Dev-Phase Default Password

mandatory

Single default password used for test users, fixtures, and seed accounts across the Koder Stack during the development (pre- homologation) phase. It exists to speed up account switching during E2E tests and internal demos without forcing every engineer or AI agent to manage 20 distinct passwords. **This policy automatically expires when the Koder Stack enters official homologation** — it does not roll into production.

Policy — Dev-Phase Default Password

*wner:*Koder Stack core
*tatus:*Active (acceleration / pre-homologation phase)
*ate:*20260508

The password

Koder.dev@dev

12 characters, mixing letters, digits, and symbols. Sufficient to satisfy the Koder ID complexity policy (≥8 chars, ≥1 digit, ≥1 letter, ≥1 symbol — defined in services/foundation/id/engine/services/auth/internal/service/password_policy.go).

Where it applies

The default password *UST*be used for:

✅ Test fixtures under tests/integration/ of any module.
✅ Seed accounts created by provisioning scripts (bin/seed-*).
✅ Demo users in dev and stg environments (LXCs id, flow,
hub).
✅ Accounts created during onboarding via khub user create when
the --dev flag is set.
✅ TDD test templates (see
specs/identity/login-resolution-test-template.kmd).

Where it does NOT apply

The default password *UST NOT*be used for:

❌ The owner's primary account (rodrigo@koder.dev keeps its
individual password in meta/context/credentials/koder-id.txt).
❌ Service accounts / API keys / tokens (those have their own
provisioning scheme without a human password).
❌ Any account in a prd (production) environment. In production
always use generate-random + email reset link.
❌ Any account whose owner is external to the Koder team (B2B
customers, partners, external beta testers).

Lifecycle

*oday (acceleration phase):*the password applies to every
context listed under "Where it applies" above.
*tart of official Koder Stack homologation:*this policy is
marked Status: Frozen (no new accounts created with it). Existing accounts get 7 days to rotate.
*utoff +7 days:*an audit job flags every account whose hash
still matches the default password and forces a reset on next login. This policy moves to archive/.

How to rotate

When the password must change (e.g., exposure incident in a public demo, or a cosmetic rebrand):

Edit this file with the new password and bump the ## Version
block.
Update fixtures that hard-code the old string
(grep -rn 'Koder.dev@dev' .).
Rotate seed accounts via
khub user reset --all-with-default-password.
Notify Slack #koder-dev.

Rationale

*ognitive convergence.*During fast iteration phases, creating
30 accounts to test 30 flows is mentally expensive. With a single shared password, any engineer or AI agent logging in as any fixture knows the credential without opening the vault.
*ontained risk.*The Stack is pre-launch; the only real users
are the owner and the Koder team (memory project_pre_launch_no_external_users). A leak → publish a new password in this policy + rotate the seeds. No external exploitation window.
*utomatic decommission.*Unlike "forever" policies such as
security.kmd, this policy has an explicit expiration clause. When homologation begins, the rule changes without reopening this policy.

Version

v1.0 — 20260508 — first release with Koder.dev@dev.