fix: fail closed weak password opt-in

central/app/human_auth.py

@@ -40,7 +40,7 @@ def create_admin(session, username: str, password: str):
     if len(username) < 3:
         raise ValueError("username must have 3 characters")
     environment = os.getenv("APP_ENV") or settings.environment
-    weak_passwords_allowed = os.getenv("ALLOW_WEAK_DEV_PASSWORD", "1" if settings.allow_weak_dev_password else "0") == "1"
+    weak_passwords_allowed = os.getenv("ALLOW_WEAK_DEV_PASSWORD", "0") == "1"
     if len(password) < 12 and (environment.strip().lower() == "production" or not weak_passwords_allowed):
         raise ValueError("password must have 12 characters")
     if session.scalar(select(AdminUser).where(AdminUser.username == username)):

central/tests/test_control_plane.py

@@ -1,4 +1,5 @@
 from datetime import datetime, timedelta, timezone
+import importlib
 import pytest
 
 from fastapi.testclient import TestClient
@@ -57,6 +58,21 @@ def test_short_local_password_requires_explicit_setting(monkeypatch):
         assert verify_password("admin", admin.password_hash)
 
 
+def test_removed_weak_password_flag_is_fail_closed_after_import(monkeypatch):
+    monkeypatch.setenv("ALLOW_WEAK_DEV_PASSWORD", "1")
+    import central.app.config as config_module
+    import central.app.human_auth as human_auth_module
+
+    importlib.reload(config_module)
+    importlib.reload(human_auth_module)
+    session_factory = setup_db()
+    with session_factory() as session:
+        assert human_auth_module.create_admin(session, "admin", "admin").username == "admin"
+        monkeypatch.delenv("ALLOW_WEAK_DEV_PASSWORD", raising=False)
+        with pytest.raises(ValueError):
+            human_auth_module.create_admin(session, "admin2", "admin")
+
+
 def test_production_admin_keeps_strong_password_minimum(monkeypatch):
     session_factory = setup_db()
     with session_factory() as session: