Task 1 Report: Presentation Helpers And Password Policy

Status

Implemented Task 1 only. The existing server-rendered architecture and fiscal behavior were not changed.

Changed Files

central/app/panel_presentation.py: added timezone-aware UI datetime, age, duration, operational priority, and health-label helpers.
central/app/config.py: added ui_timezone (default America/Bahia) and allow_weak_dev_password settings.
central/app/human_auth.py: restored the 12-character minimum unless the process is non-production and ALLOW_WEAK_DEV_PASSWORD=1; the flag is read at call time.
central/tests/test_panel_presentation.py: added helper contract tests.
central/tests/test_control_plane.py: added explicit opt-in and production password-policy tests.
docker-compose.yml: explicitly enables weak development passwords for the local fiscal-hub service.

RED Evidence

Command:

python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q

Result: collection failed with ModuleNotFoundError: No module named 'central.app.panel_presentation', proving the new helper module was absent.

The control-plane tests were then run independently:

python -m pytest central/tests/test_control_plane.py -q

Result: 2 failed, 3 passed. Both new password-policy tests failed because the pre-change implementation accepted short passwords without the required environment gate.

GREEN Evidence

Focused command:

python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q

Result: 10 passed.

Focused command including configuration coverage:

python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py central/tests/test_config.py -q

Result: 11 passed.

Full central regression:

python -m pytest central/tests -q

Result: 241 passed, 1 warning. The warning is the existing openpyxl print-area warning from central/tests/test_bootstrap_v1_extra.py.

git diff --check and the staged diff check completed without whitespace errors.

Commit

Implementation commit: 0846b9d1b076c60c57ad2a30a3071480a680bccf (feat: add operational panel presentation helpers).

Concerns

The existing pytest environment emits one non-failing pytest-asyncio deprecation warning; the full central suite also emits the pre-existing openpyxl warning noted above.
operational_priority intentionally uses only operational blocker type, field, and reason signals; it does not infer fiscal severity.

Reviewed Finding Fix

Finding: create_admin used the import-time settings.allow_weak_dev_password value as the default for the call-time environment lookup. If the flag was enabled during import and later removed, short passwords remained accepted.

Fix: ALLOW_WEAK_DEV_PASSWORD now defaults to "0" at every call. The existing APP_ENV != production check remains enforced, and Docker Compose still explicitly sets ALLOW_WEAK_DEV_PASSWORD: "1" for the local fiscal-hub service.

Regression RED command:

python -m pytest central/tests/test_control_plane.py::test_removed_weak_password_flag_is_fail_closed_after_import -q

Result before the fix: 1 failed; after reloading configuration/auth with the flag enabled, removing the flag did not raise ValueError for a short password.

Regression GREEN command:

python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q