explicitly bootstrap an empty database or recover one existing local administrator by running the compiled production command documented in Administrative bootstrap and recovery.

Recovery cannot create another account after setup or elevate a normal user. It targets an existing administrator, re-enables it, replaces its password, and revokes its sessions.