# Task 1 Report: Presentation Helpers And Password Policy

## Status

Implemented Task 1 only. The existing server-rendered architecture and fiscal behavior were not changed.

## Changed Files

- `central/app/panel_presentation.py`: added timezone-aware UI datetime, age, duration, operational priority, and health-label helpers.
- `central/app/config.py`: added `ui_timezone` (default `America/Bahia`) and `allow_weak_dev_password` settings.
- `central/app/human_auth.py`: restored the 12-character minimum unless the process is non-production and `ALLOW_WEAK_DEV_PASSWORD=1`; the flag is read at call time.
- `central/tests/test_panel_presentation.py`: added helper contract tests.
- `central/tests/test_control_plane.py`: added explicit opt-in and production password-policy tests.
- `docker-compose.yml`: explicitly enables weak development passwords for the local `fiscal-hub` service.

## RED Evidence

Command:

```text
python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q
```

Result: collection failed with `ModuleNotFoundError: No module named 'central.app.panel_presentation'`, proving the new helper module was absent.

The control-plane tests were then run independently:

```text
python -m pytest central/tests/test_control_plane.py -q
```

Result: `2 failed, 3 passed`. Both new password-policy tests failed because the pre-change implementation accepted short passwords without the required environment gate.

## GREEN Evidence

Focused command:

```text
python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q
```

Result: `10 passed`.

Focused command including configuration coverage:

```text
python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py central/tests/test_config.py -q
```

Result: `11 passed`.

Full central regression:

```text
python -m pytest central/tests -q
```

Result: `241 passed, 1 warning`. The warning is the existing `openpyxl` print-area warning from `central/tests/test_bootstrap_v1_extra.py`.

`git diff --check` and the staged diff check completed without whitespace errors.

## Commit

Implementation commit: `0846b9d1b076c60c57ad2a30a3071480a680bccf` (`feat: add operational panel presentation helpers`).

## Concerns

- The existing pytest environment emits one non-failing `pytest-asyncio` deprecation warning; the full central suite also emits the pre-existing `openpyxl` warning noted above.
- `operational_priority` intentionally uses only operational blocker type, field, and reason signals; it does not infer fiscal severity.

## Reviewed Finding Fix

Finding: `create_admin` used the import-time `settings.allow_weak_dev_password` value as the default for the call-time environment lookup. If the flag was enabled during import and later removed, short passwords remained accepted.

Fix: `ALLOW_WEAK_DEV_PASSWORD` now defaults to `"0"` at every call. The existing `APP_ENV != production` check remains enforced, and Docker Compose still explicitly sets `ALLOW_WEAK_DEV_PASSWORD: "1"` for the local `fiscal-hub` service.

Regression RED command:

```text
python -m pytest central/tests/test_control_plane.py::test_removed_weak_password_flag_is_fail_closed_after_import -q
```

Result before the fix: `1 failed`; after reloading configuration/auth with the flag enabled, removing the flag did not raise `ValueError` for a short password.

Regression GREEN command:

```text
python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q
```

Result: `11 passed`.

Full central regression:

```text
python -m pytest central/tests -q
```

Result: `242 passed, 1 warning`; the warning is the existing `openpyxl` print-area warning.

Fix commit: `de571e3ac2ce214677e1f9baa673181350b7d411` (`fix: fail closed weak password opt-in`).