fix: allow local development admin password

central/app/human_auth.py

@@ -37,8 +37,8 @@ def verify_password(password: str, stored: str) -> bool:
 
 def create_admin(session, username: str, password: str):
     username = username.strip().lower()
-    if len(username) < 3 or len(password) < 12:
-        raise ValueError("username must have 3 characters and password 12 characters")
+    if len(username) < 3:
+        raise ValueError("username must have 3 characters")
     if session.scalar(select(AdminUser).where(AdminUser.username == username)):
         raise ValueError("username already exists")
     admin = AdminUser(username=username, password_hash=hash_password(password))

central/scripts/create_admin.py

@@ -8,7 +8,7 @@ from central.app.human_auth import create_admin
 
 def main():
     username = input("Admin username: ").strip()
-    password = getpass.getpass("Admin password (12+ chars): ")
+    password = getpass.getpass("Admin password: ")
     confirmation = getpass.getpass("Confirm password: ")
     if password != confirmation:
         raise SystemExit("passwords do not match")

central/tests/test_control_plane.py

@@ -44,6 +44,14 @@ def test_password_and_event_redaction_and_retention():
         assert session.get(AgentEvent, old.id) is None and session.get(AgentEvent, keep.id) is not None
 
 
+def test_local_development_admin_accepts_operator_supplied_short_password():
+    session_factory = setup_db()
+    with session_factory() as session:
+        admin = create_admin(session, "admin", "admin")
+        assert admin.username == "admin"
+        assert verify_password("admin", admin.password_hash)
+
+
 def test_health_model_separates_safe_blocked_from_technical_failure():
     now = datetime.now(timezone.utc)
     recent = SimpleNamespace(last_seen_at=now, failed_products=0, last_job_status="COMPLETED")